Nybl - A Science Fair Microcomputer Trainer Emulator

[decle]

 

Hey there,

 

I offer up for your consideration Nybl, a Science Fair Microcomputer Emulator for the Intellivision. Perhaps the first emulator for the Intellivision, almost certainly its first emulator emulator.

 

nybl.rom

 

For more information on the Science Fair Microcomputer Trainer (SFMT), including a PDF version of the 180 page manual, I recommend:

• http://www.polylith.com/~brendan/ClassicComputers/Tandy/uCptrTrain.html
• http://tsoj.manga.org/gakken/otona_gmc.html

To use the emulator, simply move the cursor around the on-screen keypad with the D-pad, and select the current key with any action button.

 

Unlike the real SFMT, Nybl comes preprogrammed with a simple demo program. To run it, select 1, followed by the run / play button on the keypad. Somehow I don't think it will be the start of a burgeoning SFMT demo scene.

 

I should stress that this code has been developed and tested on Jzintv, and has not been run on an Intellivision. Therefore, your mileage may vary when running on real hardware.

 

Any and all feedback is most welcome, enjoy!

 

decle

 

 

 

 

 

And now, for the dweebs, some technical details.

 

 

Why do this?

For a long time I have wanted to write an emulator for the Intellivision. Not an emulator of the Intellivision, it was pretty clear from early on that Joe has this nailed, but an emulator for the Intellivision. I thought it might be an interesting challenge.

 

 

Why the SFMT?

There is a significant problem in writing any emulator for the Intellivision, the CP1610 at its heart is slow, unbelievably slow, even when compared with its 1970s peers like the 8080, 6502 and Z80.

 

Theoretically it can chew through between 75,000 and 225,000 instructions per second (75 – 225kips) in an NTSC Intellivision. Owing to different screen timing, these numbers are about 12% higher on PAL or SECAM Intellivisions. However, in typical use the NTSC values are even lower, probably somewhere around 100kips, owing to STIC cycle stealing and the fact that commonly used instructions like branches are not necessarily the fastest. This compares to more than 200kips for an 8080 clocked at 2MHz, 400kips for a 1MHz 6502 and over 500kips for a Z80 clocked at 4MHz. Although the relative sophistication of the CP1610's 16 bit registers and instruction set can be a benefit, when writing an emulator they are no real substitute for instruction throughput.

 

So the key to writing an emulator for the Intellivision is finding a subject where the CPU is even slower than the CP1610, but is still used in an interesting application.

 

Enter the TMS-1000 and its many variants. This is the first micro-controller, developed by Texas Instruments in the early 1970's. It was used in all kinds of interesting toys and devices you may remember from your youth, including

• MB Simon
• Parker Brothers Merlin / Master Merlin
• MB Big Trak
• TI Speak & Spell / Speak & Math / Little Professor
• MB Microvision
• Lots of TI calculators

The TMS-1000 is a 4 bit Harvard architecture micro-controller with 1K - 4K of 8 bit mask ROM and 64 or 128 nibbles of 4 bit RAM. According to the datasheet it is clocked at between 250KHz and 350KHz and, as each instruction takes 6 cycles, it has a throughput of between 42kips and 58kips. Still not very hopeful, an emulator would need to process each TMS-1000 instructions with around 2 CP1610 instructions, but more doable than most.

 

On the plus side, the Harvard architecture and mask ROM means that self modifying code is not possible, allowing the program ROM to be placed in an Intellivision ROM cartridge, and opening the door to a simple instruction decode and dispatch strategy. The small RAM size means it should be possible to model the CPU in a stock Intellivision, despite its limited RAM.

 

The other problem is that being a micro-controller, TMS-1000 programs are not typically available, and for a long time they were effectively undumpable. However, in the last couple of years Kevin Horton (Kevtris) and Sean Riddle have worked out ways of both visually and electrically dumping some of the TMS-1000 range, allowing games such as Simon and Merlin to be properly emulated in MESS.

 

 

OK, but why the SFMT and not Simon or Merlin?

The SFMT is an electronics kit sold by Radio Shack / Tandy from about 1985 onward. It is a reworking of an earlier kit sold by Gakken in Japan, the FX R-165. Both kits teach the basics of computer programming using 4bit machine code. As far as I can tell (I don't own the rarer Gakken version) the kits are based around the same TMS-1100 CPU running the same firmware, certainly they are software compatible.

