From DaphneWiki

(Difference between revisions)

Revision as of 22:18, 11 March 2015

Star Rider Main CPU Board

ROM program memory map

Address Range	Description
0xE000-0xFFFF	Main ROM program (U52)
0xD800-0xDFFF	Board was designed to have a RAM or ROM chip here, but nothing actually was installed in production.
0xD000-0xD7FF	RAM
0xCC00-0xCFFF	NVRAM, 4-bit (upper 4 bits of data ignored). For the NVRAM to be read, the address must be between 0xCC00-0xCFFF. For the NVRAM to be written, MEMPROT' must be disabled (raised), and the address must be between 0xCD00-0xCFFF. See U11 on CPU1/2 schematic, approximate at C3.
0xCBF0-0xCBFF	not connected (and if it was, it would be write only)
0xCBE0-0xCBEF	Color palette select (write only, only lowest 6 bits matter)
0xCBD0-0xCBDF	Video expander + background control (Write only). Bit 0: 0 = background enabled, 1 = background disabled. Bit 1: 0 = expander enabled, 1 = expander disabled
0xCBC0-0xCBCF	IMPG' even numbers, YLATE' odd numbers (write only)
0xCBB0-0xCBBF	DMA (Write only). Controls special blitter chips. Bit 3 of the address is ignored and the ROM program uses 0xCBB8-0xCBBF.
0xCBA0-0xCBAF	Vertical Counter. Reads the current value of the vertical counters (see description of them in the timers/counters section). Read only, attempting to write here will have no effect.
0xCB90-0xCB9F	Field: High bit will be equal to the inverse of the FIELD line. In other words, Top/odd field is high, bottom/even field is low.
0xCB80-0xCB8F	VGG U7 PIA control (80 is periph/dir for A, 81 is control for A, 82 is periph/dir for B, 83 is control for B, this pattern repeats). Port A goes to the video expander, port B goes to the PIF board (laserdisc player).
0xCB00-0xCB7F	Bi-phase Select
0xCA00-0xCAFF	?
0xC980-0xC9FF	CPU U10 PIA inteface is 0xC980-0xC983, CPU U20 PIA interface is 0xC984-0xC987, this repeats at 0xC990.
0xC900-0xC97F	Watchdog
0xC880-0xC8FF	LED on the main CPU board (writing anywhere to this address changes value displayed by LED).
0xC800-0xC87F	Change active page (see page section).
0xC000-0xC7FF	Color RAM (see section below about colors)
0xA000-0xBFFF	RAM
0x0-0x9FFF	See Page section

Page System

Star Rider employs a wacky paging system where it can modify what the address from 0-0x9FFF points to in real-time. This is most likely to workaround the 16-bit address limit of the 6809E CPU. Executable code can and is paged in and out, making reverse engineering more difficult.

The page value is 4 bits so has a theoretical range of 0-0xF however in practice it appears likely that the bits of the page value are mutually exclusive (ie valid page values would be 0, 1, 2, 4, and 8 only).

Writing

Writing to 0-0x9FFF will always modify video RAM as long as bit 3 of the page value is not set (ie page value < 8). See DMABUSS' signal below.

Reading

Reading from 0-0x9FFF is more affected by the active page value than writing.

Page 0

The default page where most of the program ROM is accessible.

Address Range	Description
0x8000-0x9FFF	ROM5 (U45)
0x4000-0x7FFF	ROM3 (U26)
0x0000-0x3FFF	ROM1 (U8)

Page 1

Appears to be for reading memory from the ROM PCB. ROM is selected by having address be between 0-0x3FFF or 0x4000-0x7FFF, and by setting the image page (IMPG) 5-bit register.

Page 2

When reading when page 2 is active, the following occurs (assuming address is 0-0x9FFF):

ENBUSS' goes low. Assuming HALT is low, the DMA address bus will equal the CPU address bus. The CPU data bus will get whatever is on the DMA data bus.

Page 4

Loads an alternate ROM program.

