A little reverse engineering

To understand what we are trying to accomplish, everyone will need to learn a bit about how the electronics in the pinball machine work. So I now present to you my low budget tour around the electronics.

It's a Computer

There you have it, nothing complicated. The pinball is just a main CPU with a bunch of peripherals all wired together on a few different circuit boards. The machine operates by running a program out of its rom chips and exchanging data with various systems: Lamps, Switches, Sound, Plasma Display and so on. A basic understanding of how a computer works is helpful here, but not 100% necessary. After all you are all smart people, right? (the correct thing to do here is to say, "Darn right!")

Schematic time. Looking at the CPU and sound board schematic, on page one, find U209. This is the main 68B09E processor and is the core brain of this machine. Naturally, we will want to replace it (remember...I don't like burning roms and writing 68B09E asm code.) From this chip you will see a bunch of pinouts labelled D0-D7 and A0-A15. These are the data and address pinouts from the CPU and it is through these that it communicates with the various other subsystems. If you spend a little time tracing the dark lines from the address and data pins you will find that they connect to several other places on the CPU board. Our primary job is to work out how this data bus and address bus are used so that we can drive it, replace it, or ignore it all together.

We do have a clue to deciphering some important parts of the address decoder from reading the CPU and Sound Board Theory of Operation. It tells us that the address decoding is managed by a 1of8 demultiplexer and a PAL chip slotted in locations U213 and U214. These show up on the schematic just under U209, the main CPU. Take a bit of time and familiarize yourself with the names given to the pinouts on these chips. You will see that these map to many of the systems that we are interested in. Well, perhaps it is not immediately obvious, but trust me, you will see it.

I find that tracking things back from the end of the line to the CPU makes the job a bit easier. Take a look in the upper left hand corner of page 1 of the CPU schematic. This section details the dedicated switch system. The data bus tracks to U206, a 74HC245 chip. This is a bus tranceiver, depending on whether it is enabled or not, it allows the signals at its B0-B7 pins to replicate at the A0-A7 pins. For the CPU to read the dedicated switches, it must enable this bus tranceiver, then read the values of D0-D7 to determine the state of the switches. The enable pin is the barred G pin 19 which is labelled SWLO. We can reasonably call this SWitches, LOw voltage. Trace the SWLO line back and you will find that it originates at U214 on pin 15, the Y0 signal. Similarly by spending some quality time with the schematics, we can determine that the other signals eminating from U214 and U213 are used to enable and disable the various components on the data bus.

Here is a run down of the signal trace names and what I generally refer to them as


the main system ROM chip select |

the main system RAM chip select |

enables the port that connects to the I/O Driver board, allowing certain address bits to flow to and from the high power board. |

The sound system "strobe" |

The I/O driver "strobe" |


the dedicated switches (SWitches, LOw voltage) |

the dip switches |

memory bank select |

switch matrix "strobe" |

switch matrix row enable |

input from the plasma display controller |

output to the plasma display |

status signals from the plasma display |

Next time a little conjecturing about what the CPU is doing and a plan of attack for driving these signals with our own controller.