 

Now here is the interesting bit. Using only the 4bit TMS-1100, with its built in 2K of ROM and 128 nibbles of RAM the authors implemented a virtual machine and basic machine code monitor. Unbelievably, the TMS-1100 in the SFMT is emulating another, different, 4bit computer!

 

I think this is incredible. I wanted to get a look at the code which did this, and thanks to Kevtris and Sean we can now do that. And having peered into its brain it is a great job, especially as at least a third of the code is taken up with some ancillary games, rather than the core VM and monitor.

 

 

How does Nybl work?

So the SFMT makes an interesting, if not necessarily plausible target. Things are made worse by the fact that the TMS-1100 at its heart is clocked at 400KHz (overclocking on a toy from 1985, who would have thought it?), giving 67kips throughput. To match the pace of the original, this would require Nybl to simulate each TMS-1100 instruction with an average of a little less than 1.5 CP1610 instructions. Hmm.

 

Now, I hope I'm an OK programmer, and I've written a few simple interpreting emulators in C, but the best I have achieved is 15 - 20 host instructions per emulated instruction. So this looks to be mission impossible, but perhaps it does not matter. In this instance if the emulator runs slowly it does not necessarily ruin the experience. Your program just takes longer to complete. It is true that the SFMT has sound output and running it more slowly might cause problems, but I thought it was worth a punt.

 

In its current form Nybl runs at about one third of the speed of the real SFMT, with a throughput of about 21.5kips. It takes an average of 5 CP1610 instructions to process a single TMS-1100 instruction. It is so slow I have not bothered with timing control, so obviously it is not exactly what you would call cycle accurate. While this is some way off the required 1.5 instructions, it is significantly better than anything I have managed before.

 

The UI, which runs in the VBLANK ISR, takes less than 2% of the Intellivision's cycles, and everything else is given over to the TMS-1100 emulator running off the main post EXEC initialisation thread.

 

Sound emulation is achieved by bit bashing the PSG volume register to create PWM sound, just as it is on the real SFMT, and as described here:

 

http://map.grauw.nl/articles/psg_sample.php

 

I was surprised that this PWM "just worked", and it is a real credit to the accuracy of Jzintv that it does. As always, kudos to Joe.

 

In terms of the emulation, there is no cheating, the full SFMT ROM is present (there are 2 copies, each preprocessed slightly differently, at $9000 and $a000 for branch optimisation purposes) and every instruction is individually interpreted. Although it would be possible to implement SFMT specific pseudo-instructions to process chunks of SFMT code natively in CP1610 machine code; or indeed to statically recompile the entire ROM, I've chosen not to do this.

 

The changes made to the SFMT ROM image are:

• Reordering of instructions to correct for the TMS-1100 LFSR based program counter
• Replacement of opcodes with direct jump addresses of instruction implementations, meaning instruction decode and dispatch resolves to a single MOV@ R4, R7 instruction
• Creation of 2 ROM versions with differing branch implementations, executed based on whether the branch occurs within a subroutine call or not
• Spacing out of ROM pages and the introduction of a page fault pseudo-instruction to speed handling of the paged program memory model

 

 

What next?

It has been a joy to explore the SFMT and put Nybl together. Like all software it is not complete, rather it is on a journey to who knows where. I may look to improve it further, or investigate using the TMS-1100 core to play with some other emulations. This really requires other applications to clock the CPU below 150KHz, or for there being timing loops to tweak, to make things usable. Otherwise I guess there are always other things to waste time on.

[+JasonlikesINTV]

Could you explain, like you would to a 5yr old, what an emulator for the Intellivision is and what I'd do with it? I'm technically challenged

[+eebuckeye]

Very cool! I'll give it a shot.

[decle]

Could you explain, like you would to a 5yr old, what an emulator for the Intellivision is and what I'd do with it? I'm technically challenged

 

Sorry for the confusion. Nybl is a toy, it emulates the Science Fair Microcomputer Trainer on the Intellivision. To give it a spin, download the ROM image at the top of the original post and pop it into your favourite Intellivision emulator. Unfortunately the SFMT is a rather complicated programmable electronics kit, so to do much other than run the preprogrammed demo, you will probably need to refer to the more info links in the original post.