Address Range	Description
0x8000-0x9FFF	Not connected
0x4000-0x7FFF	ROM4 (U37, not installed!)
0x0000-0x3FFF	ROM2 (U15)

Page 8

Page 8 appears to only have been used when burning ROM images (which is apparently something the developers used and which the hardware supports). It should never be set in the production ROM program.

NVRAM

NVRAM is kept alive by 3 AA batteries. The CS' line on the RAM chip (U9) is kept disabled (high) when the system is powered off or if RESET' is active (low). If RESET' is disabled (high), then a transistor (Q2) will cause CS' to be controlled by U13 and U11 (which is controlled by the current memory address from the CPU). CS' is kept disabled (high) by either the AA batteries or by VCC, either one going through a 1K resistor. CS' gets pulled low only when the output of U13 (pin 6) goes low (when the CPU address is within the NVRAM range described in the memory map above).

CPU Program

Program Flow

Color test
RAM test
ROM test
NVRAM test
PIF test
Initialization
- $5B2F
  - A6CA: FF
  - A6C2: A6C2 (itself)
  - A6C4: 5B82 (subroutine address)
  - A6BE: A6BE (itself)
  - A6C0: 5B77 (subroutine address)
  - A6C6: A6C6 (itself)
  - A6C8: 5B8B (subroutine address)
  - A6D3: A6BE A6D3 00
  - A6D8: A6BE A6D8 00
  - A6DD: ...
  - A700: A6BE A700 00
  - A705: A6C2 A705 00
  - A6D3: A6C6 A6D3 00 (changed from above assignment)
First callback to $426B because it $A6CD first pointed to $A673 (and 2 bytes after that is $426B)

IRQ

Called via the 4MS timer or VBLANK' (I haven't narrowed it down as to which one it is, but I suspect it is VBLANK').

Inputs

Coins, advance switch, auto/manual switch, etc is serviced at $E45B.

Current value read from U10 PIA PORT A is XOR'd with whatever is stored at $A115, and this is stored at $A116.
Current value from U10 PIA PORT A is then stored at $A115.
This XOR'd value is then AND'd with whatever is stored at $A117 (some kind of mask?).
The result of the AND is stored at $A118.

Biphase data updated at $E414.

FIRQ

May be called when blitter chip completes an operation.

Diagnostics Tests

Disc test

Located at $7C29.

Search To test

Located at $7D79.

Calls $7E75 which appears to initiate a disc search.

Disc search seems to wait indefinitely for either $A1B9 to be non-zero or $A1BC to be zero (see $7E88). This may indicate when a search has finished.

$A1BC is cleared by $1BDD.

Disc Search test

Auto-up controls playback direction. Auto-up enabled means forward playback ($93A1). Manual-down means reverse playback ($93A3). Some other condition needs to occur for this to take effect.

Auto-up controls video expander ($92FF).

PIA hookups

VGG U7 to PIF U1

Connection pin	VGG U7 PIA name	PIF U1 PIA name
11	CB2	CA1 ("HAND1")
12	CB1	CA2 ("HAND2")
3	PB7	PA7
4	PB6	PA6
5	PB5	PA5
6	PB4	PA4
7	PB3	PA3
8	PB2	PA2
9	PB1	PA1
10	PB0	PA0

Schematic signals of note

BIG9'

Active (low) if page bit 0 is set (ie page value is 1).

BI-PHASE WINDOW

Is high when there is bi-phase encoded data (such as the laserdisc picture number) available to be read from the laserdisc video signal. Will be high when vertical line count is 0xB (of the top field), or when the (vertical line count >= 0xF1 and <= 0xFE). Vertical line count is offset from NTSC line count by 7, so a vertical line count of 0xB would be NTSC line 18.

BI-PHASE SELECT

Active when CPU address is between 0xCB00-0xCB7F. Enables the VGG's 6810 128-byte RAM IC for reading unless the BI-PHASE WINDOW is active.

