PES Hacking for fun and (non)profit!

Well, Lord Nightmare wondered what could be done about this PES box. For those that don’t know what it is, it’s a white box with a TSP5220CNL TI speech chip inside it. There’s an 8031, RS-232 port, and a few other doo-dads. It was apparently some kind of educational aid. The box’s PCB inside is marked: “Pacific Educational Systems VPU Ver 2.1” The EPROM had a hand-written sticker on it marked “2.5” which is apparently the version number. There’s an empty spot on the board for a RAM chip, but it’s not populated. The box will run OK off of 12V DC, or a 9V wall wart (since these output around 12V DC when lightly loaded). Don’t feed it much more than this, the cap on the input is only rated for 16V and might go kablooey otherwise.

The problem with it is that the handshake handling is very crummy on it- it is almost impossible to make it work without overrunning its (nonexistant) buffer. I tried shutting off the serial port FIFO, but even that wasn’t enough. Sooo, out came the EPROM and the disassembler!

The EPROM contents were disassembled 2 years ago when we originally got the boxes to see how they worked. Come to find out, the code is only around 120 bytes, so most of the 8K EPROM is just wasted space.

I pretty much rewrote most of its code and added a 64 byte FIFO as well as proper handshaking control and XON/XOFF. This lets you feed it from a serial port and not worry about buffer overruns (within reason). The end result is it works perfectly when I send it a sample file dumped from Paperboy (arcade).

The frequency is a tad high though for Paperboy, so I removed the 82K resistor and dropped a 100K resistor in the box, then tweaked the pot until I got 160KHz on the ROM clock (as it came, it was set for 200KHz). I probably didn’t have to swap the resistor out but that’s how it ended up.

For fun, I swapped in a TMS5200, which is an earlier (buggy) version of the TMS5220. The results of both can be heard. The first is the TMS5200, the second is the TMS5220. The MP3 is here:


If you want to modify your box, you can get the asm file and binary files here:


One thought on “PES Hacking for fun and (non)profit!”

  1. Kev,

    I got an e-mail from your buddy Jon today who saw that I bought some of these boxes on e-bay as well. I read and disassembled the eprom as well to see how it worked. What a waste of a 2764.

    I wrote some code on the PC to send 5220 speech data and quickly found out that I couldn’t keep the buffer full either. It sends the 5220 status byte after each data byte it receives. I have to say that the flipping of the bit order between the 8031 and 5220 is a pain in the butt also.

    So, I replaced the 10.245 Mhz crystal (which is not the right crystal to get exactly 4800 baud anyway – it’s about 4850) with the 11.059 and patched the baud rate divider value in the eprom to make 9600 baud. Now it works and I can keep the buffer full.

    Your use of the hardwire handshaking and/or xon/xoff is a good idea that doesn’t require the crystal change (but I only had to patch two bytes in the EPROM.)

    I don’t have a website, but I can send you a quickbasic for dos program that I wrote for explainig to others how the box works and how to communicate with it. It assumes the the box has been modded for 9600 and that you’re using a true dos machine because it reads/writes directly to port registers. It’s well commented. Send me an e-mail and I’ll forward the program back and you can do with it as you please.

    Lastly, I’m using the vocabulary out of the TI-99 home computer speech synthesizer roms for the speech data. No changes were required to any of the speech rate resistors.


Comments are closed.