Can anyone run custom code on an NES Test Station?

I just saw the "ROB the Robot Programming?" topic, and the short discussion on the NTF2 System Cartridge. Now's a good time to post the research I made about this cartridge recently. (Although I'm not sure whether this thread belongs in the NESdev forum or the NES Hardware and Flash Equipment forum; feel free to move it if necessary)

As noted in this post, the NES Test Station puts a register at $1000, which would normally be a mirror of WRAM $0000 in a regular Famicom or NES.

From examining the NTF2 System Cartridge ROM in a debugger, I have found that the register reports the following data:

• 0 (0x01): AC Adapter Test (active low)
• 1 (0x02): Audio/Video Cable Test (active low)
• 2 (0x04): RF Switch Test (active low)
• 3 (0x08): Unknown (probably low for the Accessories Test and high for other tests?)
• 4 (0x10): Unknown (probably low for fail and high for pass during the AC Adapter and Audio/Video Cable Tests)
• 5 (0x20): DIP Switch 1. OFF is 1, and ON is 0. The Audio/Video Cable Test will examine the DIP Switches when powering up (not when resetting)
• 6 (0x40): DIP Switch 2
• 7 (0x80): DIP Switch 3

For now, I'm calling this register "NTF2STATUS".

During the AC Adapter test, NTF2STATUS must report the exact value 0xFE; any other value is considered a fail. Similarly, the Audio/Video Cable Test requires the value 0xFD. In both cases, all 3 DIP switches are set to OFF, and the dial sets the selected test bit low and the other 2 test select bits high. The RF Switch Test does not read NTF2STATUS at all after it has been selected.

The Accessories Test is selected when all 3 test select bits are 1; it does not bother checking bit 3 (0x08) at all. But assuming that bit 3 is indeed for selecting the Accessories Test, that would leave bit 4 (0x10) for indicating the pass/fail state of the AC Adapter and Audio/Video Cable tests. This is uncertain, though.

In Game-Tech.us's NES Test Station videos, the BIOS cartridge is a 60-pin Famicom cartridge, but bootgod's database reports that a 72-pin NES cartridge version exists as well. You'll need to disassemble your NES Test Station to figure out which type of cartridge you need.

I would like to find out the following things about the NES Test Station and see it posted to the NesDev wiki:

• Do bits 3 (0x08) and 4 (0x10) actually report the data that I predict they might above? Bit 3 might be low for the Accessories Test and high for all of the cable tests, and bit 4 might be the Pass/Fail state of the AC Adapter and Audio/Video Cable tests, with 1 indicating pass and 0 indicating fail.
• Where else is NTF2STATUS mirrored? $0800-$0FFF, $1001-$17FF, and/or $1800-$1FFF? If NTF2STATUS is not at these regions, then are they mirrors of WRAM or open bus?
• What value is bit 4 (0x10) during the RF Switch Test? This test doesn't give a Pass/Fail result like the others, so this bit is currently unspecified during this test.
• What value is bit 4 (0x10) during the Accessories Test? Always 1? Always 0? More advanced behavior?
• What does NTF2STATUS report during the Game Pak Test? Does it turn into a mirror of $0000 then? You'll need to insert your custom code cartridge into the Game Pak slot on the front of the machine instead of the internal slot for this one.
• Do DIP switches even exist inside the NES Test Station, or are those 3 bits hardwired to always be 1?

Also, I have experienced a write to the register: When starting the Power Pad Test, or when unplugging the Power Pad while the test is running, it will actually write the value 0xFE to $1000. This happened at $E0E9 in the ROM. Is there an NTF2CTRL register in addition to NTF2STATUS?

region 1; lower left corner in the video, left is left
[PPU]
[2K PPU RAM] [74HC373]
[CPU]
[2K CPU RAM]—all normal NES parts

region 2; lower right corner in the video, left is bottom
[74HC368]
[CIC1] [CIC2] [74HC157]—I assume that one of the CICs is the lock, another one is the key for when it's operating off the internal famicom-style cartridge, and the 74'157 controls which key gets to talk to the lock. The '368, however, is a good question. By adjacency, it's probably not the controller ports, and has something to do with the CIC.

region 3; upper left corner in the video, left is bottom.
··········[HC541]
[HC368?]··[HC32]·[HC04]·[HC32]
[HC04]
[HC139]
[HC139]·[HC273]·[HC368?]·[HC08]·[HCU04]·[4011]
································[HC10]
································[4066]—the yellow parts correspond to something on the NES mainboard; the other parts are new.

region 4; rotary switch:
[LM339]
[HC32]

The new parts include: An eight-bit latch ('273), an octal tristatable buffer ('541), an analog multiplexer (4066), and a bunch of logic. The lack of "real" isolating parts means that it has to separate the diagnostics cartridge from the game cartridge by just modifying M2, /ROMSEL, PPU /RD, and PPU /WR.

