+Lathe26 Posted March 31, 2019 Share Posted March 31, 2019 Mattel Test Cartridges Mattel's test cartridges were used by Mattel and others to diagnose malfunctioning Intellivision consoles. This is an attempt to document the various Mattel Test Cartridges out there. This information is likely incomplete. As folks contribute more info, this original post will be updated. Note that freewheel's "FW Diagnostics" cartridge is not listed here but is a modern homebrew test cartridge. Known CartridgesThere are 7 known Mattel test cartridges. They vary by 2 things: Version of the test code Whether a game plays at the end They are: Version Displayed Successful Name Version Ending Original Label ------- --------- ---------- -------------- v1.0 <none> no game, "PASS-PASS-PASS" VIDEO TEST CARTRIDGE v1.0a V1A no game, "PASS-PASS-PASS" ? v3 V3 Baseball MTE 201 TEST CARTRIDGE v3b V3 Night Stalker ? v3.3 V3.3 blank green screen ? v4.1a V4.1 blank green screen ? v4.1b V4.1 Night Stalker ? "Version Name" is the common name given to ROM files. For example, v4.1a and v4.1b have identical testing code and only differ by whether the game Night Stalker runs at the end of successful tests. Note that v3 is also commonly called "MTE-201" but will be mostly referred to as V3 for naming consistency with the other cartridges."Displayed Version" is shown in the lower left corner (except for v1.0). Confusing the issue of labels is that even among cartridges that are otherwise exactly identical, the printed labels vary. However, most of label variations appear to be non-original labels (ex: someone printed a new label with a name they picked) and some of these non-original labels are easy to spot. For example, in the photo below, the left label is fortunately correct but it uses a modern font that on paper with rounded corners only on the top half. Some non-original labels with different text look somewhat similar. Most of this document will use the Displayed Version to differentiate between the cartridges since the test code, not the game, is the focus. The exception is the "Video Test Cartridge" that will simply be called V1. Results on Various SystemsMost of the cartridges will pass a functioning original Mattel Intellivision (includes Tandyvision One and GTE Sylvania). However, the Sears Intellivision, Intellivision II, and Tutorvisions have differences that will cause the early versions to incorrectly report a failure. The later cartridges attempt identify what system they are on and print it in the lower left corner with an "M" or "O" sometimes followed by the number "1" or "2". One exception is V3.3, which was intended to only test the Intellivision II. Oddly, it incorrectly identifies the Intellivision II as "O" rather than the expected "M" or "M2" due to a bug in the code (thanks to JoeZ for the analysis). However, it will correctly test the Intellivision II. In the table below, each system lists 3 things: What system was displayed in the lower left corner (or n/a if nothing was displayed) What tests failed, identified by letter (ex: B) What chips failed, identified by the circuit board's name of the chip (ex: U09) Version INTV 1 Results Sears Results INTV II Results ------- -------------- ------------- --------------- V1 n/a | Pass n/a | Pass n/a | Fail B, C, J | U03, U06, U09 V1A n/a | Pass n/a | Pass n/a | Fail B, C, J | U03, U06, U09 V3 n/a | Pass n/a | Fails L, M | U03, U09 n/a | Fail B, J, M | U03, U06, U09 V3.3 O | Fails B | U03 O | Fails B | U03 O | Pass V4.1 M1 | Pass O1 | Pass O2 | Pass Tutorvision results are missing from above since Lathe26's TutorPro's already damaged RCA jack broke off. Failure CodesSo far, only full service manuals for V1 / V1A, and V3 (MTE-201) have been found that list failure letters (ex: V1 reports test B failed) and which chips they map to (ex: V1 identifies U9 as bad). These come from the "Sylvania Intellivision Service Manual", from the "Intellivision Service Manual", and from Papa Intellivision's "CCF10232011_00012". Both documents are attached to this post below but the relevant tables are here. V1 / V1A Failure Table V3 Failure Table V3 Failure Table (alternative) Note that Lathe26 has a "Sylvania Intellivision Service Manual" and eventually plans to scan it in color. This includes a separate addendum that apparently has never been scanned before that the covers differences from the first Intellivisions (serial numbers <4000) from later serial numbers. Acronyms IMI = Incoming Material Inspection MTE = ?? 