This document: Hummer DTV MOD FAQ [part] Intro > Credits Thanks to (in no particular order): Jeri, Adrian, Robin, Six, Daniel Kahlin, David Murray, Jeff Ledger, Jim Brain, Sean Cross, markco, Golan Klinger, pyrofer, MadModder, Roland, macbthpsw, suschman, axxis42,.... March, 2006 Compiled by D. Garmon This material was largely culled from the DTVHacking forum at: http://jledger.proboards19.com/index.cgi?board=dtvhacking&page=1 I have edited some content (usually concatenating several bit of info together), but not all. You may recognize your own words here. I have tried to give a "global shout-out" to everyone who contributed. If you've been left out, contact me and I'll gladly add your name to the list. And if you'd prefer real or screen name. [part] Hummer DTV Background The Hummer game was sold in the USA by "Radio Shack" for the 2005 Christmas season. This NTSC-configured unit is a simple driving game, with a steering wheel connected to a pot and two buttons for additional control. The Hummer can be converted to PAL with some hardware and/or software mods. This console is based on Rev 3 of the DTV ASIC (Application-Specific Integrated Circuit), which emulates the function of a Commodore 64 computer. The chip, designed primarily by Jeri Ellsworth, has also appeared in other "video-game-in-a-joystick" products, most notably the C64 DTV. All the chips, including custom chips (6510, SID, VIC-II, CIA, RAM & ROM addressing) of a c64 are emulated on the DTV ASIC. The actual RAM and ROM are external to the ASIC. The C64 DTV was released in two versions, the first (2004) a landmark but somewhat less modable unit. The Rev 2 C64 DTV (2005) is very similar to the Hummer, but the Hummer has a slight edge in hardware sophistication. The C64 DTV arguably has an edge in gameplay hackability, as both joystick ports can be tapped. The Hummer has better flash memory, capable of many more write/erase cycles than the C64 DTV. And the Hummer has bidi userport lines and one paddle port (emulated w/an A/D conv.) The unit is powered by 4 AA batteries (6V), which is stepped down to ~3.3v by the onboard regulator. Most modders replace battery power with a regulated 5V supply, which can supply both the main board and an add-on PS/2 keyboard. For the price, they do a remarkable job of emulating C64 hardware. The ASIC, in fact, was designed in much greater depth than is required for the "joygame" market. This has enabled modders to add keyboards, C64 diskdrives, external joysticks and paddles, I/O devices and more. Adding to the original c64 functionality are several additional hardware and software features. These include DMA transfer, Blitter, Additional CPU registers, extended CPU instructions, greater color depth, etc. The unit is not without flaws, however. Cost-cutting during production led to quality issues in the video, audio and power supply circuitry. Despite this, the product functions quite well even without modification. Originally selling for about $30 US, at this writing (Mar 2006) they have been discounted to $20. Further future discounts are possible (rumoured only.) The future is uncertain for the Hummer, the C64 DTV and the DTV ASIC. [part] Websites > Personal DTVHacking in the PETCII forums: http://jledger.proboards19.com/index.cgi?board=dtvhacking DTV hacking forum in German: http://www.forum-64.de/wbb2/board.php?boardid=155 DTV group on Yahoo! http://games.groups.yahoo.com/group/DTVTalk/ David Murray: http://galaxy22.dyndns.org/misc/hummerdtv/index.html Daniel Kahlin: http://www.kahlin.net/daniel/dtv/index.php Mr. Latch-up: http://www.geocities.com/dtvhacking/ DTVhacking: http://www.dtvhacking.info/ The "DTVprogramming" PDF: http://www.orrville.net/dtvhacking/DTVprogramming.pdf http://galaxy22.dyndns.org/misc/hummerdtv/DTVprogramming.pdf Disassembly of the Hummer kernal (DTV changes to stock kernal) http://www.kahlin.net/daniel/dtv/flash/hummer_kernal.txt Six's port guide (C64DTV specific, but very helpful): http://thedarkside.ath.cx/dtv/ports.html > Other Wikipedia C64 DTV: http://en.wikipedia.org/wiki/C64_Direct-to-TV The designer: http://en.wikipedia.org/wiki/Jeri_Ellsworth NYTimes story on designer (cached) http://www.theonelab.com/files/mirrors/c64_joystick_girl.html Mammoth Toys (this site doesn't play well with Firefox) http://www.mammothtoys.com/ Toy:Lobster: http://www.c64dtv.co.uk/ DC-Studios (game designers): http://www.dc-studios.com/ [part] Standard Hardware Game unit includes: Yellow plastic body Start switch LED "ON" indicator Reset Button (Hard Reset) Steering Wheel with Two control buttons Battery compartment Hokey stickers on front [part] Game Mode (standard startup mode) On powerup, the unit will boot automatically into the "Hummer Off-Road Racing" game. [part] Test Mode (unmodified unit) On powerup, hold button A. The screen will pause, while displaying a rotating Hummer in each corner of the screen. Pressing button B loads the next screen, the test diagnostic. TEST includes a color scale on the left side, and on the right side a diagnostic of the wheel potentiometer and buttons. As you turn the wheel, a series of numbers are displayed. Also on the right is a test grid for buttons (the grid could accomodate a full joystick, though no is connected to the hummer.) Concurrently, a RAM test program runs at the bottom of the screen. When it's done, the unit locks up. A cold reset or cycling the power is needed to restore function. TEST can be run from Basic mode also, see below. [part] Basic-Language Mode > Intro The Hummer can be forced into a modified C64 Basic mode quite easily, although not without modification (See Keyboard mod.) This mode begins with an automatic file-loading routine, DTVLOAD. The DTVLOAD must be cancelled with a keypress to enter Basic. > Entering Basic Mode Holding down TAB, LEFT or RIGHT CTRL during startup brings up the DTVLOAD/Basic screen: [Table] Basic Screen **** COMMODORE 64 BASIC V2 **** 64K RAM SYSTEM 38911 BASIC BYTES FREE WAITING FOR DTVLOAD. ANY KEY FOR BASIC _______ If you release the key within a certain period, the unit will wait for a DTVLOAD transfer. Any subsequent keypress will drop into Basic Mode. So leaving the above keys pressed during startup will (generally) result in the READY prompt and flashing cursor which denote Basic Mode. Sometimes the unit locks up and won't display READY or enter Basic. In these cases, a quirk of the keyboard input has fooled the unit into believing that a DTVLOAD has been initiated. Reset and try again. When initialized in this way, the opening screen will be monocromatic. This can be fixed by reflashing the ROM, or using David Murray's tips below. Occasionally the keyboard output will not match the keypress. Pressing SHIFT or Caps-Lock will usually solve the problem. > "Warm" reset (RESTORE & RUN/STOP) Hold down ESC, and hit PAUSE/BREAK Unit can be "warm reset" at any point in Game Mode--opening credits, user entry mode or help screens, even during the game itself. This will drop you into basic, with full color. However, any additional drives (devices 8,9) will not be recognized. DG NOTE: Reset unit and Hold "DEL" key (joy A). When TEST prog starts, press Esc & Pause/Break. There is no hurry, TEST begins with the "rotating cars" screen, and it stays there until RETURN (joy B) is pressed. Hummer unit will now display full color in Basic Mode, but this bypasses the standard DTVLOAD opening screen (again, no IEC drives.) Once TEST moves to color pallet/sound/IO testing screen, it cannot be exited without hard reset (reset button.) From the BASIC prompt, load and run "HUMMER", which runs the default-mode hummer game. A modder can also load and run "TEST", which produces the factory test that is run when Joy A is held down at start. The TEST routine is machine-lang and coded into the kernal, it's not a stand-alone program loaded from flash memory (of course, the kernal itself is loaded from flash.) > Loading the flash directory "scan": load "$" list You'll get a dir list of all the accessible flash mem programs, followed by the ROM REV NO.: 2005 08 22 03:16:34 In the Hummer, all the files are part of the console game (except for TEST, which is a jump vector to kernalROM test routine.) LOAD "$" doesn't really scan the dir, as a true file system doesn't exist on the flash memory. Instead it loads a file named "$" which contains a listing of the available files. The