Two tiny 65816 DTV consoles

The 21st century direct-to-TV game console: a dirt-cheap toy dragging poor ports of cherished games to a more downmarket age. If you couldn't afford the real device, your alternative was these inexpensive, inadequate facsimiles faithful only to one's gauzy recollection. As their chipsets are generally grossly underpowered and optimized solely for cost, the vast majority didn't even try to run the original games precisely as they were, and the quality of the resulting rewrites sometimes showed their software to be as rushed as the hardware. (Even today, where true emulators are more plentiful, the SoCs these devices use often still require compromise.) There were certainly standouts that are practical miniatures of the original systems, notably the Commodore 64 Direct-to-TV and Atari Flashback 2, but the remainder during their zenith in the early 2000s were more like this Intellivision and two Atari 2600 imposters, playing uneven resurrections on unrelated silicon.

But it turns out these three (and others) have something in common besides the bargain bin: they're all derived from our favourite chip, the 6502. In fact, the two Atari imposters even embed the 6502's 16-bit descendant, the 65816. How do we know this? Rampant speculation, foggy memory, datasheets and vidcaps — and taking them apart, of course.

I confess I fell into the DTV trap a couple times other than the C64 DTV, which is enhanced over the original and really should be considered a distinct Commodore computer of its own. I was Team Intellivision as a kid (we went from an Atari Ultra Pong Doubles to a Tandyvision One), I got the Intellvision Lives! CD for my Mac, and I figured the DTV version would be a great cartridge-free small version. Instead, I ended up being so disgusted with the abysmal quality of the ports that I'm pretty sure it went in the trash electronics recycling almost immediately, or at least I can't find it anymore. Sometime ago I'd also got an AtGames ColecoVision clone that was on sale, which also turned out to be crap (sold it at a yard sale), and the convertible Tommo Neo Geo X which does truly play in emulation but MAME was more convenient and so I found a buyer for it. The only DTVs I ended up keeping were my modded C64 DTV and a Hummer direct-to-TV game which is a later version of the C64 DTV hardware.

Recently, however, someone mentioned the Winbond W55V9x series of "TV-Toy" chips and this piqued my interest to see how hackable they might be. But first let's beat up on the Inty direct-to-TVs a bit more, partially because I despise them in particular, but also because they make a good technical lead-in.

One of the most common architectures for early generation DTVs is the so-called NES-on-a-chip ("NOAC"), which makes them little 6502s since the Nintendo Entertainment System/Famicom was 6502-based, and the Inty DTVs were all (near as I can determine) of this specific type. Originally the various "Famiclones" made their own versions of the Ricoh 2A03/2A07 CPU (an NMOS 6502 with audio hardware and no decimal mode) and 2C02/2C07 PPU video chip, their clones of which were separate components initially and later consolidated to reduce cost further. Such systems were invariably accompanied by any required mapper hardware and ROMs. The advantages of these clone chips were obvious — a community of people already experienced in programming for them and an older chip that was cheap to manufacture — and soon they appeared in all sorts of basic applications like these beyond merely being knockoff NESes. The licensed Inty DTVs came in various form factors differing pretty much only in their shape, included games and menu interface.

There is no loyalty to any particular architecture in DTVs because cost is always the leading consideration. As such, notice the ominous disclaimer on the box that I originally didn't: "Original games have been modified for optimal play on this device." From a design perspective, they already started in the hole because the NES architecture was an especially bad fit for the Intellivision. Besides the issue of an 8-bit CPU (the 6502) implementing games written for a 16-bit one (the Intellivision's General Instrument CP1610), the NES PPU maps somewhat poorly onto the Inty's STIC video chip. The STIC can have independent background and foreground colours for each 8x8 "card," but the PPU only supports selecting colours from four pre-specified palettes in groups of 4 tiles (also 8x8 each), unless you use one of the more sophisticated mappers. Moreover, the STIC generates a 159x96 (20x12 cards) display, so you can't get around that by doubling up on the PPU because its display is 256x240 (32x30 tiles), though at least you'd have more than enough pattern table overhead to support all 240 Inty on-screen cards at once. Similarly, STIC sprites, eight per scanline, can all have different colours and be dynamically stretched in hardware. Although the PPU matches the sprites per scanline and allows multicoloured sprites, it also does so off pre-specified palettes (modulo mapper) and doesn't have support for hardware resizing (i.e., for stretched sprites you'd need additional precomputed sprite images). About the only thing that did more or less directly port to NES hardware was the audio. While most Inty games were simple enough to be translated with some thought, it so happens that the NES PPU is not capable of accurately representing every possible STIC frame, and it will become clear very quickly that the programmers here didn't use any thought anyway.

