Hardware Overview

The Sega Teradrive consists of a 286 IBM PC integrated with a Sega Megadrive. The PC side is fairly standard and is built around a Western Digital chipset found in a number of other 286 and 386 systems, including the IBM PS/55 5510Z which has some additional similarities to the Teradrive. The main components of the PC chipset are the WD76C10LP system controller (DRAM controller, memory map, etc.), the WD76C30 peripheral controller (serial and parallel ports), the WD76C20 floppy controller (also provides the RTC and NVRAM) and WD90C10 VGA. While the chipset supports more, the motherboard can only handle 2.5 MiB of RAM without modification.

The Mega Drive side is most similar to a MD1 VA3 or VA4, but has some important differences. The Z80 has 16 KiB of RAM instead of the normal 8 KiB and the VDP has 128 kiB instead of the normal 64 kiB. It has a discrete YM3438 instead of a YM2612 as found in other pre-VA7 MD1 systems. It has the same "fix" for incorrect status port reads as found in MD systems with an integrated YM3438, but implemented as discrete logic. For the 68K it has a 10MHz rated 68HC000 which runs at either the standard speed or 10MHz depending on the mode.

Joining the two is the IBM 79F2661 "bus switch". In addition to providing a bridge between the MD-side 68K bus and the ISA bus on the PC side, this chip also manages access to an extra 512 KiB ROM. This ROM contains a Kanji font, a ROM disk image for the boot menu and some firmware for the MD-side that implements a Teradrive specific variant of TMSS. This chip is also found in the PS/55 5510Z where it presumably is also used for Kanji ROM management.

286 Memory Map

This uses physical addresses rather than the more traditional segment:offset format since the latter has multiple representations for the same physical address and can't represent addresses above 1 MiB. Since the chipset is fairly flexible, a lot of this map can be changed, but this is the config set by the BIOS.

000000 - 09FFFF: conventional memory
0A0000 - 0BFFFF: VGA memory (only part of this may be used depending on VGA register settings)
0CE000 - 0CFFFF: bus switch memory window into extra firmware ROM or 68K address space (note address is configurable in settings menu)
0E0000 - 0FFFFF: combined VGA BIOS and main BIOS (in shadow memory)
100000 - XXXXXX: additional RAM

68K Memory Map

000000 - 3FFFFF: cartridge or expansion port or PC memory or firmware
400000 - 7FFFFF: expansion port or cartridge or PC memory or firmware
800000 - 9FFFFF: unmapped (32X)
A00000 - A07EFF: Z80 address space
A07F00 - A07FFF: freeze (Z80 VDP port window)
A08000 - A0FFFF: mirror of A00000
A10000 - A100FF: IO registers
A11000 - A110FF: memory mode register
A11100 - A111FF: Z80 BUSREQ/BUSACK
A11200 - A112FF: Z80 RESET
A11300 - A113FF: open bus
A11400 - A11FFF: unmapped (!DTACK not asserted, will freeze without additional hardware)
A12000 - A120FF: !FDC (Sega CD)
A12100 - A12FFF: unmapped (!DTACK not asserted, will freeze without additional hardware)
A13000 - A130FF: !TIME (cart mapper registers, also MARS at A130EC when a 32X is attached)
A13100 - A13FFF: unmapped (!DTACK not asserted, will freeze without additional hardware)
A14000 - A14003: TMSS lock, write only (note this functions differently from the standard TMSS lock register)
A14004 - A150FF: unmapped (!DTACK not asserted, will freeze without additional hardware)
A15100 - A153FF: normally unmapped (no !DTACK), 32X registers if 32X present
A15400 - ADFFFF: unmapped (!DTACK not asserted, will freeze without additional hardware)
AE0000 - AE0003: MD-side Teradrive bus switch registers
AE0004 - AEFFFF: unmapped (!DTACK not asserted, will freeze without additional hardware)
AF0000 - AFFFFF: PC IO space (including PC-side bus switch registers)
B00000 - BFFFFF: 1 MiB window into PC address space
C00000 - DFFFFF: VDP/PSG registers (with holes)
E00000 - FFFFFF: Work RAM

PC Side Bus Switch Registers

Key: X = writable by both CPUS, M = writable by M68K only, R = read-only, 1 = read-only, always 1, 0 = read only, always 0

1160: XXXXXXXX

Selects an 8 KiB page from kanji/romdisk/MD ROM (note only the upper 4 KiB of the page is visible on the MD side when MD firmware is enabled)
Set to 21h when unlocking MD side and in BIOS boot
Set to 0 by BIOS after initial 68K boot