[Rev]

Ok. Now can you explain it for a 1 year old with downs syndrome?

[R.Cade]

It's an INTV rom that emulates the RS Microcontroller trainer computer that uses using a microcontroller (TMS-1100) that is emulating another microcontroller (TMS-1000). This, in turn, can be run on an IntelliVision emulator (jzIntv)...

 

Make sense? Hopefully I understood it...

Edited April 23, 2016 by R.Cade

[+fdr4prez]

I understood that I don't understand

[+JasonlikesINTV]

Sooo, it's a sex robot?

[freewheel]

An emulator is a piece of software that you run on one computer, to pretend you're on another (usually different type of) computer.

 

If this is actually an honest-to-god emulator for the Intellivision, and not a simulator, I'm bloody impressed. You really should put this in the programming forum. And hopefully share the source code someday

[pimpmaul69]

An emulator is a piece of software that you run on one computer, to pretend you're on another (usually different type of) computer.

 

If this is actually an honest-to-god emulator for the Intellivision, and not a simulator, I'm bloody impressed. You really should put this in the programming forum. And hopefully share the source code someday

i was wondering if it was a simulator or emulator myself but i know nothing about it to know what it is. If it is an emulator i am curious about it because there has to be something original in it to be considered an emulator

[freewheel]

i was wondering if it was a simulator or emulator myself but i know nothing about it to know what it is. If it is an emulator i am curious about it because there has to be something original in it to be considered an emulator

 

Not sure what you mean by "something original". From the description, it's running the actual original CPU instructions, translated into CP1610 instructions. That's an emulator in a nutshell. Sometimes you see a bit of a blend, where you're using the original instructions but not "executing" them in a virtualized processor. Or emulating a bit of the hardware but simulating the rest.

 

Generally you're looking at a performance hit of 90% or more, to emulate a CPU. And you often need a LOT more memory to handle it all. Given how there really isn't much out there that's much slower than an Intellivision (you couldn't even come close to emulating a 2600, for example), it's really impressive.

[pimpmaul69]

 

Not sure what you mean by "something original". From the description, it's running the actual original CPU instructions, translated into CP1610 instructions. That's an emulator in a nutshell. Sometimes you see a bit of a blend, where you're using the original instructions but not "executing" them in a virtualized processor. Or emulating a bit of the hardware but simulating the rest.

 

Generally you're looking at a performance hit of 90% or more, to emulate a CPU. And you often need a LOT more memory to handle it all. Given how there really isn't much out there that's much slower than an Intellivision (you couldn't even come close to emulating a 2600, for example), it's really impressive.

i missed that part about the cpu. So yeah i would consider it an emulator. I am definitely impressed that he accomplished it.

[decle]

An emulator is a piece of software that you run on one computer, to pretend you're on another (usually different type of) computer.

 

If this is actually an honest-to-god emulator for the Intellivision, and not a simulator, I'm bloody impressed. You really should put this in the programming forum. And hopefully share the source code someday

 

Thanks for the feedback

 

I was unsure of which forum to post to, as Nybl is complete (if not finished), but I recognise that it is not a normal Intellivision game and it might be of more interest to the programming fraternity. I also did not want to annoy people by double posting on my first contribution.

 

My understanding of the difference between an emulation and simulation of some target system is that:

• A simulator is a program that mimics the behaviour of the target system. In the case of a simulation of a computer it need not necessarily simulate the hardware of the target (how the target does what it does), it only needs to simulate the behaviour (what it does).
• An emulator is a hardware simulation program, it mimics the behaviour of the hardware of the target system to the point where the software of the target can be run using it. At this point it too will mimic the behaviour of the target. If the hardware emulation is good enough it should result in a more faithful representation of the behaviour that than that achievable by a simulator, because it is modelling what is done, by mimicing how it is done.

Nybl is largely a model of a TMS-1100 CPU, and that is running the software found in a real SFMT. As such I believe it is an emulator, in the same way that Jzintv is an emulator of the Intellivision.

 

Cheers

[decle]

 

Not sure what you mean by "something original". From the description, it's running the actual original CPU instructions, translated into CP1610 instructions. That's an emulator in a nutshell. Sometimes you see a bit of a blend, where you're using the original instructions but not "executing" them in a virtualized processor. Or emulating a bit of the hardware but simulating the rest.

