Saturday, August 05, 2006

Completed, at Last

As you'd probably noticed, the pics in the previous post are of the Bubble Bobble custom MCU.

Despite being one of the most popular games of all times, and having been in MAME for many years, the emulation of this game has never been perfect due to the lack of the original ROM for the MCU.

For some time, we had been using a 68705 program found in a bootleg board, believing it had been extracted from the original. However, monster behaviour was wrong and there were other problems, like the wrong behaviour of the clock item.

After some study of the program and of the game schematics, it became clear that the original MCU is not a 68705 at all (the pinout doesn't match) but looked more like a 68701.
The 68705 program had been written from scratch by the bootleggers using black box reverse engineering techniques, by running the original MCU and logging all its reads and writes from memory. Indeed, the 68705 program does a lot of reads from memory without doing anything with them--simply because the original MCU would read that memory and do some unknown action with it.

Eventually, the useless 68705 program was replaced by simulation code inside the emulator, which greatly improved the emulation accuracy. Monster behaviour was improved, the clock item behaviour fixed. However, there were still some unknown things, like how the randomisation of the EXTEND bubbles really worked.

At last, thanks to excellent work by Trinity, the original MCU ROM has been extracted. This required removing the cover from the chip, taking photographs of it under a microscope, and manually decoding the contents of the ROM bit by bit. The photo shown in the previous post confirms that it's in the 6801 class, not a 68701 however as it was conjectured, but a 6801U4.

With this ROM, we finally have the final piece of the puzzle for a 100% guaranteed perfect emulation.

Checking the original MCU program was very interesting. It was designed to provide many protection features that were eventually not used by the game, like:
  • process coin inputs and update the credit counter
  • handle the number of remaining lives for both players
  • handle the current round number
  • handle variable speed incrementing for four variables
  • return values from a 1280 bytes table of seemingly random data
The reasons why those features were not used are probably various. Some of them were probably awkward to use because they require to one one frame for the MCU to process the data, others weren't flexible enough like the coin input processing that wouldn't allow for coinage settings different from the ones hardcoded in the MCU (though versions of Bubble Bobble with different coinage settings don't seem to have been made anyway).

So, how close was the simulation to the real thing? Very close; "too good", actually. Let's see why.

The clock item behaviour was spot on, but off by one frame (the simulation made the counter expire one frame too late).

The EXTEND randomisation simply doesn't exist in the original MCU. While the simulation code used a RNG to provide truly random letters, the original MCU simply increases the counter every frame. This seriously affects the game, making the EXTEND letters predictable.
Since a new bubble enters the screen exactly 128 frames after the previous one, and the remainder of 128 / 6 is 2, this means that if you get consecutive letters each one will be 2 places after the previous one. So if you get 3 letters you can get either E, T, N or X, E, D. After that they will repeat. There are exceptions, though: if you create a new bubble in exactly the same frame when a new bubble should enter the screen, the bubble is delayed by one frame. So by timing the fire button exactly right you can change the bubble order. In theory you could get all 6 letters in a single level--let me know if you manage to do that! :)
Also, new bubbles will not appear if there are already 16 bubbles on the screen, so that will change the order as well.

The last, and most important, thing that the MCU does is compare the player coordinates with the monsters. The results are returned as flags indicating whether each coordinate is >, =, or <, and the absolute difference. This was done correctly in the simulation code, however there appears to be a bug in the original MCU. The code there attempts to check if the player collided with a moster and set a flag and indicate which monster in that case, but it just doesn't work. It would set the flag even if the player's Y coordinate matches one monster and the X coordinate matches a different monster!
This isn't much of a problem since the main program just ignores the flag--the collision detection is done correctly by the second Z80.
However, the MCU also completely stops processing the monster coordinates as soon as it finds a monster whose X coordinate is within 8 pixels of the player. So e.g. if you have a monster right above you three platforms up, and that monster is the first in the list, the other monsters could stop following you. This is a very subtle effect that's completely unnoticeable from what I can tell, though in theory it exists.

12 comments:

[[Emulation_Lover]] said...

Really nice, I'd love to see every MCU internal code dumped some day... I lose nothing for just dreaming hehe.

Does Chack'n'Pop and other old Taito games from the same era use this same type of MCU?

bubblept said...

"In theory you could get all 6 letters in a single level--let me know if you manage to do that! :)"

That's not theory at all, I used to do this all the time at the arcades. One of the bootlegs in MAME had the correct EXTEND logic, I forget which.

Here's how to do EXTEND in a single room:
1) Play in 2 players mode (to double the number of EXTEND letters)

2) Burst as many monsters together as possible

3) When the letters start apearing, get the first 3 and then start shooting like mad, until the screen is full of bubbles and the letters stop apearing (you need yellow candy)

4) Burst the bubbles and the letters start re-apearing. Some 50% of the time, the other group of 3 letters shows up and you make EXTEND in a single room.

I have some INPs at marp showing this thechnique. In fact, at the arcades with a good sideplayer, I could make EXTEND in 3 our 4 CONSECUTIVE ROOMS :)

Nicola Salmoria said...

bubblept: what I meant however is to get 6 consecutive EXTEND bubbles by shooting a bubble at exactly the right time after the third appears :)

emulation_lover: most of the other Taito games with undumped MCU use a 68705 which contains an internal EPROM, not a masked ROM, so it cannot be dumped this way.

tokrot said...

Brilliant news Nicola and a truly admirable effort. Many times I have asked myself if one would ever have perfect emulation of Bubble Bobble. Now thanks to this enormous effort we know the answer:

Would it be possible to post a hires picture of the MCU ? Would be nice to have as a wallpaper :)

clockwise said...

hehe, original MCU code for the bootlegs, and please leave the simulation code for the original

JustNiz said...

Wow thats stunning.

Just how in hell did you remove the plastic around the chip without damaging it?

..and who woulda thought you can actually *see* the bit patterns stored in the chip.

Wow again. You guys amaze me.

wkrick said...

I assume that the simulation code that was found on a bootleg will be kept around as well so we can play that bootleg version too if we want. Correct?

MADrigal said...

Hi Nicola, first let me tell you thanks for mentioning me and my simulators on your University Thesis ^^

I want to congratulate with you for this wonderful success on such hard problem. Bubble Bobble is my best favourite videogame ever, and I'm really glad you managed to solve all the internal program doubts.

I just want to report one very strange BB bootleg I once saw in my town (Sassari, Italy).

It had the "extend" bubbles generator stopped, and the red "E" bubble only was generated. You could have a stage really full of letters... but they were all identicals: red "E".

Anyone else ever saw this bootleg?

Luca "MADrigal" Antignano, Italia

Nicola Salmoria said...

The bootleg only showing red E letters would be the one using a 68705 to replace the custom MCU. The 68705 program is completely missing the logic to change the letter given.

mdentari said...

Fantastic stuff! Great dedication by Emulation enthusiast. Made my day the amount of passion you guys have on getting this right.

Emiins said...

I would like to know where can I find this (nice) emulated Bubble Bobble.
Sorry about my question, but is this for MAME?

Lord Khyron said...

Nicola, I didn´t understand not a single word of what you said, but I just wanted to tell you that you´re some kind of God to me. I don´t have enough words to thank you for your work to please our passion for videogames
YOU ARE THE ONE!!!