BLANK

Calculated from VGG 3/5, this suppresses both ROM and laserdisc generated RGB signals from going out to the RGB monitor. (see VGG 1/5)

CS TOP'

VGG 1/5, this is low if DMA address >= 0xC000 . DMA address will match CPU address if ENBUSS' is active (low).

If the CPU tries to read from 0xC000 directly, it will get the color palette RAM. However, there is a special case where the CPU can flip the high bit of its DMA address by setting the image page (IMPG') value to 0x1E, and setting the active page value to 1 (ie bit 0 is raised). This is how it reads the ROM PCB's U46.

DMA'

This gets enabled (low) if CPU is writing to address 0xCBB0-0xCBBF (controlling the special Williams blitter ICs).

DMA Address Bus

DMA Address bus will match the CPU Address bus (ie the CPU can control it) if ENBUSS' is active (low) and if HALT is inactive (low, when the blitter chips are idle).

DMABUSS'

This gets enabled (low) if:

Address is 0-0x9FFF AND
1. (when CPU is reading) Active page is 1,2,3,5,6, or 7 (ie not 0 or 4, and less than 8)
2. (when CPU is writing) Always enabled if active page < 8

DMA Data Bus

DMA Data bus will match the CPU's data bus if ENBUSS' is active (low). Both read and write directions are supported.

DMA R/W'

This signal indicates read/write direction of the DMA bus.

If the blitter chips are active (HALT being raised), then they drive this signal directly. Else, the signal is derived from a series of gates in conjunction with an open collector output and a pull-up resistor.

The value of this signal is low (write) if:

CPU R/W' is low (write) AND
HALT is low (blitter inactive) AND
WCNT' is active (low)

Else the value gets pulled high by a 4.7k pull-up resistor (meaning it's in read mode).

ENBUSS'

I believe this stands for Enable [DMA] bus and refers to either writing to the special blitter chips or reading/writing to DMA (video) memory. This gets enabled (low) if:

HALT (VGG) is low AND
1. DMABUSS' is low OR
2. DMA' is low (0xCBB0-0xCBBF address)

END SRN'

Same signal as VERT BLANK'

Becomes active (low) in the approximate center of NTSC line 1's HSYNC pulse, and becomes inactive (high) about 1/4 of the way through NTSC line 23's HSYNC pulse. This is confirmed on real hardware.

FIELD

Top/odd field is low, bottom/even field is high.

This will change when VGG VSYNC(DISK)' becomes active (low) which is approximately 3/4 of the way through line 4. This is confirmed on real hardware.

For bottom field, I strongly suspect that VGG VSYNC(DISK)' will tend to go low about 1/4 of the way through line 267, where vblank starts on line 263.

HALT (VGG)

HALT originates from the special Williams blitter chips. It appears to prevent most of the ICs related to video RAM from functioning, presumably to allow the blitter to have full control over the DMA bus. HALT does not halt the main CPU. Instead, it appears to be connected to the main CPU's FIRQ through the PIA (U7?) on the VGG board. If the main CPU attempts to do a DMA-related operation while HALT is active, the operation appears to just get dropped as a NOP. I will hopefully know more later.

IMAGE WR'

Only used by original developer to burn EPROM. Disconnected on production board.

Will be active (low) if:

Page bit 0 is set (ie page value is 1) AND
Page bit 1 is not set (ie page value is not 3) AND
WRX' is active (low) AND
WCNT' is active (low) AND
Page bit 1 is not set (this is a redundant check)

OERAM'

I believe that this stands for Output Enable RAM, and it is active low. It defines the conditions when the video RAM will be active on the DMA bus.

It will be active (low) when:

DMA R/W' is high (read) AND
1. Image Page (PP) is 0x1E and (Page value & 3 == 1) OR
2. Image Page (PP) is 0x1F OR
3. ((Page value & 3 == 2) AND HALT is disabled)
AND
CS TOP' is disabled (high) AND
XDMA' is disabled (high)

OEROM'

I believe that this stands for Output Enable ROM, and it is active low. It defines the conditions when the ROM board may be read by the CPU.