 

Generally you're looking at a performance hit of 90% or more, to emulate a CPU. And you often need a LOT more memory to handle it all. Given how there really isn't much out there that's much slower than an Intellivision (you couldn't even come close to emulating a 2600, for example), it's really impressive.

 

You are correct, in terms of efficiency, Nybl like all interpreting emulators is very poor. Prior to writing Nybl my experience was that when using languages like C to write emulators I took a performance hit of about 95% of CPU performance (it required 15-20 host instructions to emulate a single target system instruction - personally I prefer to think of this as the emulator having an efficiency of about 5%, in that you get 1 useful instruction out for every 20 you put in, but I'll stick to the performance hit terminology to avoid confusion). By choosing a really simple guest CPU (TMS-1100), writing Nybl in assembler and carefully optimising it, I have managed to get this down to an average of about 5 instructions, which means that the performance hit is "only" 80%

 

Interestingly Apple has shown in its migration from PowerPC to Intel CPUs that by using more sophisticated emulation techniques, such as dynamic recompilation, this CPU performance hit can be reduced and traded for more memory usage.

 

In terms of memory to get to 5 CP1610 instructions for each TMS-1100 instruction Nybl uses 8K words of 16 bit ROM inside the Intellivision to mimic the 2K of 8 bit ROM inside the TMS-1100, so the ROM performance hit is 87.5%. Nybl also uses 160 bytes of Intellivision RAM to store the 128 nibbles of TMS-1100 RAM and registers, so the RAM performance hit is about 60%. This number ignores the RAM used to create and maintain the on-screen UI.

 

As you say emulation is expensive in just about every way.

[Rev]

I understood that I don't understand

Some of us just want to know if it comes in a box that we can put on our shelf. Haha. Kidding. .........but not really.

[decle]

Some of us just want to know if it comes in a box that we can put on our shelf. Haha. Kidding. .........but not really.

 

I'm afraid not, sorry

 

On the plus side it is much cheaper than programs that come in boxes

[+intvsteve]

 

You are correct, in terms of efficiency, Nybl like all interpreting emulators is very poor. Prior to writing Nybl my experience was that when using languages like C to write emulators I took a performance hit of about 95% of CPU performance (it required 15-20 host instructions to emulate a single target system instruction - personally I prefer to think of this as the emulator having an efficiency of about 5%, in that you get 1 useful instruction out for every 20 you put in, but I'll stick to the performance hit terminology to avoid confusion). By choosing a really simple guest CPU (TMS-1100), writing Nybl in assembler and carefully optimising it, I have managed to get this down to an average of about 5 instructions, which means that the performance hit is "only" 80%

 

Interestingly Apple has shown in its migration from PowerPC to Intel CPUs that by using more sophisticated emulation techniques, such as dynamic recompilation, this CPU performance hit can be reduced and traded for more memory usage.

 

In terms of memory to get to 5 CP1610 instructions for each TMS-1100 instruction Nybl uses 8K words of 16 bit ROM inside the Intellivision to mimic the 2K of 8 bit ROM inside the TMS-1100, so the ROM performance hit is 87.5%. Nybl also uses 160 bytes of Intellivision RAM to store the 128 nibbles of TMS-1100 RAM and registers, so the RAM performance hit is about 60%. This number ignores the RAM used to create and maintain the on-screen UI.

 

As you say emulation is expensive in just about every way.

 

It would be really interesting to see what kinds of things you could accomplish by taking advantage of additional RAM and storage with some of the newer cartridge platforms. At least two platforms already in use offer additional RAM - some boards from 5-11under as well as the boards from LTO. The JLP boards from LTO also offer additional flash storage. When the LTO Flash! is released you'll also have a platform with not only additional RAM and a flash storage, but also a connection back to a host computer, which could conceivably allow support for deploying the ROMs for your emulator to run!

[freewheel]

 

As you say emulation is expensive in just about every way.

 

It is, but if your numbers are accurate, you've written one of the more efficient emulators I've seen. Color me impressed all the more.

 

[decle]

 

It is, but if your numbers are accurate, you've written one of the more efficient emulators I've seen. Color me impressed all the more.