flash memory routines have replaced the old tape routines in the kernal, so the default device (1) is now the flash. [part] Key Mapping [Table] Keys Keys mapped as Joystick buttons: Enter Joystick A button Delete Joystick B button other Keys: RT ALT SHIFT/COMMODORE (toggle upper/lower char banks) ESC & PAUSE/BREAK RESTORE & RUN/STOP Keybd LEDs: The num-lock key turns on the associated Keybd LED indicator. Caps-Lock and Scroll-lock do not. _ [part] Hardware -- Pin outs > Labeled Pins [Table] Test Pins (from REV 2 Schematic): TP1 IECAtn IEC Serial TP2 KeyboardData PS/2 Keyboard TP3 KeyboardClk PS/2 Keyboard TP4 PAL_nNTSC TMODE TP5 AudioOut audio TP6 TestPort3 CPUAddressEn TP7 TestPort2 Clk1mhzEn TP8 IECClk IEC Serial TP9 IECData IEC Serial TP10 TestPort1 PA2 (userport) TP11 CompositeOut video ____ [Table] Other labeled pins JoyB0 Joystk B0 Joystick $DC01 JoyB1 Joystk B1 Joystick $DC01 JoyA0 Joystk A0 Joystick $DC00 Bat+ powerin + (unregulated +6v) Bat- powerin - LED LED anode To switch daughter board DIS cap discharge (pwr off) To switch daughter board GND Board ground To switch daughter board L- LED cathode To switch daughter board Rs Reset (to GND) To switch daughter board ____ >Other Hackable pins: Userport [Table]Userport Addr Address Addr $DD01 _ > Paddle Pot [Table] Paddle PB0 User0 Unmarked, but verified (see photo) PB1 User1 Unmarked, but verified (see photo) PB2 User2 Unmarked, but verified (see photo) _ The "paddle" ADC (Analog-to-Digital Converter) hardware uses these three lines. They are connected to unused solder pads as well as the ADC. The small epoxy blob on the topside is the ADC. Next to it are through-vias labeled cad1 and cad2. A larger trace from that epoxy blob runs to the center pin of the potentiometer. The endpins of the pot are soldered to Vcc and GND, and together with the center pin they form a voltage divider for the ADC. "It's using an ADC equivalent to a Sonix SNAD01C. It's a serial ADC, and the 3 wires (START, CLK, DIO) are hooked up to USR2-0." The "paddle" circuit on the Hummer is radically different from the paddle section in the DTV Rev 2 schematic. > Video Initialization [Table]Video Init PB0-7 User0-7 Unmarked, but verified (see photo) ____ The user port inputs are also hard-wired to indicate to the unit which video mode and timing to use at startup (so that NTSC or PAL video can be set at the factory by switching resistors.) But this information can be kernal-patched, which frees all the port lines for other uses. [Table] Video-Settings Pins Pin: PAL: NTSC: Function: ------------------------- USR[0] 1 0 Pal-Ntsc USR[1] 1 0 PhaseAlt USR[2] 0 0 Sat0 USR[3] 1 1 Sat1 USR[4] 0 0 BurstLock USR[5] 0 0 Lockmode USR[6] 0 0 Tune USR[7] 1 0 PalBurst ------------------------- (Daniel Kahlin) _ > RS-232 [Table] RS-232 and Handshakeing from Userport (CIA) PA2 TP10 UserPA2 FLAG2 missing _ NOTE: Either nIRQ or nNMI might function as FLAG2 on userport (don't count on it--they have different functions.) nIRQ and nNMI probably correspont to IRQ and NMI lines on 65xx processor. FLAG2 is IRQ line for CIA 2. C64 hardware specs CIA IRQ as output only (CIA1, $DC00-$DCFF), FLAG2 as input only (CIA2, $D000-$D0FF.) User5 (PB5) isn't assigned for RS232 operations. However, the kernal RS-232 code might currently work in "3 line" (no handshakeing) rather than "X line" mode. Frankly, the C-64 documentation indicates that both FLAG2 and PA2 are needed for kernal rs-232 routines. Of course, custom-coded RS-232 routines could always be applied to the port (and using the interrupt lines is an option to replace FLAG.) It is pointed out (prominently) in the DTV programming guide that nIRQ and nNMI are bidi.... > Hacking the Userport Once the Hummer's video-initialization routines are patched to ROM, the resistors can be removed from the userport lines (add photo.) If all 8 userport lines are needed, the paddle ADC traces can also be cut (free up PB0-2.) The userport is fully bidirectional, so there are few limits on its usage.... David Murray has wired the user port connections to a joystick to get all the needed input lines (5 total--4 direction and one button.) Will this become the standard Hummer joystick port? Time