1+7 Test MenuAt the controller testing screen, if the user presses 1+7 at the same time, the user is presented with a Test Menu on the later test cartridges. It allows the user to run individual tests one at a time. This menu is operated with the right controller only. Simply type in the test's number and press Enter. Type in "00" and Enter to exit the menu. Version Test Menu ------- --------- V1 no V1A no V3 Yes V3.3 Yes V4.1 Yes There is some variation in the menus, mostly notably because the V3.3 cartridge test the Intellivision II which has slightly different chips. V3 Test Menu V3.3 Test Menu V4.1 Test Menu 2+8 Checksum Screen and GamesAt the controller testing screen, if the user presses 2+8 at the same time, checksums of any game code will be displayed. The checksum is displayed for all test cartridges even though only some of the test cartridges will play the game after a successful test pass. Only the later test cartridges will play a game if the tests are successful by jumping to code starting at the $5000 address range. Earlier test cartridges lack code to jump to a game, even though they will calculate the checksums. Further, there 2 slightly different ways the checksum is calculated. In all cases, the checksum is simply a 16-bit of various memory ranges. Older test carts display 2 numbers in octal format called "CART CHECKSUM LO" and "CART CHECKSUM HI". These correspond to checksums calculated for the 2K word ranges of $5000-$57FF and $5800-$5FFF, respectively. The checksum is displayed whether or not a game is present. When a game is not present, 00777774000 is displayed (the sum of 2K's worth of the value $FFFF). Newer test carts display a list of memory ranges by displaying a list of hexadecimal numbers in the left column (ex: "5" means the 4K memory range of $5000-$5FFF) and then display a checksum in octal next to it. This displays multiple memory ranges from 5xxx through Fxxx. Checksums are only displayed if code is present. These cartridges always skip 1 number in the 5xxx through Fxxx range (V3.3 skips 7xxx while V4.1 skips Cxxx). Below are the known cartridges: Version Low Chksum Hi Chksum Checksum 5 Game ------- ---------- --------- ---------- ---- v1.0 00777774000 00777774000 n/a none v1.0a 00777774000 00777774000 n/a none v3 00002371677 00003372642 n/a Baseball v3b 00001014317 00002732341 n/a Night Stalker v3.3 n/a n/a n/a none v4.1a n/a n/a n/a none v4.1b n/a n/a 00003746660 Night Stalker Note that for the 2 cartridges with Night Stalker that adding the checksum values of 00001014317 with 00002732341 results in 00003746660. Most games can be used with the test cartridges. As an experiment, the game Brickout, which was never released by Mattel, was added to each of the test cartridges. This game was chosen so the ROMs would never be confused with legitimate ROMs from real test cartridges. This game is <2K so the HI checksum is 00000000000 and the LO checksum is 00001604524. Later test cartridges also display the same 00001604524 value. The below table also shows that V1 and V1A don't play the game. Version Game Appended Low Chksum Hi Chksum Checksum 5 Game plays? ------- ------------- ---------- --------- ---------- ----------------- V1 Brickout 00001604524 00000000000 n/a No V1A Brickout 00001604524 00000000000 n/a No V3 Brickout 00001604524 00000000000 n/a Yes V3.3 Brickout n/a n/a 00001604524 Yes V4.1 Brickout n/a n/a 00001604524 Yes Using Brickout, the checksum displays are: V1, V1A, and V3 Checksum Screen V3.3 Checksum Screen V4.1 Checksum Screen Interestingly, V4.1 is compatible with the ECS and will display checksums of the ECS ROMs as well. This only occurs for the real v4.1 test cartridges. The LTO FLASH disables the ECS ROMs so a V4.1 ROM running from the LTO FLASH will not see it (likely changeable via an LTO setting). The Brickout versions of the various Test Cartridges are attached at the bottom of post. Also, a Unix Bash script is included that will compute checksums for any game or other ROMs such as from the ECS (script tested under the Cygwin shell). Memory Ranges and ECS CompatibilityThe test cartridges code (excluding any game code), use the following address ranges. Version Size Memory Ranges ------- ---- ---------------------------- V1 8KB $7000 - $7FFF V1A 8KB $7000 - $7FFF V3 8KB $7000 - $7FFF V3.3 16KB $4000 - $4FFF, $C000 - $CFFF V4.1 12KB $4800 - $4FFF, $C000 - $CFFF Note that only the V4.1 is compatible with the ECS. Older cartridges either conflict with the ECS's $7000-$7FFF range or with the ECS's RAM at $4000-$47FF. Cartridge InternalsSome of the test cartridges have been opened up and photographed. This shows what the chip numbers and manufacturing dates were. What's interesting is that some of the cartridges show that the test code was on one chip while the game code was from same chip that was used in the normal game's cartridge. v1.0 (no game) shield is soldered onto the board, two chips are visible underneath v1.0a (no game) no photo v3 (Baseball) v3 (Night Stalker) board appears to be a standard Night Stalker board that the 994 chip was added at a later time (solder work on underside of board for 994 chip is noticeably different) v3.3 (no game) no photo v4.1a (no game) v4.1b (Night Stalker) no photo IMI Tester-MTE 100Briefly, there is a portable Intellivision diagnostic system that enables testing individual chips. It is called the IMI Tester-MTE 100. It comes with what appears to be an MTE-201 (i.e. a V3) built into it. More information on this system is available at http://www.intvfunhouse.com/hardware/mte100/ AcknowledgementWhile small parts of this was from my own investigations, the vast majority of this information was many other people who scanned, photographed, dumped, and analyzed the cartridges long before my involvement. Most of this documentation stands on their shoulders. Test Carts with Brickout and Checksum Calculator.zip Sylvania Intellivision Service Manual.pdf Intellivision Service Manual - Big One.pdf 18 1 Quote Link to comment Share on other sites More sharing options...
+JasonlikesINTV Posted March 31, 2019 Share Posted March 31, 2019 Wow! Thanks for documenting all of this! Excellent resource. 2 Quote Link to comment Share on other sites More sharing options...
+intellivotion Posted March 31, 2019 Share Posted March 31, 2019 Impressive! Amazing dissertation with academic-like approach. I'm proud to be part of this community 3 Quote Link to comment Share on other sites More sharing options...
+cmart604 Posted March 31, 2019 Share Posted March 31, 2019 Impressive! Amazing dissertation with academic-like approach. I'm proud to be part of this comunity You understand that Rev is part of the community too right? You may want to reconsider your statement. ? 2 Quote Link to comment Share on other sites More sharing options...
+intellivotion Posted March 31, 2019 Share Posted March 31, 2019 You understand that Rev is part of the community too right? You may want to reconsider your statement.Victoria's Secret angels also have to fart sometimes. That doesn't make them less pretty. 3 Quote Link to comment Share on other sites More sharing options...
+cmart604 Posted March 31, 2019 Share Posted March 31, 2019 Victoria's Secret angels also have to fart sometimes. That doesn't make them less pretty. Hahahahaha! Quote Link to comment Share on other sites More sharing options...
Intymike Posted March 31, 2019 Share Posted March 31, 2019 Victoria's Secret angels also have to fart sometimes. That doesn't make them less pretty. But probably noisy and smelly. Quote Link to comment Share on other sites More sharing options...
+the1hatman Posted March 31, 2019 Share Posted March 31, 2019 Victoria's Secret angels also have to fart sometimes. That doesn't make them less pretty. This may be the post of the century. 2 Quote Link to comment Share on other sites More sharing options...
intvnut Posted March 31, 2019 Share Posted March 31, 2019 The LTO FLASH disables the ECS ROMs You can control this via one of two mechanisms: Add an "ecs_compat = 2" statement to the [vars] section of the config to say that the cartridge is "enhanced by" the ECS. Or change the corresponding ROM property in the LTO Flash GUI. (Screen shots below.) Change the LTO Flash ECS ROM enable policy to "Always" or "Compatible". I prefer to change the ROM properties. If you set the LTO Flash ECS ROM enable policy to "Always" or "Compatible," then you have to navigate through that ECS title screen when playing other games such as, say, Astrosmash. I prefer to leave it set to "ECS Games," and then edit the ROM properties of specific titles as needed. Here's what the ROM features screen looks like on Mac: And here's where you can change LTO Flash's overall policy: 1 Quote Link to comment Share on other sites More sharing options...