It will be active (low) when:

DMA R/W' is high (read) AND
OERAM' is disabled (high) AND
XDMA is disabled (high)

RESET'

Controlled by a push button on the CPU PCB (or the watchdog timer). Pressing this will reset the main CPU's 6809E, the 2 PIAs on the main CPU board, the PIA on the VGG board, and the two blitter chips on the VGG board.

VERT BLANK'

This value is latched depending on the current vertical count (see timers & counters section). Will changed to active (low) if vertical count & 0xFE is 0. Will changed to inactive (high) if vertical count & 0xFE is 0x10.

Note that this does not quite match the actual vertical blanking period of NTSC which suggests that the vertical count is offset somewhat. Line 23 (where line 1 is the first line in the top field) is typically the first visible line after vertical blank ends.

VMA

This is a tricky one for me to understand.

Here's my current take of when it is active (high): E and Q both need to be high, and AVMA needed to be high when E went low previously.

This means that CPU R/W' and the CPU address will already be stable when VMA goes high.

It will be high when the CPU is reading or writing data.

WCNT'

Will be active (low) if:

ENBUSS' is active (low) AND
1. CPU address < 0x8000 OR
2. Image page is not 0x1E OR
3. Active page value >= 8 (bit 3 is set) OR
4. CPU R/W' is high (read mode)

WINDOW

See BI-PHASE WINDOW

WRX'

Same as the CPU's R/W' being low except the timing window is shorter (more strict). This will be low (active) if E and Q are both high, and R/W' is low.

Basically, this is active when the CPU has safely put the byte to be written on the data bus.

XDMA'

VGG 1/5 XMDA will be active(low) if DMA' is active (low) and HALT (vgg) is inactive (low).

It is active when CPU is attempting to write to 0xCBB0-0xCBBF (blitter chips) and the blitter chips aren't already busy doing a previous operation.

XLATE'

Probably stands for translate.

Value associated with this signal (when memory address is written) is 6 bits and gets latched into U12 on VGG 1/5. This value gets passed into PROMs U10 and U11, and may (or may not) modify data read from the ROM PCB. The use case for this seems to be to change specific colors read from the ROMs that contain bitmap images. For example, this can be used to change all colors of 0 to a color of 7 (of XLATE is set to 1) so that there is no transparent background. Since this is done by hardware, no CPU penalty occurs.

An XLATE value of 0 causes no change from the original bitmap to occur.

Colors

The color RAM is at 0xC000-0xC7FF. Each color is described by two bytes (16-bit color palette). The first byte contains green (high nibble) and red (low nibble), and the second byte contains blue (low) and luma (high). So for example, if I write to 0xC000, I would be writing the red and green information of the first color. If I then wrote to 0xC001, I'd be writing the blue and luma information of the first color.

Color Palette

When CBE0-CBEF written to, it updates U94 on the VGG board (74LS374 octal register) with the current 8-bit value on the data bus. Only the bottom 6 bits are used. The output of this register is enabled as long as the CPU's memory address is not in the 0xC000-0xC7FF range.

The value written here is latched as the upper 6 bits of the color RAM internal address (used by the hardware to lookup a color value).

The lower 4 bits are changed by the graphics hardware at will and refer to the active color index.

This means that each color palette can hold 16 colors and there are 64 total color palettes available. (seems like it would've been a lot cooler if there had been 16 total color palettes with 64 colors each!)

Laserdisc background

Color 0 is the transparent laserdisc background (see VGG 4/5 schmatic A2).

Timers and Counters

Clocks

Master

The master clock is 24 MHz and is located on VGG 3/5.

12 MHz

The master clock immediately gets divided in half to create a 12 MHz clock. This clock is used to update an 8-bit flip flop (U101), to generate a 6 MHz clock, and to influence the CAS' signal.

U114 PROM

This 32-byte PROM is like a fancy gate array to describe how the 6 MHz clock will influence a bunch of signals. The high bit of the address (bit 4) alternates with each clock. The lower 4 bits of the address get the value of the lower 4 bits of the data that the address contains, hence the lower 4 bits of all data are a GOTO.

