TutorVision / INTV88 Reverse Engineering

J. Zbiciak

March / April 2017; Updated October 2018

Special thanks to Earl Ruffa, whose INTV88 PCB provided much of the circuit information below, and Chuck Gill for providing access to his complete TutorVision.  Board photos show Earl Ruffa’s board, except where otherwise noted.

Hardware Overview        3

CP1610A CPU (U1)        3

RO9580 / P587 WBEXEC (U2)        4

Title Screen / Menu GRAM Font        5

Alternate U2: RO9580 / P586        6

System RAM: 4×2114 RAM + 2×74HCTLS174 latches (U3 through U8)        6

Interrupt / Bus Request Generation (U17 through U22)        8

STIC1A ASIC (U9)        10

STIC1A Interfaces        11

Bus Control Inputs        11

Pinout        12

Graphics Generation / AY-3-8900-1 Compatibility        14

Read Only vs Read/Write STIC register bits        14

Display Resolution: 160x192 vs. 159x192        15

Bus Isolation Mode / Cycle Stealing        15

Sears Bus Copy and VBLANK / STIC Period        15

INTV88 Bus Copy and VBLANK / STIC Period        16

Address Aliasing        17

Foreground / Background MOB Incompatibility        17

Sound Generation / AY-3-8914 Compatibility        18

ADAR Bus Phase / Running Code from RAM        18

To be measured:        18

Graphics Bus: GROM and GRAM (U10, U11, U12)        18

Comparison to original GROM        19

Title and Copyright String Comparison        19

Updated Alphanumeric and Punctuation Tiles        19

GRAM Compatibility Issues        20

Hand Controller Interface (U14, U15)        21

Video Interface (U16)        21

Audio Interface (???)        22

Jumper Block (JP0 to JP6)        23

Misc Observations        23

Prevalence of INTV88 Systems / SuperPro Variants        24

Board Variants        26

Supporting Docs        28

GI CP1600 Bus Phases        28

Bidirectional Bus Timing        28

Instruction Fetch and Data Access (Indirect Reg. Mode)        29

Instruction Fetch and Data Access (Direct Addr. Mode)        30

MVO Timing (Write Operation)        30

Hardware Overview

CP1610A CPU (U1)

The CP1610A is a pin-count-reduced, single voltage variant of the CP1610.  No data sheet is available.

I determined the pinout below analyzing connections into the rest of the circuit.  The CP1610A also appears in some later logic boards that predate the INTV88. It is found in some System /// and SuperPro units.  (INTV87 and perhaps others.)

Note: On previous Intellivisions, the CPU bus control signals go through additional logic that remaps the INTAK bus phase to BAR.  On the TutorVision / INTV88 PCB, the CP1610A bus controls go directly to the cartridge port without further conditioning.  That means that cartridges now see INTAK:

RO9580 / P587 WBEXEC (U2)

• 8K × 10-bit at $1000 - $2FFF
• First 4K identical to original 2609 EXEC
• Next 4K are TutorVision extensions
• Not bank-switched / page-flipped
• Conflicts with $2000 - $2FFF ROM in ECS

Datasheets:  

• RO9580.   This provides the entire 8K × 10-bit WBEXEC.
• RO-3-9502  (from 2609 Intellivision)

• Provides EXEC $1000 - $17FF
• Provides interrupt vector in response to IAB bus phase
• Decodes addresses for Scratch RAM

• RO-3-9504 (from 2609 Intellivision):  Provides EXEC $1800 - $1FFF.

The WBEXEC connects to the BC1/BC2/BDIR signals that are driven from the cartridge port, similar to the Intellivision.

On the original Intellivision, the EXEC ROM provides interrupt/reset vectors in response to the IAB bus phase.  WBEXEC has no /MSYNC input to distinguish a reset from an interrupt.  Therefore, the STIC1A likely picks up this responsibility.  No other hardware in the system is suitable.  See RO-3-9502 and RO9580 datasheets linked above for more detail on IAB.

