I had a spare bootleg replacement play pack from a Driving force on Galaxian hardware, so I proceeded to trace the circuit and try to identify the ICs used since they all have the IDs removed, other that the one attached as a later addition as IC7.
Following the tracing, I used the pinouts to identify the most likely ICs used, and where possible put them in the Retro Chip Tester and tested / read or dumped them.
The ICs turned out to be :-
- 1 : S2650
- 2 : 82S158 (handles all the Z80 <-> S2650 control lines and protection)
- 3 : TBP28S42 (memory remapping, dumped this, matches “Top Racer”)
- 4 : 7474
- 5 : 7474
- 6 : 74244 (used for IN0 protection – most games don’t use)
- 7 : 7474 (along with this written from main PCB)
The 82S158 is a precursor to PALs and GALs and allows you to program custom logic into each chip. I used the PAL dumping option on the RCT to get the original equations.
- (1) /Z80-RD = /S2650-RW * S2650_OPREQ;
- (2) /Z80-WR = S2650-WRP * S2650-MIO * S2650-RW * S2650_OPREQ * Z80-WAIT;
- (3) /Z80-M1 = S2650-MIO * OUTPUT-FROM-ADDRESS-REMAP-ROM;
- (4) /Z80-MREQ = S2650-MIO * S2650_OPREQ;
- (5) /7474-2D = /Z80-WAIT + /S2650-CLK;
- (6) /S2650-RESET = Z80-RESET;
- (7) /74244-GATE = /S2650-MIO * /S2650-RW * S2650_OPREQ * OUTPUT-FROM-ADDRESS-REMAP-ROM;
- (8) /7474-CLK = /OPREQ or /RW or /A14 or /WRP or MIO or A13
(5) will pause the 7474 that divides the z80 clock by 2, disabling the S2650 clock.
(7) is used to read IN0 from the 74244 (used for protection on Top Racer).
(8) triggers the flip flop to load D7 – this is fed back to D0 on IN0 and is used for protection.
Going back to a bootleg of the original play pack, it has most of the same chips but skips IC5 and IC7 used on Driving Force. They are used to feed BUSREQ to D6 and a signal from the main PCB (wire was dangling, so no idea where from) to D7 which would be returned on port 0
so it looks like the original play pack could have the protection as well, but not many games seem to use it. (they would have port 0 mapped in mame)
It seems that D0 would be loaded from D7 when an extended IO command is executed, but not being that familiar with S2650 coding I am unsure exactly which it would be.