Q0-Q7 of this image is confirmed to be accurate using real hardware. The other signals are assumed accurate but have not been vetted as thoroughly.

Unknown counters

On VGG 3/5, there is an 8-bit counter on the far-left, about halfway down. This counter increments (via a 4 MHz clock) until it hits 228 at which point it lowers the "INCREMENT VERTICAL COUNT" line and waits. More details later, hopefully.

Vertical Counters

The vertical counters are three 4-bit counters for a theoretical size of 12-bits. However, only the lower 9 bits are used. The lower 8-bits correspond to VA6-VA13 on the schematic. The 9th bit apparently does not ever make it to the video address bus.

By sniffing vsync and the vertical counters on the real Star Rider hardware, we've learned that:

the vertical counter gets clear when the VGG hardware detects a new vsync (middle of NTSC line 4 for the top field)
the vertical counter is equal to 1 when the NTSC top field line number is equal to 8. Or in other words, vertical count is offset 7 from the NTSC line number (where the first line of the NTSC top field is 1, not 0). Behavior for bottom field is unknown but most likely very similar. This means that a vertical count of 0xB (11) is NTSC line 18, which contains the laserdisc picture number on it. When the vertical count is 0xB, the hardware enables the BI-PHASE WINDOW signal to read the picture number (which is precisely what we would expect).
When the FIELD line indicates that the bottom field is active, the vertical counter appears to be 255 on NTSC line 525. It then rolls over to 0 on NTSC line 1, 1 on NTSC line 2, 2 on NTSC line 3, 3 on NTSC line 4, then vsync becomes detected, and the vertical count gets reset and held at 0.
When the FIELD line indicates that the top field is active, the vertical counter may keep counting up until the middle of line 267 which means that it will have a value of (267-7)&0xFF (or 4). This is not confirmed on real hardware (yet).

Expander Control

The video expander will always get disabled when the vertical counters exceed 0xB4.

See VGG 3/5 schematics, around 4. There is a section labeled EXPAND CONTROL and two 74LS85's (U61 and U77). Pin 5 (A > B) will be true when v.count > 0xB4.

The input 'B' bits for U61 (the least significant digit) is 4. Its compare inputs (pins 2-4) are wired to A==B as the datasheet requires. The inputs for 'A' are VA6-VA9 which are the least significant digits of the vertical counter.

U77 represents the most significant digit. Its compare inputs (pins 2-4) receive the compare outputs from U61. Its input 'B' bits are 0xB. The inputs for 'A' are VA10-VA13 which are more significant digits of the vertical counter. Its A>B output (pin 5) is high when the vertical counter > 0xB4 and thus when the expander should be disabled.

Horizontal Counters

The horizontal counters are two 4-bit counters that make up an 8-bit counter. The bits correspond thusly:

Bit	Corresponding signal on video address bus
0	none
1	VA0
2	VA1
3	VA2
4	VA3
5	VA4
6	VA5
7	none

The horizontal counter increments every 0.5 microseconds. It gets reset at the end of the HSYNC pulse (ie when HSYNC pulse goes high). It is used to generate the HSYNC pulse if the laserdisc's video signal is not present. HSYNC from NTSC signal is supposed to be about 4.7-4.8 microseconds long. (It is almost exactly 4.68uS on raspberry pi + LM1881 CSYNC pulse.) If the board has to generate the HSYNC pulse (due to the lack of a laserdisc video signal), this pulse will be low for exactly 4.5 microseconds.

The horizontal counter will loop from 0-129 continuously. Hsync will be active while counter is 121-129 (9 0.5 microsecond periods, or 4.5 microseconds).

For reference, a horizontal line is supposed to be approximately 63.5 microseconds long. The exact length of a horizontal line is H = (1001 * 1000000 * 2) / (1000 * 60 * 525) microseconds.