Title Screen / Menu GRAM Font

Locations $2000 - $24AF in the WBEXEC contain packed graphics data that is mostly used for the title screen and TutorVision menu system.  This data gets unpacked to GRAM locations $39D0 through $3F7F.  This corresponds to GRAM card numbers $3A through $F0.

It appears the card loaded at $E6 (highlighted in red) is incorrect. Assuming this portion of the font is supposed to mimic IBM extended ASCII line-drawing characters, $E6 should hold a plus-sign shape.This is not an error in the dump.  Rather, this is apparently an actual error in the WBEXEC.

The cards $B6 .. $DA form the tall, thick font used for game names on the TutorVision title screen and elsewhere in TutorVision games.

Alternate U2: RO9580 / P586

INTV88 boards that lack the WBEXEC seem to have an INTV88-specific version of the Intellivision 1 EXEC.  The image is bit-identical to the Intellivision 1 EXEC; however, it is in a single RO9580 ROM designated P586.  It also shares the same second-line designation 3504-730A.

The fact that the two variants are numbered P586 and P587 suggests INTV was preparing to ramp up parallel production of TutorVision and non-TutorVision units, and the few SuperPro systems found with WBEXEC are evidence of INTV shipping whatever’s available to ship, there in the final days.

One curiosity:  RO9580 is twice the necessary capacity for holding the Intellivision 1 EXEC.  What’s in the other 4K, or is it just disabled?

System RAM: 4×2114 RAM + 2×74HCTLS174 latches (U3 through U8)

The 2 × 74HCTLS174 latch addresses to demultiplex the address/data bus for the System RAM.  These capture DB9 - DB0 to feed to A9 - A0 on each of the 4 × 2114s.  The A0 bit is also used by the controller-reading logic to select left vs. right controller.

The 2114s are organized as 16-bit memory, with separate byte enables for the upper and lower bytes.  The 2114s map into memory as follows:

The STIC1A generates all enables and chip-selects for the System RAM.

The STIC1A fetches BACKTAB from System RAM during active display, using /BUSRQ to halt the processor during fetches.

Interrupt / Bus Request Generation (U17 through U22)

The logic block U17 through U22 generates /INTRM and /BUSRQ signals from a set of signals provided by STIC1A.  Chip breakdown:

This circuit takes 3 inputs from the STIC1A ASIC:

• CBLNK, which indicates when the STIC is in horizontal or vertical retrace
• UNK_1, which appears to be closely related to /BUSRQ.
• UNK_2, which appears to be closely related to /INTRM.  (Possibly generated in response to INTAK.)

Note:  CBLNK is named for the pin it connects to on the cartridge connector.  UNK_1 and UNK_2 are signals I don’t have better names for.

The 6 chips form the following circuit:

The upper portion of the circuit stretches low transitions of UNK_1 out to CBLNK boundaries.  UNK_1 therefore indicates the start of /BUSRQ, while CBLNK defines the end of /BUSRQ.

The lower portion of the circuit uses CBLNK to count scan lines, ultimately generating a long /INTRM pulse.  Asserting UNK_2 terminates /INTRM; however, CBLNK also must toggle to fully deassert /INTRM; otherwise asserting UNK_2 will just deassert /INTRM until UNK_2 deasserts.

Quite why this circuit is necessary remains a mystery.  I suspect the ASIC was intended to generate /BUSRQ and /INTRM, but generated them incorrectly.

This logic is likely buggy.  The 74HCTLS163s have synchronous reset inputs. CBLNK must toggle while UNK_2 is asserted for circuit to reset properly. It’s not clear when CBLNK toggles.  IntyBASIC v1.2.9 games hang on startup.  While dispatching to an interrupt, the CPU dispatches a second time.  (Symptom: Interrupt return address of $100A, which is in the EXEC interrupt dispatch code.)  Current theory: STIC1A asserts UNK_2 when the CPU issues INTAK.  Under normal circumstances, STIC1A would also be toggling CBLNK around the time the CPU issues INTAK.  If the display was disabled for a long time when the CPU finally takes the interrupt, that assumption may not hold.

STIC1A ASIC (U9)

(Picture from Chuck Gill’s system.)

