A CD-Rom emulator for SonyPlaystation that I have been writing for over ten years. Part 1

A long time ago, we had a game club in our city for several SonyPlaystation. Where I hung out a lot. There I fell in love with PS1 and games on it. The use of CD-Rom as a storage medium made it possible to bring video inserts that were stunning for those times, CD music as a design for the gameplay, the ability to make games multi-disc (they didn’t seem to turn this kind of cartridges), which was a definite plus. But it also introduced one minus, namely the degradation of the drive laser. And if at home, perhaps, it was not a big problem, then in the game salon they died every 2-3 months. That’s where I got the idea to make a CD-Rom emulator. And after a lot of years, I still fulfilled my dream.

The article may contain scary pictures, non-optimal schemes, wrong decisions. If you are ready for this and you are interested, welcome under cat.

PS. I know about the existence of psio, and console emulators, but I was interested in the process.

1. Attempt one, study the circuit

In general, twenty years ago, where I lived, the Internet, one might say, did not exist. Finding something in it was also more difficult. But then there were quite interesting books. One of which I managed to get. Namely, game consoles. Repair and service”. Where the PS1 circuit was found. After studying the circuit, and also under the influence of how it was broken down in this book, the idea ripened in my head that the easiest way to “emulate” the CXD2545 chip.

The task did not seem particularly difficult and there were not so many signals that had to be emulated, about fifteen. It seemed to me that the set-top box sends control commands, and this chip outputs data from the desired sector of the CD. In general, I was not very far from the truth. When I got online, I was able to find a datasheet for the CXD2545. True, in very terrible quality, in the form of a very crooked scan from paper. But in general, it became clear why all the signals are needed, and an approximate protocol for their work. Then I saw a list of commands that this chip understands, and realized that I could not master it. Since at that time blinking the LED on the AVR was a feat. Well, I didn’t have the PS1 itself, and I didn’t have a powerful AVR either. And so the idea is shelved for the first time.

2. Attempt number two, after many years

Everything that is described below is relevant for boards with a low degree of integration of SCPH-5XXX and below.

2.1 What to emulate

Many years have passed, I managed to work as an administrator, get a soldering station, a DE1 board from Terasic, a logic analyzer and the PS1 itself. And from time to time I played on it, but the laser still died in it, so I was able to get through FF IX, and I already watched the final splash screen on YouTube. Because, here she could not read the final screensaver, although the disc was read perfectly on the PC. And then an old idea came to mind. And after a short search on the Internet, a datasheet for the CXD2545 was already found in normal quality. And it also became clear what exactly needs to be done with all (almost all, as I was wrong about SENS) control signals. All signals can be divided into: data transmission, subchannel data transmission, status and control:

Data transfer:

Subchannel data transmission:

Status signals:

Control signals:

There are some more signals, but they are not particularly interesting and necessary (well, at least for now).

2.2 Logic analyzer and data analysis

2.2.1 Preparation

The signals to look for were known. How they should look was written in the datasheet. Now it remained to check how it really looks and how the set-top box communicates with this controller. And here I must say special thanks to Sony engineers. The set-top box has a huge number of test points. On which almost all signals of interest are displayed. After digging around on the Internet, we found high-resolution photos of the top and bottom sides of the board. Which greatly simplified the search for the necessary testpoints. I unsoldered a bunch of wires, which I then brought to the IDC type block and began to study.

Impressive is better not to look

After all the preparations, several samples of the operation of the signals were filmed. Everything that was used is posted on


you can open the logs using the proprietary


from the DSLogic analyzer. But it must be taken into account that for some reason that I can no longer remember, although the analyzer and 16-channel I did not capture data lines from the sidirom. Perhaps it seemed to me that there, in principle, there is nothing interesting. Therefore, see the annotation of signals where what. It should also be taken into account that the seventh channel on the analyzer turned out to be dead for me, so the SCOR signal was caught not crookedly and every other time, but this did not really interfere.

2.2.2 Analysis

To begin, I captured the Read the Table of Contents (TOC) event on two discs. And looked what happened.

Let’s start with the data because there were no surprises here. We should see something like this:

We do not use the WDCK signal. And so there are 24 bits of the signal, for each channel, recorded from the highest to the lowest, while the first 9 bits are the same. It seems to me that the first 8 bits are not used at all further, but I did not check. And this is how we see it on the analyzer:

Pins 3,4,8 all agree with the datasheet. It should also be taken into account that the clock frequency and the channel indication signal are transmitted even if there is no data from the sidir.

Next is the subchannel data. For the most part, there are no surprises here either.

A pulse appears on the SCOR line at the moment when the drive encounters the so-called S0 or S1 sequence when reading a frame from the disk, which I may tell you, but in simple terms, this is the sector start mark. After that, the SUBQ signal should go high, which indicates that there is ready data in the subchannel buffer. Further, using SQCK, we pull out 96 bits of data one bit at a time, of which the first 80 bits belong to the subchannel, the last 16 are some kind of PeakMeter, most likely it has adequate values ​​​​only for audio CDs. The last 16 bits may have other values, but I did not see any options for the prefix to switch to another mode. Yes, I spoke almost without surprises, but there were still surprises:

As you can see, 18 bits are read here, which is very strange, but later we will figure out what it is. And isn’t it garbage?

And here the interesting begins, namely the control signals. According to the datasheet it looks like this:

That is, we drive bits one by one from low to high, and the XLAT signal latches the received combination and sends it for execution. This allows you to make variable length command parameters,
What we actually see:

Everything seems to be so, but it was completely incomprehensible to me why the bytes 0x50 and 0xA0 were still sent but did not snap into place (and I had to carefully read the datasheet, but it’s so boring). In general, he sends and sends, with whom it does not happen.

And the last two signals SENS and SCLK remain:

According to the description in Russian-language sources, SENS works together with SCLK, but SCLK has never changed its state. According to the datasheet:

SENS output to CPU.

Moreover, I even read how it works without SCLK and still did not understand why it behaves this way. Why does it change state when it wants to. And a crazy thought flashed through my head that the leg dangles in the HI-Z state and just catches pickups from neighboring pins. For the test, I pulled the pin to the ground, the drive did not even spin the disk. Tightened up in VCC and everything worked fine. It was my first serious mistake that ruffled my nerves in the future. But more on that later.

2.2.3 Conclusions

After viewing the signals and reading the datasheet. It was clear that this is a relatively low-level chip. The purpose of which is to control the mechanics of the drive, and to issue data received from the disk. This chip does not know about any sectors, the external chip is responsible for this, as well as for indicating where to position the laser. And not an indication of the exact positioning location, but according to the left / right principle in search of the necessary data, based on the received subchannel data.

The task of emulating this microcircuit did not look very difficult. Receive commands, and emulate subchannel data and drive data as output. I decided to entrust the whole thing to the board


. First, I had it. Secondly, it lay idle. And thirdly, it seemed to me that FPGA is just perfect for such cases, it turned out to be true. In addition, there is already a slot for an SD card, from where I was going to take data for emulation. In general, the number one task was to emulate, reading the table of contents of the disk. And for this it was necessary to understand how it is formed. but we’ll talk about that in the next section.

Similar Posts

Leave a Reply