Intellivision Productions, then the owners of the Inty IP, licensed various games and the trademark to Hong Kong-based Techno Source, who in turn contracted out the software development to Chinese developer Nice Code. Nice Code already had experience programming simple games for famiclones and some of the work they did here turned up under other names or with minor changes in other famiclone collections. (Later Inty DTVs such as the X2 had games ported by an unknown Chinese firm instead of Nice Code. However, they are still NOAC-based DTVs, and they still sucked.)

The menu is very simple and selects from the 10 available games. Let's start with the very famous Astrosmash!. This is a simple shoot-em-up with straightforward gameplay. If you can't get this one right ...

On the top is the DTV version and on the bottom is a grab from my usual GTE Sylvania Intellivision (ignore the red at the top, my TV tuner box doesn't like the picture even though it looks fine on my CRT games TV). It makes sense they'd change the copyright message, and I'm prepared to admit that at least some of the inaccurate colours may be my capture box or problems with this specific unit (compare with the contemporary 25 game version), but everything else is wrong. The font has incorrect metrics, the digits in particular are vertically squashed, and they even missed the exclamation point in the title. And let's not forget that pillarboxed background, either.

It gets worse when you actually try to play (again, real system at the bottom). The player sprite is double the size, the mountain background is different and the stars look like clusters instead of points. The meteors are also rendered incorrectly — my score is zero, I haven't actually shot anything — and game play is a strange combination of weirdly jerky and unnervingly smooth, since the DTV's sprite motion runs approximately at NTSC 60fps yet the Intellivision EXEC animates sprites at only 20fps. But the rotten smelly cherry on top of the fail sundae is the mixed-up score panel once again featuring those obnoxiously bogus digits. These aren't trivial details! Seriously, did they make any attempt to compare it with an actual Intellivision?

The funny part is comparing this with the screenshots on the back of the box, above, and even in the menu — which are correct, and which were obviously taken from an actual Inty. Class action lawsuits have been filed for less.

Astrosmash!'s poor conversion was sadly no fluke. Let's move onto Star Strike, a sometimes difficult but graphically impressive rail shooter which spokesman George Plimpton infamously remarked contained the "total destruction of a planet" (Earth, natch). Again, the problems start immediately from the very first screen.

Even if we ignore the questionable palette — the stars are supposed to be twinkling in various colours and I can barely make out the continents on the planet — Earth doesn't start in the middle, it's supposed to start on the side behind the moon. Also, because the PPU's screen geometry doesn't match the STIC's, we get a different perspective background, and we still have those squished digits.

And if you came here for the planet destruction pr0n, you've just been disappointed, because here's what it should have looked like:

What's missing here that Nice Code mistakenly added? A "Game Over." The original game didn't have it because what's more game over than the Earth being turned into crunchy little earth bits? (Likewise, when you win and the trench space station crumbles to 8-bit dust, what's more "you won" than that?)

Oh well, let's crack it open.

For as cheap as these things were, they are not generally difficult to disassemble. We open the battery compartment (screwed in) and remove the screw there, then remove the screws on the side and pop the plastic halves apart.

And, yeah, that's it. Other than the controller logic, you're looking at the entire show in two globchipped chip-on-board halves.

The giveaway that this is an NOAC is its prominent crystal oscillator at the distinctive speed of 21.47727MHz, though the embedded 6502 is definitely not running that fast. Instead, the NOAC (and the original NES, which this is a clone of, remember) divides this crystal by six for the standard NTSC colour subcarrier frequency of 3.579545MHz (i.e., 315/88 MHz) used by the PPU and by twelve for the actual CPU clock of 1.789773MHz. This crystal by far is most commonly found in NES-derived hardware, though it also appears in various obscure arcade machines and the NEC PC Engine (a/k/a TurboGrafx-16) and derivatives, also a 6502-based game system. Conversely, PAL NOACs and NESes are based on a 26.601712MHz crystal divided by 8 and 16 respectively along the same basic notion.