will tell..... The core of this issue is that the joystick addr must be altered in games for DTV, and Hummers need a different addr than the C64 DTV. > Other info on Pins: TLR : "...it says in the V2 manual that, among others, JoyA0-A5 / JoyB0-B5 / USR0-7 are bi-dir 5V-tolerant pins with internal pullups. Further down it is stated that all of those are open-collector pins. This is actually open-drain as the process most probably is CMOS, but it works the same way." There are 26 bidi pins (not counting data and address busses--used together they would need some kind of latch.) [part] Keyboard interface Although a keyboard was never planned for any product releases, one was certainly useful during development. The interface hardware/code remains in the ASIC. To make it sweeter, any standard PS/2 keyboard will work. And no extra components are needed; only a DIN jack for the connection. This is usually the first mod for any DTV device. [Table] Keyboard Connections Signal Board miniDIN (ps/2) DIN (PC/AT) ---------------------------------------------------------------------- KeyboardClk TP3 5 1 KeyboardData TP2 1 2 GND common 3 4 Vcc +5v 4 5 The on-board +3.3v is generally inadequate for keyboard, and +6v from batteries will likely kill most keyboards. Most modders feed the board with a regulated +5V supply and tap it for keybd also. _ [part] IEC Serial Port The Hummer also has a fully-implemented CBM-style serial port interface, so standard diskdrives such as the 1541, 1541II, 1571, 1581, etc. are supported! Four connections are necessary: [Table] IEC Connections Signal Board DIN (6pin) ----------------------------------------------------------------------- IECAtn TP1 3 IECClk TP8 4 IECData TP9 5 GND common 2 _ [part] S-Video Mod http://galaxy22.dyndns.org/misc/hummerdtv/svideo.html [part] On-Board Power Regulator > General info The Hummer (and C64 DTV) unit's on-board power regulator is much-maligned for it's design and current consumption (although it functions fine and I've never heard of one failing.) One thing is clear from the V2 schematic--the design specs called for an efficient IC regulator, not the discrete component version. > To do. Include: Jim Brain's photo of V1 discrete component schem Switch/gnd issue Discharge line LED wired to replace zener > Device specs DG: My Hummer draws ~140 mA. If the LED's drawing 15 mA, that's close to 11% of the total current. If the LED draws 20 mA (it's bright!) that's about 14%! [Table] Component Power Requirements AT49BV163A (flash mem) ~12 mA when fully active. IS42S16100C1-7T (SDRAM) 70 to 170 mA when active, depending on the mode (seems like alot...) (oops. 170 > 140. I guess it's not using that mode...) SNAD01C ~500 uA (not even 1 mA. Assuming that's what's there...) The DTV ASIC-- ? _ [part] Significant Memory Addresses Joysticks JoyA $DC00 JoyB $DC01 The Hummer is wired with only two input lines for the joystick, which are used as control buttons in the game. User Port $DD01 [part] DTVLOAD To do. [part] Flash Memory directory "list" format The "$" file (fake directory scan) is in the following format: Directory Format ---------------- The directory is located at $010000-$013fff. Each entry is 32 bytes long: --- $00-$17 Filename max 24 bytes, padded with $00 $18-$1a Location of the file in flash. $1b-$1d Load address of file in RAM. $1e-$1f unused, always $00. --- Directory scanning stops when the first byte of the entry is $00. (Daniel Kahlin) The contents of the flash (file-portion) don't match the entries in "$". (David Murray) [part] Flash Memory file format The files stored in the Flash device are compressed with a simple run-length encoding scheme (similar to GIF files.) (Although the Hummer encoding scheme is has been reported as different from the C64DTV, Daniel includes the same algorythm in the "hummer_kernal.txt" file.) File Format ----------- The files are compressed using a simple equal-sequence compression algorithm. Every chunk of data starts with a code-byte. If the code is $01-$7f, that number of bytes follow. If the code is $80-$ff, then len=code & $7f, and a second byte follows this copies len bytes of data from the current destination-$0100+secondbyte. If