1161: 11111111
1162: 110XXXX0

Controls address of memory window in 286 address space
Effectively top byte of real mode segment address or physical address >> 12
Normally initialized from a value stored in CMOS
Set to CE if value in CMOS is invalid
Window is 8KiB in size and is used for both PC-side access to MD hardware and the Kanji/romdisk ROM

1163: XXRRXXXX

bit 0: Enables auxiliary ROM (must also be set for 286 window into 68K address space to function)
bit 1: Enable 286 memory window into 68K address space (also disables access to firmware by 68K)
bit 2: unknown
bit 3: unknown
bit 4: Returns value written by 68K to AE0001 bit 0
bit 5: Returns value written by 68K to AE0001 bit 1
bit 6: Value written here is readable by 68K at AE0001 bit 2
bit 7: Value written here is readable by 68K at AE0001 bit 3
Set to 1 by BIOS and during MD unlock procedure

1164: MXXXXXXX

bit 0: Setting bit from 286 side pauses the 286 and releases 68K from reset

Clearing bit from 68K side puts 68K into reset and releases 286
Making certain other reg changes seems to make clearing this bit have no effect

bit 1: 0 = Teradrive hardware at 0 (if also enabled elsewhere), 1 = cart mapped at 0
bit 2: Controls video switch - 0 = PC video, 1 = MD video
bit 3: Dual boot bit. When both this and bit 1 are set, bit 0 is ignored and both CPUs run independently.
bit 4: Unclear function. When set bits 4 & 5 become 10 in AE0003 and 1165 returns a fixed sequence (D5,7F,00,AA,55,FF,80,2A)
bit 5: Unknown
bit 6: Set on TMSS failure immediately before wedging 68K by reading from VDP while configured for writes
bit 7: Seems to start as 1, clearable on 68K but not on 286
Dual boot mode makes all Teradrive hardware except AE000X and A14000 inaccessible (no !DTACK)

1165: 0000RR0R

bit 0: Indicates PC/MD switch setting, 0 = MD boot, 1 = PC boot
bit 2: Indicates video switch setting, 0 = "Video", 1 = "RGB"
bit 3: 1 indicates bus timeout on 286 access to 68K bus, cleared on read
bit 5: indicates MD hardware has been "unlocked" ('SEGA' has been written to $A14000)

1166: XXXXXXX0

low bits of selected 8K page for access to 68K memory from 286

1167: 0000XXXX

high bits of selected 8K page for access to 68K memory from 286
when taken together with 1166, holds 68K address >> 12
Also used along with 1166 for passing params from PC side to MD-side firmware

MD Side Bus Switch Registers

Note: The 68K can also access the PC-side registers via the AFXXXX region which gives access to PC IO space unless the Teradrive is in dual boot mode. This section only lists registers that are directly accessible by the 68K.

A14000: TMSS unlock, write-only.

Seems to treat all writes as word-wide so byte-writes can't be used to unlock.
Writing SEGA here unlocks PC access to MD hardware via the bus switch

AE0001: XXXXRRXX

bit 0: Value written here is readable at 1163 bit 4
bit 1: Value written here is readable at 1163 bit 5
bit 2: Returns value written to 1163 bit 6
bit 3: Returns value written to 1163 bit 7
bit 4: Appears to be used by TMSS firmware to detect cold boot (0 = cold boot, 1 = warm reset)
bit 5: Appears to be used by TMSS firmware to keep track of whether there's a non-TERA286 cart (0 = cart present)
bit 6: Unclear. Set late during cold boot process if MD/PC switch is set to PC mode
bit 7: Maps PC side memory at $0 when set as long as 1164 bit 1 is clear

AE0003: XXXXXXXX

Selects 1 MiB bank of 286 address space visible at $B00000

TMSS Firmware

The TMSS firmware is located at offset $43000 and is 4 KiB in size. To boot with this firmware, register 1164 bit 1 must be zero and page $21 must be selected in register 1162. Page $21 starts at offset $42000 in the ROM, but only the upper 4 KiB of a page is mapped into the 68K's address space.

The first time the firmware is run, it checks for the presence of a ROM in the cartridge or expansion slots by comparing both the $0-$3FFF and $400000-$403FFF regions to $FF to check for open bus. If any other values are found it checks for SEGA at $200 or $201. If this check fails, it sets bit 6 of register 1164, clears all bits of AE0001 except bit 4 (cold boot detect) which it sets and purposely wedges the 68K by attempting to read from the VDP data port while writes are configured.