But if that didn't convince you, the markings on the board should. Eight lines run to the controller board and A/V outputs. From right to left (in this view) they are ground, power, sound, a reset line, composite video — and then three NES-specific lines used to interface with the controller board, OUT0, RD4016 and 4016D0. NES controllers are read out bit by bit from locations $4016 and $4017 by writing to the control register, which goes out to the controller on the OUT line to select it, and then reading each bit (4016D0) on each clock (RD4016). This has a single controller, so it only has lines for working with $4016; the two player Inty DTVs have additional lines for $4017. It's fabulously unlikely two lines clearly labeled with that specific address would be present if the underlying architecture weren't NES-based.

The chip closest to the crystal appears to be the actual SoC. Its pinout, such as it is, and the use of a single oscillator are both consistent with the UM6561, a very common NOAC used in many games that has its own internal clock generator. The other chip is essentially a tiny multicart containing the PRG-ROM (code for the CPU) and CHR-ROM (image data for the PPU) for the main menu and each game along with any needed mapper(s). As the two chips are connected by what is more or less a hardwired NES cartridge port, it is possible, albeit after some work, to dump its contents.

If we pull out the controller board with two more screws and turn it over, we find one more IC also under globtop epoxy that appears to be a UM6582. This chip provides the controller data for the 6561 using those three NES-specific lines. It supports "turbo" (rapidfire) for the A/B buttons (if you press turbo A or B, it triggers A or B plus a separate turbo line), and the chip can perform rapidfire at three different speeds, but only the basic "turbo" speed appears to be connected here. The shoulder triggers are wired into the same A/B button lines on the 6582 with separate buttons for select, start and reset; the reset line is fed directly to the 6561 through that 8-pin connector.

That's the basics of a NOAC-based DTV and a particularly unadorned example. We're going to use it as a point of comparison for the remainder of the article, but I promised you 16-bit DTVs, and now I'll bring you two — maybe even three.

Compared to the 6502 the 65816 got comparatively few design wins (though, in fairness, the 6502 got a lot of design wins), and consequently is a much less frequently embedded processor. The two major systems with a 65816 were the Apple IIgs, for which it was designed, and the Super Nintendo, but what we're about to talk about is most definitely not a Super NES-on-a-chip. Let's meet the Winbond W55V91.

Winbond calls this chip a "TV-toy Controller." It is an entire SoC with a 65C816 core licensed from the Western Design Center, plus on-chip video, sound, ROM, RAM and I/O. (We're talking about it like it's a single chip, and the data sheet only ever depicts it as a single chip, but I'll drop a spoiler now that this is not the case for the units we'll look at.)

The initial W55V91 supports up to 1152K of ROM (split into program ROM and video ROM which is directly accessible to the onboard video) and about 5.8K of RAM split into program or video memory. The onboard video generates a single 320x240 video mode in either 4, 8, 16 or 256 colours from a full 24-bit RGB range with two scrollable background layers, up to 512 16x16 sprites (with maxima of 96 per frame and 12 per scanline) and a top-most text overlay that can use 8x8 or 16x16 glyphs in a 27x8 matrix. On-core DMA handles quickly transferring data from PROM/PRAM into VRAM. Audio consists of two tone generators and two white noise generators which can be mixed. Interrupts can fire on the vertical or horizontal blanks, I/O lines (8 input ports, 16 bidirectional ports), or two timers, plus a separate watchdog which can reset the IC.

Winbond developed at least four chips in this line starting with the W55V91 around 2000, then the W55V92 and W55V93 in 2004, and finally the (wait for it) W55V94 in 2005. They were produced more or less simultaneously through at least 2006 and differ primarily in amount of available RAM and ROM, plus (starting with the V93) a CMOS camera interface for integrating video input. This interface only supports display and is mixed in at the video encoder level, meaning capture data can be seen onscreen without CPU assistance but is consequently inaccessible to reading or manipulation by programs.