The STIC1A ASIC integrates the following major functions from the original Intellivision:

• Display generation (previously: AY-3-8900-1, AY-3-8915)
• Video FIFO (previously: RA-3-9600)
• Bus bridging between CPU bus and Graphics bus (previously: RA-3-9600)
• Sound generation (previously: AY-3-8914 / 8914A / 8916)
• Address decoding for CPU bus

The analysis below applies to the 8930 date code STIC1A variant.  At least one other date code has been spotted (8912); however, I expect the analysis to apply to both.

STIC1A Interfaces

The STIC1A has the following major interfaces:

• CPU bus interface:

• DB0 .. DB15
• BC1, BC2, BDIR (from cartridge port, not CPU)

• Graphics bus interface:

• 11-bit multiplexed address/data
• /GDWS (Graphics Data Write Strobe) write enable for GRAM
• /GBAR (Graphics Bus to Address Register) to demultiplex data/address bus

• 74HCTLS374 is rising edge triggered, and so /GBAR will cause it to sample address on falling edge of BAR bus-phase, consistent w/ GI’s recommendations. See GI CP1600 Bus Phases.

• /GRAM, /GROM enables for GRAM vs. GROM.

• System RAM interface

• /RAMH, /RAML chip-selects for upper/lower byte of 16-bit RAM
• DB0 .. DB15 for multiplexed address/data to RAM (shared with CPU interface)
• /RDWS (RAM Data Write Strobe) enable for writing RAM
• /RBAR (RAM Bus to Address Register) to demultiplex data/address bus

• 74HCTLS374 is rising edge triggered, and so /RBAR will cause it to sample address on falling edge of BAR bus-phase, consistent w/ GI’s recommendations. See GI CP1600 Bus Phases.

• Hand controller interface

• Single /HAND signal to enable hand controller MUXes onto CPU bus

• Video output interface

• RF8, RF4, RF2, RF1 signals mimic output of AY-3-8915 color processor.  These connect to a 7407 open-collector buffer plus resistor ladder to generate the actual video data.

• Audio output interface (details TBD)
• Clock generation

• Connects directly to the crystal to generate a 7.16MHz clock from which everything else is derived.

Bus Control Inputs

The STIC1A connects to the BC1, BC2, BDIR inputs driven from the cartridge port, rather than a direct connection from the CPU.  The STIC1A integrates the functions of both the RA-3-9600 and AY-3-8900. Therefore, this represents a change for the RA-3-9600 functionality (slightly), but not the AY-3-8900.  

Because BC1, BC2, BDIR come from the cartridge port, it’s possible to completely override the address map for all of the hardware inside the TutorVision/INTV88 with external logic, including the System RAM, STIC, PSG, and hand controllers.  On the Intellivision, you could not intercept bus cycles decoded by the System RAM (RA-3-9600), as it took its bus control inputs directly from the CPU.

Pinout

I do not know the STIC1A’s complete pinout.  I determined the following pinout through reverse engineering.  The following pin numbering assumes counter-clockwise starting at the top right corner.

Note: STIC1A does not connect to +5V VCC.  Rather, it accepts the same unregulated voltage input as the 7805 voltage regulator, indicated as Vunreg above.

Note2: GD0 .. GD7 in diagram above is GAD0 .. GAD7 elsewhere in this document. (1), (2) and (X) are the same as UNK_1, UNK_2, UNK_X.  

Note3: !FOO means the same as /FOO, ~FOO, FOO*, and FOO with a bar over it.  All five notations refer to an active-low signal.  Some signals polarity aren’t known definitively yet and may appear with inconsistent polarity notations in the short run.

Graphics Generation / AY-3-8900-1 Compatibility

No major oddities have been observed in the STIC1A’s graphics output or backward compatibility to the AY-3-8900-1.  There are some minor differences.

Read Only vs Read/Write STIC register bits

Locations $0000 - $003F mostly respond identically to an AY-3-8900-1, including the following:

• Bits 15:14 read as 0
• Other unimplemented bits read as 1

There is one exception:

• Bit 3 of location $0022 reads as 0.  (ie. reads as $3FF7 instead of $3FFF as expected.)  No function has yet been discovered for this bit.  No code refers to this location, and attempts to tweak it have no outwardly visible results.