the code is $00, then we are done. To just store the data without any compression, put an $7f byte before every 127 bytes, and terminate with a $00 byte. (Daniel Kahlin) [part] Reflashing ROM ROM write info (much credit to Daniel Kahlin on this issue): http://jledger.proboards19.com/index.cgi?board=dtvhacking&action=display&thread=1133731077 Link to flashing utility (beta) http://www.kahlin.net/daniel/dtv/flash.php --------------------- From Adrian (dw): Thought I'd drop a quick note on this subject. I wrote the flasher we used during the development of the PAL DTV. The prototype used a diffferent kind of flash chips though: 4 x Winbond 29c040 (256-byte sectors, 512KB per chip). The Atmel used on the production units has 64KB sectors, except for the first or last 64k, depending on wether the part # ends on T (top) or B (bottom). The principle is exactly the same though... unlock the flash chip with a 'magic' write sequence, issue an erase sector command, unlock again, issue a write command, write sector, wait for the chip to finish, verify, repeat till done (the winbond chips didn't need the erase sector part). One suggestion though, and you probably already know this but just in case: copy your charset to ram and use it from ram. You really don't want the asic reading char/bitmap/etc data from the flash while you're trying to write to it. We were led to believe all the production units would have flash, but I truly have no idea if the AT47 series is OTP or not. Best bet would be to try to write to one of the small unused 8K sectors at the end of the chip (SA38/39, $1fc000/1fe000, assuming a 'T' chip) and see what happens. I wish I had a production unit to tinker with :) If it does prove to be OTP, there's some interesting stuff in the reset routine that could be the next best thing to flashing your DTV.. I'm surprised nobody has noticed that ;) -------------------- [part] New CPU opcodes > Symbolic names (Mnemonic): [Table] Opcode names Opcode Mnemonic Operand Description --------------------------------------------------- $12 BRA (BRanch Always) $32 SAC # (Set ACcumulator mapping) $42 SIR # (Set Index Register mapping) _ (Naming adopted by Daniel Kahlin and used in DTVMON) The "DTVprogramming" PDF is the best source of hardware and low-level programming information specific to the DTV. [part] Bugs and Patches > Save Bug Discussion of bug http://jledger.proboards19.com/index.cgi?board=dtvhacking&action=display&thread=1136228960 > Fixes: (to do) > Patching Start Mode Direct To Basic: http://jledger.proboards19.com/index.cgi?board=dtvhacking&action=display&thread=1135883752 > Patching Video mode (and converting NTSC<->PAL) to do > Video Fix http://galaxy22.dyndns.org/misc/hummerdtv/video.html > Audio Fix http://galaxy22.dyndns.org/misc/hummerdtv/audio.html -------------------- [part] Hummer-Specific Software DTVMON -- machine lang monitor http://www.kahlin.net/daniel/dtv/dtvmon.php FLASH -- reflashing utility http://www.kahlin.net/daniel/dtv/flash.php 256DRAW, DIREDIT -- and more http://galaxy22.dyndns.org/misc/hummerdtv/software.html dtvencoder -- utility for encoding files (C64 DTV) http://www.d-schmidt.onlinehome.de/dtvencoder.zip -------------------- [part] PCB 1) Topside plane is GND 2) Bottom side plane is Vcc [part]TIPS ------------------------------------------ From David Murray How to turn the color on - If you are in the USA, which you probably are if you have one of these. You can get proper NTSC color by typing the following at a BASIC prompt: POKE 53311,1 Enable extended VIC instructions POKE 53313,28 Set high bit of Fout POKE 53314,0 Set middle bit of Fout POKE 53315,0 Set low bit of Fout POKE 53326,7 set exact timing (try other numbers between 0 and 15, see which makes your monitor happy) POKE 53327,2 Set Saturation, usually a 1 or 2, whichever looks best on your monitor ------------------------------------------ There are no easter eggs in the Hummer game. The C64 DTV included several hardware shortcuts and other nuggets such as photos of the development team. Easter egg example: Output of "dtvteam" program - Adrian Gonzales (programmer), Jeri Ellsworth (hardware), and Robin Harbron (programmer) [part]Footnotes