If the cart passes the SEGA check, the firmware will check for two special values following the SEGA text: TERA286 or TERA68K. These checks are combined to produce a single cart type from 0-3 where 0 is no cartridge, 1 is a normal cartridge, 2 is a TERA68K cartridge and 3 is a TERA286 cartridge. After the cartridge check, the firmware checks for the PRODUCED BY OR UNDER LICENSE FROM SEGA ENTERPRISES Ltd. string in the PC option ROM address range. If found, it records the address it was found at and adds $100 to the cart type.

If a cart was found and it's not a TERA286 cart, then bit 5 is set in AE0001. This bit will be checked on subsequent boots of the 68K and will prevent unlocking the MD hardware. This is presumably intended to prevent using a Teradrive as a cart dumper.

Next the Sega logo is displayed. If a cart is present or an option ROM with the "PRODUCED BY..." text, then the "PRODUCED BY..." text is shown below the logo. What happens after the logo displayed depends on the cart type detected earlier.

TERA68K carts are booted directly without returning control to the 286 first. This is done regardless of the MD/PC switch setting. The next highest priority is an option ROM. The 10 lowest bits of the "PRODUCED BY..." string end address are cleared. A pointer is then loaded from offset 4 from this truncated address and jumped to.

For the 3 other cases (none, normal and TERA286), the firmware simply locks the TMSS register and returns control to the 286. On subsequent 68K boots, it looks at the word passed via the 1166 and 1167 registers (MSB in 1167) to decide what to do. There area few special values that are treated as commands and the rest of the range is treated as a pointer for the unlock process. The special values are:

• FFE -> does the MD hardware init part of the cold boot process and returns to the 286
• FFC -> locks TMSS and returns to the 286
• FFA -> displays the SEGA logo, locks TMSS and returns to the 286
• FF8 -> locks the machine in the same way as a cart TMSS failure

(value >= $A0 && value < $100)

(value >= $FE0 && value < $FF8) -> jump to work RAM address FF0100

A commented disassembly of this firmware is available here: ​https://github.com/mikepavone/teradrive_tmss_disassembly

Unlock Process

You can use the following snippet of x86 real mode assembly to unlock the MD hardware from the PC side

TD_BASE equ 0x1100
TD_FW_PAGE equ 0x60
TD_TMSS_FW_PAGE equ 0x21
TD_WINDOW_CTRL equ 0x63
TD_FW_TO_MD equ 1
TD_SWITCH equ 0x64
TD_SWITCH_TO_68K equ 1
TD_SWITCH_BASE equ 0x80

md_unlock:
	mov dx, TD_BASE|TD_M68K_PAGE ;0x1166
	mov ax, cs
	shr ax, 8 ; you can also just clear ax here, but the unlock takes a little longer
	out dx, ax
	
	mov dl, TD_FW_PAGE
	mov al, TD_TMSS_FW_PAGE
	out dx, al
	
	mov dl, TD_WINDOW_CTRL
	mov al, TD_FW_TO_MD
	out dx, al
	
	inc dl
	mov al, TD_SWITCH_BASE|TD_SWITCH_TO_68K
	out dx, al
	
	mov ax, 0xFFFF ;unclear exactly why this busy loop is needed
.waitlp:
	dec ax
	jnz .waitlp
	retn
	
	
	align 2
	db "PRODUCED BY OR UNDER LICENSE FROM SEGA ENTERPRISES Ltd.", 0

Expansion Port Pinout

B1 = pin on the front side of the system closest to the drive bays. A1 = pin on the backside also closest to the drive bays

This was first ​documented by piroxolin, but has been independently confirmed.

B1  VCC
B2  SR2
B3  VA8
B4  VA11
B5  VA7
B6  VA12
B7  VA6
B8  VA13
B9  VA5
B10 VA14
B11 VA4
B12 VA15
B13 VA3
B14 VA16
B15 VA2
B16 VA17
B17 VA1
B18 GND
B19 VD7
B20 VD0
B21 VD8
B22 VD6
B23 VD1
B24 VD9
B25 VD5
B26 VD2
B27 VD10
B28 VD4
B29 VD3
B30 VD11
B31 SL2
B32 VCC

A1  GND
A2  !MRES
A3  VA9
A4  VA10
A5  VA18
A6  VA19
A7  VA20
A8  VA21
A9  VA22
A10 VA23
A11 !ROM
A12 !RAS2
A13 !FDC
A14 !FRES
A15 !DISK
A16 !FDWR
A17 !CAS0
A18 !CE0
A19 !AS
A20 VCLK
A21 !DTACK
A22 !CAS2
A23 VD15
A24 VD14
A25 VD13
A26 VD12
A27 !ASEL
A28 !LWR
A29 !UWR
A30 !TIME
A31 !CART
A32 GND