This table shows read/write bits (RW)  vs. bits that return a fixed value (shaded value) by address.

Locations $0040 - $007F return $FFFF.  On older Intellivisions, a portion of GRAM(?) was visible here.

Display Resolution: 160x192 vs. 159x192

The STIC1A displays the 160th column, unlike the AY-3-8910-1.  This may have some implications for MOB-vs-border collision detection.

Bus Isolation Mode / Cycle Stealing

Bus Isolation mode is “more isolated” in some ways.  During active display, STIC registers return various random garbage.  GROM and GRAM however return $00FF.  In contrast, RA-3-9600 would sample the graphics bus, giving semi-predictable garbage based on what portion of the display was being generated.

The game Map Mazes shows some graphical glitches that appear as light-colored stripes near where the STIC should assert /BUSRQ.  This suggests the STIC1A may behave differently when programs have too many non-interruptible instructions in a row.  This requires further investigation.

The STIC1A definitely has different cycle stealing and bus isolation timing.  The following values were measured by irq_per, run on both a Sears unit and an INTV88 unit.

Sears Bus Copy and VBLANK / STIC Period

INTV88 Bus Copy and VBLANK / STIC Period

In this test, we see that the INTV88 unit allows slightly more bus-copy time when the vertical delay register is 0, and allows increasing amounts of bus-copy time as the vertical delay increases.  In contrast, the AY-3-8900-1 offers about the same amount of bus-copy time regardless of the vertical delay register. 

INTV88 steals fewer cycles, as indicated by the larger numbers in the S-ON column, and roughly identical numbers for vert_delay = 0 and vert_delay > 0.  Likely, STIC1A only issues 12 /BUSRQs for the 12 rows of cards, omitting the initial short /BUSRQ the AY-3-8900-1 issued at the start of field, and the 14th /BUSRQ that only gets issued when vertical delay is 0.  That is, the STIC1A likely omits the first and last /BUSRQ pictured here.  Also /BUSRQ appears to be ~1 CPU cycle shorter based on experiments in jzIntv.

The irq_per test does not measure how long STIC registers are visible for, only GROM/GRAM.  It also does not measure how long the STIC asserts /INTRM.  Those parameters need to be measured.

Also of note:  The Bus Copy Measurement makes the screen jump wildly on the Sears unit, and not at all on the INTV88 unit, which indicates the two behave differently when given too many non-interruptible instructions in a row.  This deserves further investigation.  Likely cause:  No initial short /BUSRQ.

Address Aliasing

The STIC1A does not respond to STIC register aliases at $40xx, $80xx, $C0xx.  It also does not appear to respond to GRAM write aliases at $7800 - $7FFF, $B800 - $BFFF, and $F800 - $FFFF.

Code which writes to GRAM at its aliases at $7800 - $7FFF, $B800 - $BFFF, and $F800 - $FFFF will not function correctly.  Note the ECS also masks these GRAM write aliases.

Foreground / Background MOB Incompatibility

Foreground/Background mode on the AY-3-8900 and AY-3-8900-1 limits all card numbers for GRAM and GROM to the range 0 - 63.  This limitation applies equally to BACKTAB and MOBs.  The AY-3-8900 STIC places the RO-3-9503 GROM into a different addressing mode that causes it to ignore bits 9 and 10 of the GROM address for all purposes.  (See the RO-3-9503 datasheet, bullet 3.)

STIC1A only applies the restriction to BACKTAB cards.  MOBs always see the full GRAM and full GROM.  Games that rely on Foreground/Background mode to restrict the span of GRAM or GROM card numbers for its MOBs will display incorrectly on STIC1A.

Sound Generation / AY-3-8914 Compatibility

The STIC1A PSG implementation mostly appears to be an AY-3-8914 clone.  Importantly, there is zero evidence that it is an AY8930 clone.  The 8930 printed on the package is most likely a date code.