 

 

Thanks, but other than one or two tricks where more memory is traded for increased CPU performance, it is not really that clever, just a "simple matter of programming" as my boss would say. Nybl harks back to the early days of emulators in the late 1990s / early 2000s when they were written in assembly and optimised for the particular host system. These days either the system you are hosting the emulator on, normally a PC, is so much more powerful than that being emulated that you can use high level languages, write accurate, elegant, portable code and not worry too much about the additional cost; or if this is not true you have enough resources on the host and decent tools such that you can contemplate much more sophisticated approaches such as dynamic recompilation. Either way it is really comparing apples and pears.

 

The emulator that has always impressed me (although I must admit I have not used it) is Carl Mueller, Jr's Intellivision for the Game Boy Color (I4GBC). I think the CPU in the GBC is an 8MHz Z80 clone, so it should be good for somewhere between 1 and 1.5mips. Therefore, you might think that emulating a 100kips CP1610 would be relatively easy. However, the Z80 is fundamentally an 8 bit CPU so we can probably halve the Z80 numbers as it will need to do at least double the work to emulate the larger 16 bit registers and memory transfers of the Intellivision. This puts the CPU emulation into the same kind of ballpark as Nybl. But Carl had to go much further, he also had to generate a bitmapped screen from Intellivision's card based system, and 3 voice sound, and as I'm sure Carl and Joe would agree, even with careful design both of these tasks take a large chunk of CPU resources. In choosing to emulate the SFMT I was careful to select a target that effectively has no screen, and only minimal sound. To be honest it would have been preferable for the SFMT to have no sound, but in the end I was lucky and implementing what little sound there is was trivial given a quirk of the AY-3-8914 sound chip in the Intellivision, and the excellent accuracy of Jzintv; and Nybl's simple UI consumes less than 2% of the Intellivision's CPU. I think I'm right in saying that by statically recompiling some of the Intellivision instruction combinations to Z80 machine language Carl managed to get I4GBC to run Intellivision games at full speed. Makes Nybl's 3 times slower than real time look very sedate. One of many amazing jobs by Carl.

 

If you want to watch Nybl doing its stuff, pop a break point at $5038 when running Jzintv in debug mode. This is the kick off point of the emulation core. From here, unless you are in the VBLANK ISR:

• R0 - permanently contains the TMS-1100 A register value 0-f (remember this is a 4 bit CPU)
• R1 - permanently contains the TMS-1100 Y register value 0-f
• R4 - effectively permanently contains the TMS-1100 program counter (actually this is a pointer to the next instruction to be executed from the ROM image starting at $9000 or $a000)
• The CP1610 carry flag contains the TMS-1100 status flag
• TMS-1100 RAM is found at $170-$1EF in the Intellivision 8 bit RAM
• Address $358 contains the value of the TMS-1100 X register (actually a pointer to the Intellivision address that contains the start of the TMS-1100 RAM page). Together with the Y register these point to an address in TMS-1100 RAM.
• Each MVI@ R4, R7 you see being executed after this point is a new TMS-1100 instruction being loaded from ROM and dispatched to be executed

The first bit of TMS-1100 initialisation code taken from the SFMT ROM, with my annotations to understand what on earth is going on is below:

# Start of page f
# Main entry point

# ADD OP    MNEMONIC           COMMENT
#---- --    ----------------   -------------------------------------------------

0f:00 28    LDX 0            # X = 0
0f:01 40    TCY 0            # Y = 0
0f:02 60    TCMIY 0          # [0] = 0
0f:03 68    TCMIY 1          # [1] = 1
0f:04 64    TCMIY 2          # [2] = 2
0f:05 6c    TCMIY 3          # [3] = 3

# Start of loop which clears RAM, jump from 0f:08

0f:06 60    TCMIY 0          # [4] = 0
0f:07 50    YNEC 0           #
0f:08 bf    BR 06 (3f)       # if Y != 0 goto 0f:06 - clear remaining page of RAM

Where:

• ADD is the memory address broken down into <page>:<word> - the TMS-1100 has a nasty paged memory model for both ROM and RAM
• OP is the opcode
• MNEMONIC is pretty obvious
• Everything after a # on a line is a comment
• In the comments, "[#]" means RAM at address #
• TCY loads Y with a constant (I have know idea why they chose LDX and TCY for operations that do the same thing to different registers, bonkers)
• TCMIY instructions push a constant to the RAM location specified by X * 16 + Y, and post increments Y
• YNEC sets the status to 1 if Y does not equal the constant specified
• All branch instructions are conditional and are taken if the status = 1
• The status flag is not persistent unlike the Intellivision carry, but is reset to 1 by most instructions

It should be possible to follow the TMS-1100 CPU executing by single stepping from here in Jzintv.

