Nintendo 64 Experiments

Unless noted with the test the following equipment can be assumed.

• N64 Console (NUS-001 USA) w/ Expansion Pak (NUS-007)
  • Serial - NS272135424, probably: NUS-CPU-05/NUS-CPU-05-1
• N64 Controller (NUS-005)
  • Transparent Black
• Saleae "Logic 8" Logic Analyzer
  • Note the software can be used without the hardware to view the files below.
• Custom "Breakout board" using Extension Cable

Controller - Experiment #1 -Voltage Test

• Additional Equipment
  • Multi-Meter
• Hypotheses
  • The power pins for the controller are 3.3 Volts (not 3.6 or 5V)
• Observation
  • Use the analog channel of the Saleae Logic 8 Analyzer
  • Review community created Schematic for 3.3 Volt power rail
  • N64 label indicates required power supply is 3.3 Volts
• Results
  • LA analog channel: besides power on the voltage range is: 3.312 - 3.375
• Assumption
  • The power pins for the controller are approximately 3.3 Volts
• Logic Analyzer Output - Download below "N64-Controller-PowerPin-AnalogVoltage.logicdata"

Controller - Experiment #2 - Raw Digital Data for initial review

• Additional Equipment
  • Game Cartridge "Conker's Bad Fur Day"
• Hypothesis
  • There is data going across the wire
• Oberservation
  • The Data pin is pulled high (it's default state)
  • The toggled low in different patterns of on and off
  • With consistent timing during toggled pattern
• Results
  • Logic Analyzer File Output "N64-Controller-E2-Raw Data.logicdata"
  • Pin goes high about 355 ms after power on (Manual triggering)
  • At about 1 second and 800 milliseconds is the first sign of possible data
  • First 2 groupings are small the following ones are much larger.
• Assumption
  • There is digital data going across the wire

Controller - Experiment #3 - Proof of Data

This is the first time we are going to make some assumptions that are based on internet research but we will prove them before we get much further.

• Additional Equipment
  • None
• Hypothesis
  • We have enough information to determine there is real data there.
• Observation
  • Using the output file from Experiment 2
  • Zoom in on the first small block of data

• At first this looks cryptic but from reviewing other web sites that have attempted this kind of decoding we can expect the following exchange.
  • Console sends a Command with or without data
  • Console sends a "Console Stop Bit"
  • Controller Responds to Command
  • Controller sends a "Controller Stop Bit"
• We can also learn that each "bit" is made of both a low and a high.
  • First there is a minimum low of 1us
  • Then 2us of the bit data (either high or low)
  • Ending with 1us of high
  • Then starts again.
• The stop bits are a little trickier
  • I'll give you the first one

• It's the low for 1 us, then high for 2.4 us. (Ignore the 5.4 us) in this instance it only stands out because the high duration isn't a standard duration of either 1 us or 3 us. It's also different because it occurs at an 8-bit boundary.

• Here it is the whole thing marked up so it's easier to decode.
  • Yellow is the Console Command in this case it's 0000 0000 or 0x00
  • Red is the Console Stop Bit (The low 1 us and the 2.4 us high)
  • Blue is the Controllers response broken up by the pink indicators into 3 bytes or 24 bits.
    • Decoded it's 0000 0101 0000 0000 0000 0001 or 0x05 00 01
  • Green is the Controller Stop Bit, this one is a little easier to identify because it's low for 2 us where all of the other low durations are either 1 or 3 us.
• Results
  • There is data of some kind of patterned data going across the wire.

Command 0x00 Notes

• API Docs state that the Standard Controller has 2 bits toggled HIGH
  • CONT_TYPE_NORMAL (made up of the following) (0x0005)
    • CONT_ABSOLUTE (0x0001)
    • CONT_JOYPORT (0x0004)

Command 0x01 Notes

• Left/right X axis +/- 61
• Up/down Y axis +/- 63
• X axis incline +/- 45
• Y axis incline +/- 47

Experiment #4 - Prove it's not a game specific pattern

• Additional Equipment
  • Another game (1st Party - Nintendo)
  • Another game (3rd Party)
  • Another game (Japan)
  • Another game (Home Brew)
  • Flash Cart
• Hypothesis
  • Let's confirm that the same data goes across the wire when other games ask for it.
• Observation
• Results

Experiment #5 - Prove Console vs Controller data

• Additional Equipment
  • 2k Ohm Resister
• Hypothesis
  • The data really is showing both a console and controller "conversation".
• Observation
• Results

Experiment #xx - Capture Controller plugged in to already powered on Console

• Additional Equipment
  • None
• Hypothesis
• Observation
• Results

Experiment #7 - Research + validation

• Additional Equipment
  • Google
• Hypothesis
• Observation
• Results

Experiment #XX - Reset Command 0b1xxx x111

• Additional Equipment
  • First Party (Nintendo Controller)
  • 3rd Party Controller
• Hypothesis
  • The bits in between may not matter, therefore nearly any command with the pattern 0b1xxx x111 will have the same result as the 0xFF command.
  • If the hardware isn't required it's often not implemented.
• Observation
  • From a Home Brew application send the command 0x87 (yes hex) 0b1000 0111
• Results

Experiment #XX - Rumble Pak Init

Additional Equipment

Hypothesis

Observation

Results

Experiment #XX - Rumble Pak On

Additional Equipment

Hypothesis

Observation

Results

Experiment #XX - RUmble Pak Off

Additional Equipment

Hypothesis

Observation

Results

Experiment #XX - Multi-Player delay between P1 data and P4 data, hard coding to read only controller one may be a transfer rate performance improvement.

Additional Equipment

Hypothesis

Observation

Results

Experiment #XX - Max actual Data Rate Using Command read commands

Additional Equipment

Hypothesis

Observation

Results

Experiment #XX - Transfer EEPROM data between 2 controllers, what is the data rate?

• Additional Equipment
• Hypothesis
• Observation
• Results

Experiment #XX - Is the PIF filtering the wire?

• Additional Equipment
  • None
• Hypothesis
  • The wire is always carrying controller state + accessory status/data
• Observation
• Results
  • The timing suggests a maximum data rate of xxxxx
    • Although the actual data rate is probably much lower