intvnut Posted March 31, 2019 Share Posted March 31, 2019 (edited) Also, digging up a comment I made awhile back on Facebook. V3 seems to have code that anticipated the Intellivision III: OK... for the sleuths out there, I found the test in MTE-201.It looks for $28 in location $2FFC, and $CA in $10EB. I'm not quite sure what it does with that info, but that's the check it performs.$2FFC does not contain $0028 in either the WBEXEC or the ECS ROMs at this location. The only other hardware I know of at $2xxx is Coffee's EXEC.The test appears starting at $75EC in MTE-201 V3. Here's the code: . SDBD ; 75EB 0001 MVII #$2FFC, R3 ; 75EC 02BB 00FC 002F MVII #$00A8, R0 ; 75EF 02B8 00A8 CMPI #$0028, R3 ; 75F1 037B 0028 BNEQ L_75F7 ; 75F3 020C 0002 MVII #$00CA, R0 ; 75F5 02B8 00CA L_75F7: SDBD ; 75F7 0001 MVII #$10EB, R5 ; 75F8 02BD 00EB 0010 CMP@ R5, R0 ; 75FB 0368 BNEQ L_7645 ; 75FC 020C 0047 . Also, the MTE failure codes are also documented in one of the procurement specifications on PapaIntellivision: (CCF10232011_00012.pdf) Edited March 31, 2019 by intvnut 2 Quote Link to comment Share on other sites More sharing options...
intvnut Posted March 31, 2019 Share Posted March 31, 2019 BTW, that customer procurement specification I linked above also has a STIC specification that's pretty detailed, along with specifications for other chips. It's a huge, fascinating document. The system test cartridge description starts on page 174 and is dated 5/7/1982. Quote Link to comment Share on other sites More sharing options...
intvnut Posted March 31, 2019 Share Posted March 31, 2019 Also: According to the customer procurement specification, IMI stands for "Incoming Material Inspection." I'd never noticed that before! intvsteve has one of the described IMI units. It's a bizarre metal suitcase. 3 Quote Link to comment Share on other sites More sharing options...
+Lathe26 Posted March 31, 2019 Author Share Posted March 31, 2019 Regarding the suitcase, I find the 3-way switch interesting. Test vs Checksum seems easy to figure out (short controller pins to look like 2+8 was pressed) but it sounds like there way also a way to bypass the tests and go straight to the game. "I haven't traced the three-way Checksum/Game/Test switch circuitry in detail yet. I can say that in Checksum mode, one controller's pins are shorted such that the MTE-201 is forced into the Checksum test. It does not appear that a new test ROM variation is to be found here... A dump is necessary! The Checksum/Game/Test switch also seems capable of switching which cart is used by shorting (or not) pin 37 of the MTE-201's cartridge port edge connector to pin 38 of the main connector. I haven't quite figured this out yet." If someone knows how this was done, that would be interesting to know... 2 Quote Link to comment Share on other sites More sharing options...
intvnut Posted March 31, 2019 Share Posted March 31, 2019 (edited) Regarding the suitcase, I find the 3-way switch interesting. Test vs Checksum seems easy to figure out (short controller pins to look like 2+8 was pressed) but it sounds like there way also a way to bypass the tests and go straight to the game. "I haven't traced the three-way Checksum/Game/Test switch circuitry in detail yet. I can say that in Checksum mode, one controller's pins are shorted such that the MTE-201 is forced into the Checksum test. It does not appear that a new test ROM variation is to be found here... A dump is necessary! The Checksum/Game/Test switch also seems capable of switching which cart is used by shorting (or not) pin 37 of the MTE-201's cartridge port edge connector to pin 38 of the main connector. I haven't quite figured this out yet." If someone knows how this was done, that would be interesting to know... Just a hunch here, but my guess is that they're selectively connecting or disconnecting the BDIR pin to prevent the ROM in a plugged-in cartridge from seeing the DTB and ADAR bus phases, effectively "deselecting" it. (I'd guess there's a pullup when BDIR isn't connected.) Pins 37 and 38 are the two copies of BDIR on the cartridge port. For the curious, this page describes the bus phases and the cartridge port wiring. Edited March 31, 2019 by intvnut 1 Quote Link to comment Share on other sites More sharing options...
+Lathe26 Posted April 1, 2019 Author Share Posted April 1, 2019 Also: According to the customer procurement specification, IMI stands for "Incoming Material Inspection." I'd never noticed that before! Screen Shot 2019-03-31 at 2.21.51 PM.png intvsteve has one of the described IMI units. It's a bizarre metal suitcase. I recall knowing what IMI stood for at one time but total forgot recently. Thanks for reminding me. I added it above. Any ideas on what MTE stands for? I have guesses but documentation would be better. I'll have to add the suitcase above later. It's not a cartridge, but the MTE100 should be mentioned. Edit: added the MTE 100 1 Quote Link to comment Share on other sites More sharing options...