How a complex scene might be generated appears in this sample screenshot from the V93/V94 datasheets. Input from an attached CMOS sensor has the lowest priority and is overlaid first by background zero (the blue backdrop) and then background one (the yellow "stage"), which is higher priority than both. Both figures standing on stage are composite sprites which can be individually above or below background one. Finally, the text layer has the highest priority, with 16x16 glyphs used for "CMOS interface" and 8x8 glyphs used for the "Manual Mode" text at the bottom. However, these two DTVs don't seem to use many of these features and primarily treat the onboard video as a framebuffer with sprites.

Both units are Atari 2600 DTVs produced by Jakks Pacific and were some of the earliest such hardware. Jakks Pacific was Jack Friedman's final toy and games company before his death after LJN (sold initially to MCA and later Acclaim and subsequently dissolved in 1994) and THQ (bankrupt in 2013), founded in 1995 and expanded rapidly through acquisitions. Toymax was one of these buyouts which had produced an early Activision-specific 2600 DTV unit in 2001 and seems to have been what launched Jakks' own line.

NOACs have a notorious history in Atari 2600 DTVs (the original Atari Flashback being the exemplar), but the Toymax Activision DTV is actually another 65816 Winbond-based unit because Jakks used the exact same hardware and developer (DC Studios) for their own joystick-based VCS DTV in 2002, as we'll demonstrate. Jakks also recased and sold the same Activision DTV under their own brand using a joystick instead of a gamepad, while the paddle-based VCS DTV came out in 2004. As HDTVs and more advanced consoles proliferated, Jakks eventually jettisoned their DTV line in the mid-2010s, though they're still in business selling other toys.

Jakks generally consolidated its DTV offerings under the TV Games and Plug-it-in-and-Play TV Games brands, including several models with toy and character tie-ins unrelated to classic video gaming. Despite being the later of those models, we're going to talk about the paddle Atari DTV first because there is first-person recollection that it was Winbond W55V9x-based. The development period would make it most likely a W55V91, and none of these toys have a need to use the more expensive V93/V94 because they don't have video input. From that information we'll derive the joystick Atari DTV's architecture and by extension the "primordial" Toymax, though I don't personally have that unit here.

The exact formal name of this product is subject to some debate, but it goes something like (deep breath) "Jakks Pacific Atari 2600 Plug-it-in-and-Play 13 TV Games Paddle." It seems to have sold in decent numbers as it's not hard to track down (this unit was a few bucks on the eBay), though the two-player version here is somewhat more uncommon. The paddles really impressed me, particularly for ones intended purely as toys. Each wheel has pretty good throw and spin feel and nice detents, and the buttons are solid with a satisfying travel distance except for RESET which is obnoxiously all but inaccessible. The plastic is similarly thick and durable. Overall, I found the build quality surprisingly high and a competent facsimile of my CX30s.

The reason we know the CPU/SoC in this unit is because of its developer, Digital Eclipse. Digital Eclipse had a cottage industry during the growing interest in emulation in the 1990s developing highly precise emulations and recreations of older software and hardware. One of their early specialties was Williams Electronics' 6809-based arcade games like Sinistar and Joust. In 1995 Dad had just bought an AT&T Globalyst PC from Computer City, a Pentium 75 that we were told came with Windows 3.1 but actually came with the brand-spanking-new Windows 95. There was some consternation as a result because he primarily used the beige-box 486 it replaced for word processing with Ami Pro, though fortunately the new OS ran it just fine (thanks, Raymond Chen!). I took advantage of this to buy the Activision Commodore 64 15-Pack here (this is my original copy) which was also out that year and required Windows 95, but what I really wanted it for was its legally cracked D64 versions of my favourite titles like Portal, Park Patrol and Hacker. Unfortunately for Digital Eclipse their own early emulator wasn't quite as authentic as my Commodore 128DCR sitting right next to the Pentium, but that was okay because C64S wasn't either, and their games loaded way faster than the 128 since they didn't emulate the disk drive and started from preloaded memory images.

Plugging the main paddle in and turning it on, we get these copyright messages, amusingly delivered in a modified Commodore 64 font (which is itself a modification of the Atari 8-bit font). These two screens immediately tell us it can't be a standard NOAC. The text display is fixed-width and C64 font glyphs are 8x8, which would limit any NOAC-based hardware using them to 32 characters per line (i.e., 256 divided by 8), while these screens have several lines longer than that. The TMS 9918A in the 99/4A and Tomy Tutor and many others does have a 40-column mode at 256x192, but by compressing character glyphs to 6x8.