Edited April 25, 2016 by decle

[m-crew]

This thread has really pushed the Dazed and Confused to its limits... lol

[Osccccar]

Hi all,

 

I found this topic searching on the web, and I was surprised, since I knew the link to the original science fair microcomputer kit. I found

it very interesting that someone managed to do such emulation. Now, I would like to ask you for the demo included. I press the "Run/Play"

button, and nothing happens. However, when I press one of the 4 empty buttons that are above the numbers of the intellivision pad, then,

the demo starts, lighting the leds one by one, and showing digits on the 7 segment display. Am I doing it correctly? Is there a little bug in

the rom? I do not know this console. I am running it in my smartphone, using jzintv4droid.

 

Thank you very much for your attention. Regards.

 

P.S. Which language did you use to make this rom? It is amazing, really amazing.

[decle]

Hi all,

 

I found this topic searching on the web, and I was surprised, since I knew the link to the original science fair microcomputer kit. I found

it very interesting that someone managed to do such emulation. Now, I would like to ask you for the demo included. I press the "Run/Play"

button, and nothing happens. However, when I press one of the 4 empty buttons that are above the numbers of the intellivision pad, then,

the demo starts, lighting the leds one by one, and showing digits on the 7 segment display. Am I doing it correctly? Is there a little bug in

the rom? I do not know this console. I am running it in my smartphone, using jzintv4droid.

 

Thank you very much for your attention. Regards.

 

P.S. Which language did you use to make this rom? It is amazing, really amazing.

 

Hi Osccccar,

 

Firstly, thanks for taking the time to download Nybl and give it a try. From your description it sounds as though something is going wrong. I've created a short animated gif showing Nybl running within Jzintv. Is this what you are seeing? I've not tried the ROM in jzintv4droid, I'll have to download it and see what it gives.

 

 

Like the real SFMT you have to specify the run mode, before hitting the run key. In the video mode 1 is chosen which is just free running.

 

Nybl itself is written in CP1610 assembly language.

 

 

Thanks

 

decle

Edited January 29, 2017 by decle

[decle]

Hmm, running the built in demo ("1", followed by ">" to play) it looks to be OK to me with the latest version of jzintv4droid, with the official GROM and EXEC rom images on a Moto G4 running Android 6.0.1.

 

Could you give a little more detail about what you are running on and what you are seeing relative to the animation I posted?

 

 

Thanks

 

decle

[Osccccar]

 

Hi Osccccar,

 

Firstly, thanks for taking the time to download Nybl and give it a try. From your description it sounds as though something is going wrong. I've created a short animated gif showing Nybl running within Jzintv. Is this what you are seeing? I've not tried the ROM in jzintv4droid, I'll have to download it and see what it gives.

 

nybl.gif

 

Like the real SFMT you have to specify the run mode, before hitting the run key. In the video mode 1 is chosen which is just free running.

 

Nybl itself is written in CP1610 assembly language.

 

 

Thanks

 

decle

 

Hello,

 

Thanks for the replies. Yes, I see that screen. Then, I press "Enter" for instance, and I get into the next screen

where the LEDs, the keyboard, and the HEX display appear. There is where I have the problem with the "run/play button".

 

 

I have a GROM.bin, and EXEC.bin that I found on the web, but I do not know if these are originals. I tried to get them

from the links of jzintv4droid, but I could not, so I look for them on the web. But I do not know if they are originals or

not, I just tried to see if they worked, and that's it for the moment. I downloaded jzintv4droid last week as well. It is

strange that there are 4 buttons empty, but I do not know even the game console.

 

Thank you very much. Regards.

[decle]

Thank you very much. Regards.

 

No problem, I've sent you a private message. Hopefully we can get to the bottom of the problem.

 

 

decle