If the board is generating HSYNC, its horizontal lines will be exactly 65 microseconds long (130 0.5 microsecond periods).

HSYNC VGG

HSYNC VGG is the pulse that the board will generate if HSYNC DISC is not available. HLOAD is the complement of HSYNC VGG and leads it by 1 clock. HLOAD can be calculated as:

hload = (((hcount & 120) == 120) || ((hcount >= 128) && ((hcount & 1) == 0))) ? 1 : 0;

Or in other words, HLOAD will be high if hcount >= 120 and hcount <= 128, which means HSYNC will be low when hcount >= 121 and hcount <= 129. LOAD will only go low when HLOAD and HSYNC are both low, which only happens when HLOAD goes from high to low. When LOAD goes low, the counter resets to 0.

Each row in the table below represents a positive transition of the 2 MHz input clock.

Horiz. Count	Microseconds	Hsync VGG	HLOAD	LOAD
118	0	1	0	1
119	0.5	1	0	1
120	1	1	1	1
121	1.5	0	1	1
122	2.0	0	1	1
123	2.5	0	1	1
124	3	0	1	1
125	3.5	0	1	1
126	4	0	1	1
127	4.5	0	1	1
128	5	0	1	1
129	5.5	0	0	0
0	6	1	0	1
1	6.5	1	0	1

Video

Using the schematics to understand how the video RAM maps to the pixels rendered on the RGB monitor is quite a difficult and slow process.

Total video memory capacity: 384x256 pixels
Total video memory that is addressable by the CPU and blitter ICs: 320x256 pixels

^ - this took me FOREVER to figure out! so hard!!!

The video memory is composed of six 8k DRAM chips for a total storage capacity of 49,152 bytes. Each byte contains two pixels, thus giving a total capacity of 98,304 pixels. The video hardware will render 6 pixels every 1 microsecond to the monitor (via a 6 MHz clock). The video hardware also uses the horizontal counters (divided by 2) to keep track of the horizontal position of the CRT gun. The horizontal counters loop from 0-129 which means that horizontal resolution is effectively (129/2 * 6) which is 384. Boom! This took me forever to validate even though I suspected it for quite some time because I had mistakenly calculated the DRAM size as being 2k, not 8k. 98,304 divided by 384 gives us our vertical resolution of 256.

How did I conclude that the addressable video memory is 320x256? I did it by emulating the game far enough to take some screenshots. But it's easier in hindsight. I already knew that the video RAM ranges from 0-0x9FFF so simply dividing 0xA000 by 256 gives 160 bytes per line. And there are 2 pixels per byte, hence 320 pixels per line.

How does the game hardware know where to put these 320 pixels on this 384 pixel line? By the Horizontal PROM, U74.

SER0-SER3

The 4-bit value here is the 4-bit color index to be rendered to the monitor at any given time. It is influenced solely by the horizontal and vertical counters which are in sync with the video signal's vertical and horizontal sync signals. The color index is translated into an RGB value by the circuitry on VGG 4/5, using the active color palette and the color palette RAM.

This value comes from a set of 74LS166's (known as "pixel shift register"s on VGG 2/5). These registers hold 6 bits each, and there are 4 of them, hence the registers hold 6 pixels at a time. After each set of 6 pixels has been rendered, the next set is loaded in via the SRL' line (active low) and the low->high transition of the 6 MHZ clock.

The pixels will be available on the bus to be loaded in because of the values of the MUX0/MUX1 lines in conjunction with the current value of the horizontal and vertical counters.

DRAM layout

On the schematic, each DRAM shares the same 14-bit address, which will change depending on whether video hardware is reading the memory in order to render it to the screen, or if CPU/blitters are doing I/O. The data lines of each DRAM are labeled Zn1-Zn4 where n is 1-6 for each DRAM.

For any given 14-bit address, the DRAMs combined simultaneously present 24-bits on the data bus, or 6 pixels (where each pixel is 4 bits). So when rendering pixels to the screen, the hardware puts a 14-bit address on the DRAM address bus, then reads in 6 pixels into three 8-bit shift registers. After the shift registers have rendered the 6 pixels, the process repeats and the next set of 6 pixels are read.

