NEC uPD78 series MCU is used in both stationaly and portable DCC recorders. uPD78056 is used in DDU2113. DCC170/175 uses uPD78058.
Has someone tried to read the FW code out of these MCUs? I’ve found some information about PROM read process, but before doing any steps in this direction I’m interested if anyone has done this job before.
The purpose of doing this is primarily to check if MCU code from DDU-2113 contains any undocumented modes allowing to perform external communication and write of custom data.
As far as I know, no-one has tried to read the UPD78 microcontroller ROMs from any DCC recorders. I would be very interested in a dump and disassembly. But I’ve never worked with the UPD78 series microcontrollers so I know very little about them.
With a dump and disassembly, it would be possible for us to figure out what kind of commands the UPD78 accepts from the front panel MPU (also a UPD78), and how it controls the DCC chips via the L3 bus. As you may know, I’ve reverse-engineered much of the protocol between the front panel and deck controller in my DCC-i project on Github, and one of the interesting discoveries is that the DDU generates VU meter values that aren’t used in the 730 or 951 because they have no VU meters.
A reverse-engineering of the UPD78 on the DDU might make it possible to replace the MPU in 1st and 2nd generation DCC recorders to give them more capabilities.
2nd Generation DCC has 80C51 family MCU and should be easier to read than NEC 78K0 if Philips had not implemented any kind of PROM protection there. I have a plan to read them too but a bit later.
As for me, personally, 3rd Gen deck’s code could be investigated to the possibility to write custom SYSINFO (this brings us the possibility to make any SYSINFO metadata). As for DCC175, we still need to reverse-engineer custom serial protocol, and having ROM dump can make it a bit easier.
I also did not have any experience with 78K0, but it seems disassemblers exists, and also MCU is well-documented. It will be an interesting task.
I found information on how to read uPD78 PROM area so it is just a question of time when I’ll be able to do this. Currently I’m still working on my DCC175 (mechanism part), and next task after lowering W&F from it will be packet sniffer between DCC175 and DCC-Link. I’m going to build it aroung RPi Pico 2, all parts needed for this arrived some days ago. For uPD78 PROM reader I think I’ll use some Arduino because of 5V nature.
If you have any programmer for MCS51 you can try to dump MCU from 2nd Gen. I’ll also try to do this but later.
The DCC Museum actually has a source code listing of the 8052 on the Deck Control circuit board of the DDU2113 deck from the DCC730 and DCC951 (which is also used in the DDU2212 of the FW68 mini system and the DDU2213 of the DCC771 double deck recorder).
We don’t know anything about the UPD78 firmware on the digital board of the 3g decks but I’ve reverse-engineered most of the protocol between the front panel microcontroller and the Digital Board microcontroller in my DCC-i project (GitHub - DigitalCompactCassette/P700: Enhancing DCC recorders).
I don’t think it’s possible to write custom SYSINFO with the 3rd generation recorders without replacing the UPD78, and developing a replacement would be more work than I would like to do.
The protocol between the DCC-175 and the PC-Link cable is already fully known, too. I’m pretty sure it’s possible to record SYSINFO and AUXINFO at the same time as music.