+Lathe26 Posted April 1, 2019 Author Share Posted April 1, 2019 Also, digging up a comment I made awhile back on Facebook. V3 seems to have code that anticipated the Intellivision III: Here's the code: . SDBD ; 75EB 0001 MVII #$2FFC, R3 ; 75EC 02BB 00FC 002F MVII #$00A8, R0 ; 75EF 02B8 00A8 CMPI #$0028, R3 ; 75F1 037B 0028 BNEQ L_75F7 ; 75F3 020C 0002 MVII #$00CA, R0 ; 75F5 02B8 00CA L_75F7: SDBD ; 75F7 0001 MVII #$10EB, R5 ; 75F8 02BD 00EB 0010 CMP@ R5, R0 ; 75FB 0368 BNEQ L_7645 ; 75FC 020C 0047 . Also, the MTE failure codes are also documented in one of the procurement specifications on PapaIntellivision: (CCF10232011_00012.pdf) Screen Shot 2019-03-31 at 2.05.54 PM.png That is really awesome. I had no idea this was hidden in there. I did some poking around and... Only the V3 has this code. It was removed in V3.3 and V4.1. I tried to decode what the code is doing but didn't figure it out in the limit time I had. As an alternative, I fed in data that the code expected. I extended MTE-201 ROM image to have a $2xxx with $2FFC set to $0028. Only making this change caused test M to fail (somewhat expected). Then I tried modifying $10EB to $00CA (and modified another value to offset the change in checksum value) but that resulted in test L failing (surprising). Then I changed $10EB back and then changed $1FFC to $0028 (and another value to compensate for the checksum) and this worked. By worked, I just mean that V3 simply stopped reporting failing tests and chips. Edit: I realized something as I stepped through the code in jzintv... the CMPI #$0028, R3 is not comparing $28 to what is stored at the address in R3, its comparing $28 to the value in R3 which is $2FFC. The BNEQ will always be taken. I was fooled by this as well. It looks like this is the remnants of left over dead code. Edit: The $2FFC check is done right in a 2nd place just a little bit below in what originally thought was dead code. However, setting a breakpoint at $761C works does hit the address. After inspecting the stack, what appears to be going on is that a separate block of code is loading an address from a table into R0 and then MOVR R0, R7 (MOVR is at address $7ABB, table at $7FEA to $7FFA) which is how the below code is even reached. PSHR R5 ; 7616 0275 MVII #$004D, R0 ; 7617 02B8 004D MVO R0, G_033F ; 7619 0240 033F SDBD ; 761B 0001 MVII #$2FFC, R5 ; 761C 02BD 00FC 002F MVI@ R5, R3 ; 761F 02AB CLRR R0 ; 7620 01C0 CMPI #$0028, R3 ; 7621 037B 0028 BNEQ L_7627 ; 7623 020C 0002 MVII #$0028, R0 ; 7625 02B8 0028 L_7627: SDBD ; 7627 0001 MVII #$1FFC, R5 ; 7628 02BD 00FC 001F CMP@ R5, R0 ; 762B 0368 BNEQ L_7645 ; 762C 020C 0017 At this point, I'm not ready to add this information above, unless you think adding the speculation on Coffee (Intellivision III) is strong enough. As an alternative explanation, do you think the checks might have been for an early internal version of the Intellivision II? 2 Quote Link to comment Share on other sites More sharing options...
+Lathe26 Posted April 1, 2019 Author Share Posted April 1, 2019 Just a hunch here, but my guess is that they're selectively connecting or disconnecting the BDIR pin to prevent the ROM in a plugged-in cartridge from seeing the DTB and ADAR bus phases, effectively "deselecting" it. (I'd guess there's a pullup when BDIR isn't connected.) Pins 37 and 38 are the two copies of BDIR on the cartridge port. For the curious, this page describes the bus phases and the cartridge port wiring. I think I see where I goofed: I overlooked that the MTE 100 has a cartridge slot. Thus, I misinterpreted that the "Game" position of the switch caused the built-in MTE-201 board to jump to the Baseball code. Dumber yet, I spent a couple hours looking at the V3 assembly code trying to find a way for some magic button combo on the controller to trigger jumping straight to the game. 1 Quote Link to comment Share on other sites More sharing options...
