Original Firmware and ISA Card PAL

Notes on the two original binaries. Neither is distributed with this repository; see the note in the top-level README.

AT89C51 firmware — EZ2IO.bin

Source and confidence. Everything in this section below the string dump was produced by an AI decoding the 8051 opcodes in the image. It has not been checked with a disassembler, confirmed on hardware, or reviewed by a second party. See ../AI-DISCLOSURE.md.

1046 bytes (0x416). Embedded strings, verbatim:

EZ2DJ PROGRAM  V 1.1
DATE: 1999. 01. 30
UPDATE : 1999. 10. 05.
PROGRAMMED BY PAEK YOUNG

A physical AT89C51 can be reflashed with this image to repair a board with a dead MCU.

Structure

Internal RAM

Turntable decoding

The two decoder blocks are structurally identical, differing only in the mask applied to the port 1 input: 0x03 for channel 1 (P1_TT_S0/S1 on P1.0 and P1.1) and 0x0C for channel 2 (P2_TT_S0/S1 on P1.2 and P1.3).

Each block compares the current 2-bit state against the previous state held in 0x77 and increments or decrements the corresponding position byte, which wraps freely through 0–255. These are the absolute values the host reads at ports 0x103 and 0x104. Channel 1 feeds P0, which the host sees as 0x103.

Coin handling

The coin handler at 0x00C0 reads P1 and tests bit 4:

1. If the debounce counter 0x7C is non-zero, the sample is ignored.
2. If the previous sample in 0x7B also had bit 4 low, the sample is ignored. Only a high-to-low transition counts.
3. On a valid transition, the coin counter 0x78 is incremented and 0x7C is loaded with 20.

0x78 is therefore a free-running 8-bit counter, incremented once per debounced coin and wrapping at 255 — it is not a level or a fixed-width pulse. It is output on P3, which the host reads at port 0x105.

This is the basis for the correction noted in bus-protocol.md: a host should latch the whole byte and treat any change as one credit. It also explains the "companion bit" previously observed on bit 1, which is simply the next bit of the count.

Timing

Timer 0 runs in mode 2 with a reload of 0x83, giving 125 machine cycles per interrupt. At 11.0592 MHz the machine cycle rate is 921.6 kHz, so the ISR runs at 7372.8 Hz. The ISR divides this by 90 via 0x7F, giving an 81.92 Hz tick that decrements the coin debounce counter — a debounce window of roughly 244 ms. A further divide by 100 via 0x7E drives the slow counter 0x7D, which sequences a short pattern on the upper bits of P1 during the first seconds after reset.

ISA card PAL — EZ2CARD.JED

A PAL16V8 fuse map. Header fields:

AM TECH EZ2DJ IBM IO CARD MAPPING
Author:   KIM CHOON DUK
Company:  ONOFF SYSTEM
Revision: 2.0
Date:     12/10/98

This is the address decoder on the PC-side ISA card. Its active outputs share one common product term — a fixed high-address match corresponding to the 0x100 I/O block — and differ only in a few low bits carrying the A0–A2 offset and the read and write command lines.

Functionally: the PAL watches the ISA bus, recognises accesses to 0x100–0x107, and drives the select, read-range and write-range lines onto the DB25. This matches the protocol reconstructed by measurement and annotated on the board schematic, making three independent sources in agreement.

To rebuild an original ISA card rather than use a USB bridge, program a PAL16V8 with this fuse map and wire it per the card's bus and DB25 connections. The bridge described in arduino-bridge.md requires none of this.

This page is synced from docs/original-firmware.md in the ez2-io repo.