STIC1A specific behaviors:

• The envelope-trigger register is readable, revealing the last triggered envelope type.
• A period of $0000 appears to be a maximal period, like the original AY-3-8914, rather than minimal period, as with the AY-3-8916 in the Intellivision II, as well as the AY8930.
• The volume registers are 6 bits, like the original AY-3-8914.  Bits 5:4 behave unlike any other PSG observed to date for values 01b, 10b, however:

• 00b:  4-bit volume in bits 3:0
• 11b:  Volume taken from envelope (similar to original AY-3-8914).
• 01b, 10b:  Takes volume from envelope for one “envelope step” and then go to silence.

• Bits 7:6 of location $1F8 are hardwired to 0.

ADAR Bus Phase / Running Code from RAM

The STIC1A behaves similarly to the RA-3-9600, in that direct-mode instructions do not operate correctly when run from system RAM.  This was tested with a simple program run from System RAM.

To be measured:

Timing of /BUSRQ, /INTRM.  Duration of STIC register visibility.  Whether MOBs are visible in the rows exposed by v-delay > 0.

Graphics Bus: GROM and GRAM (U10, U11, U12)

The graphics bus consists of the following components:

• 74HCTLS374 Octal Transparent Latch (U10).  This demultiplexes the lower 8 bits of address and data bus.
• AMI 0098-0210 GROM (U11).  This is a 2K × 8-bit JEDEC ROM containing the GROM data mapped at $3000 .. $37FF.
• 6116 (U12).  This is a 2K × 8-bit JEDEC RAM containing the GRAM data mapped at $3800 .. $3FFF.

The /GBAR signal from STIC1A instructs the 74HCTLS374 latch to sample GA0 .. GA7 from GAD0 .. GAD7.  This, combined with GA8 .. GA10 provides a 11-bit address to both GRAM and GROM.

The /GRAM and /GROM signals separately enable GRAM and GROM.  /GRAM goes to pins 18 and 20 on U11.  /GROM goes to pins 18 and 20 on U12.

The /GDWS signal acts as a write-enable to the GRAM.  It goes to pin 21 of U12.  Pin 21 of U11 is tied to ground.

Comparison to original GROM

• GROM tiles 1 through 94 (addresses $3008 through $32F7) differ between the two GROMs.  These hold the alphanumeric font.
• The title string “Mattel Electronics presents” is replaced with “INTV Corporation presents”.
• The copyright string “Copr @ 1984 Mattel” is replaced with “Copr @ 1986  INTV “.

Title and Copyright String Comparison

Updated Alphanumeric and Punctuation Tiles

This font is nearly identical to the IBM CGA font, with the following changes:

• Slash removed from the zero
• Vertical bar is a solid line
• The forward slash and backslash are thinner
• The ^ and _ are replaced with and

It’s otherwise pixel identical.  Reference:

GRAM Compatibility Issues

The TutorVision/INTV88 is slightly incompatible with the Intellivision, due to its expanded 2K × 8 GRAM.  The STIC1A does not appear to provide a mechanism to disable the additional GRAM.  This affects BACKTAB and MOBs in Color Stack mode, and MOBs only in Foreground / Background mode.  (MOBs have other issues.  See Foreground / Background MOB Incompatibility above.)

On the original Intellivision, the STIC effectively ignores bits 6 and 7 of the card number when selecting graphics tiles from GRAM.  (These are bit 9 and 10 of the BACKTAB entry and STIC MOB Attribute registers.)  The original Intellivision ignores these bits because it only provides 512 bytes of GRAM.  

In Color Stack mode, BACKTAB entries select GRAM cards with the following encoding:

A similar situation exists for MOBs.  The MOB Attribute register is encoded similarly:

With the expanded GRAM, bits 10:9 now form part of the GRAM card number, giving the user access to 256 GRAM cards.  Games which do not zero these two bits—either because they store other data in these bits, or just treat them as don’t-care bits—will display incorrectly.

Hand Controller Interface (U14, U15)

On the original Intellivision, the AY-3-8914 PSG provided two 8-bit input ports for the hand controllers.  The STIC1A absorbs most PSG functionality on the INTV88 board.  However, the hand controller input ports remain outside.