intvnut Posted April 1, 2019 Share Posted April 1, 2019 Any ideas on what MTE stands for? I have guesses but documentation would be better. I do not know. If I had to guess, I'd say "Mattel Test Equipment" or "Manufacturing Test Equipment." I think I see where I goofed: I overlooked that the MTE 100 has a cartridge slot. Thus, I misinterpreted that the "Game" position of the switch caused the built-in MTE-201 board to jump to the Baseball code. Now that would be a real trick! You'd have to prevent address $7xxx from getting sent to the cart, while allowing $5xxx. That is really awesome. I had no idea this was hidden in there. I did some poking around and... Only the V3 has this code. It was removed in V3.3 and V4.1. I tried to decode what the code is doing but didn't figure it out in the limit time I had. As an alternative, I fed in data that the code expected. I extended MTE-201 ROM image to have a $2xxx with $2FFC set to $0028. Only making this change caused test M to fail (somewhat expected). Then I tried modifying $10EB to $00CA (and modified another value to offset the change in checksum value) but that resulted in test L failing (surprising). Then I changed $10EB back and then changed $1FFC to $0028 (and another value to compensate for the checksum) and this worked. By worked, I just mean that V3 simply stopped reporting failing tests and chips. Edit: I realized something as I stepped through the code in jzintv... the CMPI #$0028, R3 is not comparing $28 to what is stored at the address in R3, its comparing $28 to the value in R3 which is $2FFC. The BNEQ will always be taken. I was fooled by this as well. It looks like this is the remnants of left over dead code. Edit: The $2FFC check is done right in a 2nd place just a little bit below in what originally thought was dead code. However, setting a breakpoint at $761C works does hit the address. After inspecting the stack, what appears to be going on is that a separate block of code is loading an address from a table into R0 and then MOVR R0, R7 (MOVR is at address $7ABB, table at $7FEA to $7FFA) which is how the below code is even reached. PSHR R5 ; 7616 0275 MVII #$004D, R0 ; 7617 02B8 004D MVO R0, G_033F ; 7619 0240 033F SDBD ; 761B 0001 MVII #$2FFC, R5 ; 761C 02BD 00FC 002F MVI@ R5, R3 ; 761F 02AB CLRR R0 ; 7620 01C0 CMPI #$0028, R3 ; 7621 037B 0028 BNEQ L_7627 ; 7623 020C 0002 MVII #$0028, R0 ; 7625 02B8 0028 L_7627: SDBD ; 7627 0001 MVII #$1FFC, R5 ; 7628 02BD 00FC 001F CMP@ R5, R0 ; 762B 0368 BNEQ L_7645 ; 762C 020C 0017 At this point, I'm not ready to add this information above, unless you think adding the speculation on Coffee (Intellivision III) is strong enough. As an alternative explanation, do you think the checks might have been for an early internal version of the Intellivision II? Oh wow, thank's for the additional sleuthing! I had dug into this particular weird $2FFC check before—I had detected it by doing a "read watch" on $2000 - $2FFF in jzIntv's debugger—but apparently I had found the "b0rken" version of the check when I looked at the disassembly. I first noticed this several years ago, and then sorta forgot about it until Don Daglow posted about overseeing Coffee's development on FB. It's weird that both versions—the b0rken test and a working test—are in the final ROM. Based on all of the memory maps I've seen from Papa Intellivision across a range of dates, I'm pretty certain that $2xxx was always reserved for Coffee and Lucky. The Intellivision II's revised EXEC did not ever occupy any of $2xxx. 1 Quote Link to comment Share on other sites More sharing options...
Intymike Posted April 1, 2019 Share Posted April 1, 2019 The German service manual, including usage of the MTE-201. I know of two of these to exist - one is mine, from where the PDF is made of and one is owned by another Intellivision Brotherhood member. https://www.dropbox.com/home/Intellivision?preview=Intellivision+Service+Manual+German.pdf 3 Quote Link to comment Share on other sites More sharing options...
intvnut Posted April 1, 2019 Share Posted April 1, 2019 Then I tried modifying $10EB to $00CA (and modified another value to offset the change in checksum value) but that resulted in test L failing (surprising). I hadn't gone back to see what "test L" was in the lists last night. When I did just now, I realized it wasn't in any of the lists. I did some further digging though: This looks to be an incorrectly written test for the Sears EXEC. The Sears EXEC has $28 at $1FFC, and $CA at $10EB. 1 Quote Link to comment Share on other sites More sharing options...