IC List

U1: D42264V-10 (64Kx4 dual port VRAM)
U2: Sega 315-5313/Yamaha YM7101 (MD VDP)
U3: D42264V-10 (64Kx4 dual port VRAM)
U4: Toshiba TMP68HC000N-10 (10Mhz CMOS 68000)
U5: Sega 315-5309 (MD IO)
U6: D42264V-10 (64Kx4 dual port VRAM)
U7: 74HC4066 (Quad single-pole single-throw analog switch)
U8: D42264V-10 (64Kx4 dual port VRAM)
U9: 74HC4066 (Quad single-pole single-throw analog switch)
U10: IMSG179P (VGA palette RAM/DAC)
U11: Sega 315-5364 (MD bus arbiter)
U12: Sony CXA1145 (composite video encoder)
U13: 256Kx4 DRAM (VGA video RAM)
U14: 256Kx4 DRAM (VGA video RAM)
U15: 84C00AM-6 (Z80)
U16: Western Digital WD90C61-JE (VGA dual clock generator)
U17: 74HC4066 (Quad single-pole single-throw analog switch)
U18: IBM 79F2661 (labeled BUS SW)
U19: Western Digital WD90C10-LR (VGA chipset)
U20: 79F2662 (Display Switch, branded NEC but has an IBM part number)
U21: 74F245 (Octal bus transceiver)
U22: 74HC4066 (Quad single-pole single-throw analog switch)
U23: ALS257 (Quad 2-input multiplexer with tri-state outputs)
U24: M5M5165FP-10L (8KB SRAM for Z80)
U25: 74LS14 (Hex Schmitt-Trigger inverters)
U26: 74LS508 (Quad 2-input NAND gate)
U27: 74F245 (Octal Bidirectional transceiver with tri-state outputs)
U28: Sony CXA1145 (composite video encoder)
U29: ALS240 (Octal inverter buffer)
U30: ALS138 (3 to 8-line decoder/de-multiplexer)
U31: ALS151 (1 of 8 selector/multiplexer)
U32: M5M5165FP-10L (8KB SRAM for Z80)
U33: ALS32 (Quad 2-input OR gate)
U34: AMD N80L286-10/S (286 CPU)
U35: ALS00 (Quad 2-input NAND gate)
U36: ALS273 (Octal D-Type Edge-Triggered Flip-flop)
U37: ALS373 (Octal transparent latch)
U38: HN62414FPD80 (additional firmware)
U39: ALS244A (octal buffer and line driver with 3-state outputs)
U40: ALS157 (Quad 2-input data selector/multiplexer, non-inverting)
U41: Western Digital WD76C10LP-LR (system controller)
U42: Western Digital WD76C30-JU (peripheral controller, Serial & Parallel ports)
U43: ALS373 (Octal transparent latch)
U44: Yamaha YM3438 (MD FM chip)
U45: IBM 89X8922 (128Kx4 DRAM)
U46: 27C010 (BIOS)
U47: TL7705 (Single Supply Voltage Supervisor for 5V Systems with Programmable Time Delay)
U49: 74F125D (Quad buffer tri-state)
U50: ALS04B (Hex inverter)
U51: TL431 (Three-terminal adjustable shunt regulator)
U52: IBM 89X8922 (128Kx4 DRAM)
U53: ALS245A (Octal bus transceiver)
U54: ALS04 (Quad 2-input OR gate)
U55: Intel 8042 (keyboard controller)
U56: Sony CXA1034 (Headphone amp)
U57: 74LS06 (Hex inverter)
U58: ALS32 (Quad 2-input OR gate)
U59: IBM 89X8922 (128Kx4 DRAM)
U60: Western Digital WD76C20-JU (floppy controller)
U61: LM386 (audio amplifier)
U62: ALS245A (Octal bus transceiver)
U63: NEC D4714 (RS-232 Line Driver)
U64: ALS373 (Octal transparent latch)
U65: ALS244A (octal buffer and line driver with 3-state outputs)
U66: IBM 89X8922 (128Kx4 DRAM)
U67: ALS245A (Octal bus transceiver)
U68: ALS244A (octal buffer and line driver with 3-state outputs)
U69: ALS373 (Octal transparent latch)
U70: SP1?(maybe 8) (unpopulated)
U71: 32Kx8 PSRAM
U72: 32Kx8 PSRAM
U73: 74LS74 (Dual D-Type Positive-Edge triggered flip-flops)
U74: SP14 (unpopulated)
U75: SP16 (unpopulated)
U76: ALS32 (Quad 2-input OR gate)
U77: SP16 (unpopulated)
U78: SP20 (unpopulated)