DRAM 1 will present the first 4-bit pixel, DRAM 2 will present the second pixel, etc.

Video Address

The schematics have the concept of a video address which is calculated by the following method:

Video Address = ((vertical counters & 0xFF) << 6) | ((horizontal counters & 0x7E) >> 1)

The lower 8 bits of this address become the DRAM's "row" bits, while the upper 6 bits became the DRAM's "column" bits.

DRAM Row	[VA7 VA6] <- from vertical counter [VA5 VA4 VA3 VA2 VA1 VA0] <- from horizontal counter
DRAM Column	VA13 VA12 VA11 VA10 VA9 VA8

Here are some examples of a theoretical video address and its row/column bits.

V. Count	H. Count	Video Address	Row Bits	Column Bits
0	0x50	0x28	0x28	0
1	0x50	0x68	0x68	0
4	9	0x104	4	1

Mapping of CPU address to video address

The address is essentially $XXYY where the first byte is the X coordinate (left to right) and the second byte is the Y coordinate (top to bottom).

This mapping is partially handled by the U74 PROM on the VGG board.

Details: The lower 8-bits of the CPU address are the vertical coordinate on the screen (there are 256 lines). So it's a little backward from the usual standard of having the X coordinate as the least significant part of the word, and the Y coordinate as the most significant. The upper 8-bits of the CPU address refer to the horizontal coordinate, but since they can only cover a range of 0-159 (0-0x9F), they get filtered through the U74 prom which will translate the coordinate so as to add horizontal margins on the left and right side. Remember, that one byte holds 2 pixels, so a range of 0-159 can describe 320 horizontal pixels.

When CPU writes to video memory, a full byte is written to two of the six DRAM chips simultaneously (where one nibble goes to one DRAM chip, the other nibble goes to the other). A byte may be written to DRAM 1/2, 3/4, or 5/6. In other words, writing a byte to video memory will change 2 pixels (like you'd expect).

The CPU's address is filtered through U74 PROM. The PROM decides which pair of DRAM chips the address maps to. It may also opt to make the write a NO-OP by not enabling any of the DRAM chips for writing, but from what I have seen, it will never do this if the address is in range of 0-0x9FFF.

Monitor output

The monitor output is labeled 3J2 on the schematics (see VGG1/5 and VGG3/5). Sync pulses are TTL and active high. R,G,B voltage ranges are unconfirmed but monitors such as the G07 have a published range of 0-4V.

Pin	Description
1	Red
2	Green
3	Blue
4	Ground
5	Vsync
6	Hsync
7	Not connected

7-segment LED

The LED part is a MAN72A.

This is unconfirmed, but it is likely that these bits correspond to the LED segments:

Pin	Description
1	A
2	F
3	GND
4	N/C
5	N/C
6	D.P.
7	E
8	D
9	N/C
10	C
11	G
12	N/C
13	B
14	GND

@@ Line 446: / Line 446: @@
 ==== Expander Control ====
 The video expander will always get disabled when the vertical counters exceed 0xB4.
+See VGG 3/5 schematics, around 4.  There is a section labeled EXPAND CONTROL and two 74LS85's (U61 and U77).  Pin 5 (A > B) will be true when v.count > 0xB4.
+The input 'B' bits for U61 (the least significant digit) is 4.  Its compare inputs (pins 2-4) are wired to A==B as the datasheet requires.  The inputs for 'A' are VA6-VA9 which are the least significant digits of the vertical counter.
+U77 represents the most significant digit.  Its compare inputs (pins 2-4) receive the compare outputs from U61.  Its input 'B' bits are 0xB.  The inputs for 'A' are VA10-VA13 which are more significant digits of the vertical counter.  Its A>B output (pin 5) is high when the vertical counter > 0xB4 and thus when the expander should be disabled.
 === Horizontal Counters ===

StarRiderMainCpu