Two 74HCTLS257 4-bit 2:1 multiplexor chips provide the two 8-bit input ports for the hand controllers.  RA0 from the System RAM address latch selects between controller 0 and controller 1.  The /HAND output from the STIC1A enables the muxes onto the CPU bus when reading locations $1FE and $1FF.

The controller ports themselves connect to the inputs of the 74HCTLS257s directly, with 47kΩ pull-up resistors on each pin.

There are no series resistors on the controller inputs, unlike the Intellivision 1.

Video Interface (U16)

The main video interface consists of a 7407 open-collector buffer, along with a resistor-ladder DAC.  This mimics the resistor-ladder circuit that previously attached to the AY-3-8915.

The resistor ladder is essentially identical to the one in the AY-3-8915 data sheet and the original 2609 Intellivision schematic:  Outputs RF8, RF4, RF2, RF1 feed into 22kΩ, 11kΩ, 5.5kΩ (via two 11kΩ in parallel) and 2.1kΩ resistors, with an 18kΩ resistor to GND.

Audio Interface (???)

TBD

Jumper Block (JP0 to JP6)

The board has 7 pairs of jumper points, labeled JP0 through JP6.

Because the jumper block involves GA9 and GA10, I speculate INTV Corp may have experimented with methods to correct the INTV88’s GRAM compatibility issues.

Misc Observations

The RESET pin on cartridge connector doesn’t seem to do anything on the INTV88.  However, it is connected to an RC circuit.

At present, this means LTO Flash!, JLP, CC3, Intellicart, etc. cannot reset the console.  We observed this behavior with Chuck’s TutorVision.  In fact, Chuck’s TutorVision also requires hitting reset on every power-up.  Because RESET is connected to an RC circuit and a pin on the ASIC, I have some hope that we can make LTO Flash! and JLP reset the unit properly.  (To be certain: I have not tried CC3 or Intellicart in the system yet..)

MCLK on cartridge connector doesn’t seem to be connected to anything either.

Beamrider crashes from LTO Flash; runs OK in jzIntv.  Don’t know why—perhaps double interrupt issue. Worm Whomper displays corrupted graphics. So does Space Patrol.  Reason: Expanded GRAM.

Prevalence of INTV88 Systems / SuperPro Variants

Some SuperPro systems contain INTV88 hardware.  We don’t have much data on which SuperPro systems are INTV88 systems.  All confirmed INTV88 SuperPro systems have an A-series serial number.  We’ve also verified that some SuperPro systems have an Intellivision 2 EXEC image.

Datapoints:

I use the mainboard type designation “Intellivision I” to broadly mean all mainboard styles similar to the original 2609 Intellivision, including the INTV 1987 design, despite the fact there’s a ton of variants out there.  I list INTV 1987 where we’ve explicitly identified an INTV 1987 board.

Board Variants

At least 3 different INTV88 PCB revisions have been spotted, and can be identified by a circuit trace near U1.  On one board variant, there is no circuit trace below the U1 designator.  On another, there is a jumper there.  On the third, there’s a permanent trace.

The leftmost (no trace) appears to be the earliest, while the permanent trace version seems to be the newest.  This trace seems to be connected to Vunreg and the Zener diode near the RF modulator.

The second and third style of boards have additional inductors L1 and L2 near the power supply and controller input section, and capacitor C31 near the reset circuitry between R1 and R2.   These are all missing on the first board style.

Note:  The second board style labels L1 and L2 as R33 and R34; however.

Chuck Gill’s system is a fourth variant.  It looks like the second variant; however, it uses a mesh copper fill rather than a solid fill in certain areas.  It’s otherwise the same as the second variant above.

Chuck’s:

Other:

Supporting Docs

GI CP1600 Bus Phases

From CP-1600 Microprocessors User Manual, 1975.

Bidirectional Bus Timing

Instruction Fetch and Data Access (Indirect Reg. Mode)

Instruction Fetch and Data Access (Direct Addr. Mode)

MVO Timing (Write Operation)