There are no other switches other than the rotary switch and the three buttons on the front (power, reset, and "AV/RF" which seems to do nothing). The other inputs are actually diagnostic feedback.

Interestingly, the commands for the R.O.B. test do not consist of solid black and green frames. Instead, it alternates between solid black and the menu screen.

Also, for emulation purposes, should this ROM be assigned to a new mapper that simulates the registers discussed above?

The actual cart is an ordinary MMC1. Because it relies on changes in the console means it's not an NES program (because it isn't, it's a Test Station program).

I don't think this is really a situation where merely allocating a new mapper is appropriate.

Yeah I guess mappers are best reserved for hardware on the cartridge side. If one wants to support this cart in an emulator, one could add a NES Test Station mode to the emulator.

So, does no one have both an NES Test Station and an EverDrive N8 (60-pin or 72-pin depending on the internal BIOS connector) or other custom code cartridge? Or, if someone does have both and is willing to open up the NES Test Station for research, do you need a test ROM that can read and display a byte from any selected address (controllable via an NES controller)? I'll make one if you want me to.

If you want to emulate the NES Test Station anyway despite the lack of hard research, I would make the following assumptions:

• $0800-$0FFF is a mirror of $0000-$07FF.
• NTF2STATUS is mirrored to $1000-$1FFF. That is, a single 8-bit register is repeated 4096 times.
• Bits 5, 6, and 7 are always 1.
• Bit 3 is 0 when selecting the Accessories Test and 1 when selecting the AC Adapter, Audio/Video Cable, or RF Switch test.
• In the AC Adapter and Audio/Video Cable tests, bit 4 is 1 for pass and 0 for fail.
• In the RF Switch and Accessories tests, bit 4 is always 1.
• Too little is known about the Game Pak and Control Deck tests internally, so just disable them in the emulator.

Remember, these are just assumptions. Be prepared to change them if someone comes forward with hard evidence of the NES Test Station's memory map and NTF2STATUS's behavior.

From the video:
* The ribbon cable from the front panel has 26 total pins, and there appear to be no other relevant logic-level signals between the front panel and the mainboard.
* The '541 and '273 are relatively near the ribbon cable, and probably hold the read and latched values for NTFSTATUS/NTFCTRL.
* Something has to hold the state for the relay for the A/V switch test, but it may not be software-controlled
* All 7 pins on the rotary switch go somewhere, but that doesn't necessarily mean they go to the ribbon cable

26 pins has to hold both controller signals (gnd, +5V, /RD1, /RD2, STR, 1D0, 1D3, 1D4, 2D0, 2D3, 2D4), at least three bits from the rotary switch, at least one bit each for the A/V cable and A/C adapter tests.

In the video, he provides two close-ups of the "NTF2 SUB REV:B" daughterboard in the front panel which ... actually might be enough to trace what's going on there. (Doing that now)

... Ok, all six signals from the rotary switch definitely go over the ribbon cable. At least three, and possibly 5, of the signals on the ribbon cable are ground. One comes from the bridge rectifier+BJT thing. At this point, only two more signals are unaccounted for.

"A/V switch" is confusing. If you're referring to the RF Switch, then the relay cycle absolutely must be hardware-controlled. The program never writes to anywhere between $0800-$1FFF during the RF Switch Test (only at the beginning of the Power Pad test), so every half-second, an internal hardware-based timer is responsible for toggling between the Control Deck and Antenna signals.


Could bits 3 and 4 of NTF2STATUS really be separate status bits for the AC Adapter and Audio/Video Cable tests (after all, the NTF2 System Cartridge uses process of elimination to select the Accessories Test, never checking bit 3 after checking bits 0 to 2)? If that's true, then we still don't know which one is which.

However, the AC Adapter Test checks for the exact value 0xFE, and the Audio/Video Cable Test checks for the exact value 0xFD. If the 2 bits really are separate for each test, then that would mean that each test would interfere with the other, and both tests would need to pass simultaneously in order to get a "PASS" result in each one. But in the first part of Game-Tech.us's NES Test Station video series, you can clearly see that, when the AC Adapter Test passes, no composite cables are plugged into the Audio/Video Cable Test, and when the Audio/Video Cable Test passes, no AC adapter is plugged into the AC Adapter Test.