intvnut Posted April 1, 2019 Share Posted April 1, 2019 I hadn't gone back to see what "test L" was in the lists last night. When I did just now, I realized it wasn't in any of the lists. I did some further digging though: This looks to be an incorrectly written test for the Sears EXEC. The Sears EXEC has $28 at $1FFC, and $CA at $10EB. OK, so I went and changed the $2FFCs to $1FFCs, and I manually made the b0rken test at $75F1 succeed. Now MTE-201 passes 100% when provided the Sears EXEC. This wasn't a check for Intellivision III. It was an incorrectly implemented check for the Sears EXEC. 1 Quote Link to comment Share on other sites More sharing options...
+Lathe26 Posted April 1, 2019 Author Share Posted April 1, 2019 I hadn't gone back to see what "test L" was in the lists last night. When I did just now, I realized it wasn't in any of the lists. I did some further digging though: This looks to be an incorrectly written test for the Sears EXEC. The Sears EXEC has $28 at $1FFC, and $CA at $10EB. OK, so I went and changed the $2FFCs to $1FFCs, and I manually made the b0rken test at $75F1 succeed. Now MTE-201 passes 100% when provided the Sears EXEC. This wasn't a check for Intellivision III. It was an incorrectly implemented check for the Sears EXEC. Nice work! While you were writing the 2nd post, I went looking around in V4.1 and found that the 2nd block of code ($7627) was corrected for the Sears EXEC but the 1st block ($75F7) was completely removed. In a nutshell, I was about to post the same conclusion that V3's code was an incorrectly written test for the Sears EXEC. V4.1's code: SDBD ; 4E24 0001 MVII #$10EB, R5 ; 4E25 02BD 00EB 0010 MVI@ R5, R3 ; 4E28 02AB CLRR R0 ; 4E29 01C0 CMPI #$00A8, R3 ; 4E2A 037B 00A8 BEQ L_4E30 ; 4E2C 0204 0002 MVII #$0028, R0 ; 4E2E 02B8 0028 L_4E30: SDBD ; 4E30 0001 MVII #$1FFC, R5 ; 4E31 02BD 00FC 001F CMP@ R5, R0 ; 4E34 0368 BNEQ L_4E1A ; 4E35 022C 001C PULR R7 ; 4E37 02B7 1 Quote Link to comment Share on other sites More sharing options...
+Lathe26 Posted April 1, 2019 Author Share Posted April 1, 2019 Joe probably already knows this, but I'll add the following for other readers. When looking at the disassembly for all the versions of the Test Cartridges, the code for all the versions is closely-related. It looks like the source code was handed down from version to version, with only some modifications and additions being added along the way (which makes business sense if you have the source code). Even V1 and V4.1 still have good-sized sections that look identical, once you ignore the shift address offsets for the branch and jump instructions. 3 Quote Link to comment Share on other sites More sharing options...
intvnut Posted April 1, 2019 Share Posted April 1, 2019 Joe probably already knows this, but I'll add the following for other readers. When looking at the disassembly for all the versions of the Test Cartridges, the code for all the versions is closely-related. It looks like the source code was handed down from version to version, with only some modifications and additions being added along the way (which makes business sense if you have the source code). Even V1 and V4.1 still have good-sized sections that look identical, once you ignore the shift address offsets for the branch and jump instructions. Indeed. If you look over the customer procurement specifications (CPS), they refer to various "patterns" that were to be delivered by GI for testing various components (and IIRC they were assigned numbers, perhaps CPS spec numbers). I can't find them just now. I do remember seeing notes in one of the PapaIntellivision docs indicating that the pattern #x tests the AY-3-8914, but needed to be revised to pattern #y which can test both AY-3-8914 and AY-3-8914A. (This makes sense: They removed one of the bits in each volume register.) I suspect these were all intended to be assembly modules that could then be linked together to form the whole. It makes a lot of sense to me to structure the software this way. 1 Quote Link to comment Share on other sites More sharing options...
+Lathe26 Posted November 7, 2019 Author Share Posted November 7, 2019 Real test cartridge that runs Spiker at the end! Wow! 5 Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.