The main menu. You select games and options by rolling the primary paddle and pressing the button. Only eleven of the titles are actually VCS games; the other two are a recreation of Atari Pong and a visually different but still entertaining take on arcade Warlords. This is a bit of a skunk because that practically eliminates any incentive to play the 2600 Warlords also present, effectively cutting the "real" game count down to twelve.

The game's formal credits screen is also accessible from the menu. It's always risky to count pixels on analogue grabs and its pixels are slightly taller than they are wide, but let's concentrate on the center long line "Support Programming: George Phillips". This is 36 characters long and on this 640x480 grab roughly 512 pixels wide and 16 pixels tall. That makes every 8x8 glyph roughly 14.2 by 16 pixels on this grab. Since we know that the W55V9x series generates a 320x240 display, that means all 30 rows of text occupy the entire screen vertically but for each row the Winbond leaves roughly 18 pixels of horizontal gutter space on the left and right. That would cover the TV-safe region on the sides but a programmer would need to be mindful of the top and bottom borders and not paint in them (or a CRT TV will cut those portions off). It should also be obvious that all of this is being generated directly on the SoC's background layers because the character matrix is clearly larger than 27x8.

The source for the Winbond being used in this device was reportedly technical director Jeff Vavasour, who developed or co-developed many Digital Eclipse titles, including this one and the Activision Commodore 64 15-Pack. On this unit, among other tasks, he developed a debugger to tease out the fine details of the original games, reworked arcade Warlords, and did some of the artwork like the menu. I tried contacting him about it but couldn't locate a current E-mail address, so if you know him or are him, please post in the comments or drop me a line at ckaiser at floodgap dawt com.

I don't intend this to be a review, but looking at a couple games to get an idea of its hardware features is instructive. Fortunately, unlike a NOAC trying to act like a STIC (badly), the W55V9x is fully able to draw an accurate 2600 TIA screen. Here is Breakout. The players and missiles are easily represented with the W55V9x's sprites, and the TIA 160x192 display and 128 colour NTSC palette are well within the Winbond's capabilities. As a practical matter it looks like Digital Eclipse simply chose to double the horizontal pixels and vertically centre the TIA display rows within the Winbond's 240 line viewport, which takes care of the TV-safe region. Sound at least in theory should also be within the W55V9x's tone generators' range, both being two-channel audio, though the sound effects in these games don't sound quite exact since the timbre differs. Still, it's pretty close.

In each game, the menu button on the main paddle (not the side fire button, which is the regular paddle button) brings up an array of options you can modify. These vary from game to game. At the bottom is a "virtual console" also drawn by Vavasour which you can use to flip the VCS's physical switches such as difficulty. You return to the main menu by spinning the knob all the way to the left and hit fire.

The simulations are generally complete enough to even model things like those black "comb" lines on the left from positioning the TIA players at the beginning of a scan line (remember that 2600 games must "race the beam" with the CPU emitting screen data every line, every frame), here shown in Night Driver. With minor exceptions, audio notwithstanding, I found the games in this DTV to be very consistent with my real Darth Vader 2600.

The Pong game is probably the weakest of the set and seems mostly thrown in as a bonus easy-to-implement paddle title. Adding some of the variation games would have seemed a logical step but this is "just Pong." It's still a competent knockoff of Pong Doubles, at least compared to my Ultra Pong Doubles unit; it's just not as interesting as the other games and there are other Pong consoles I like better. Its primary draw is as a better single player opponent than with Video Olympics, which is also included, and does have variations.

I did enjoy Warlords, though. I always liked it in the arcade and although this conversion was consciously inaccurate, game play is fairly on point compared to the real ROM running in MAME. Graphically the screen had to be reformatted to prevent the arcade's 256x240 framebuffer from extending into the TV safe range on the top and bottom, requiring scaling the display down to keep the same proportions and timing. I'd say that was successful overall, though like I mentioned, its biggest sin is that it renders the 2600 Warlords almost superfluous.

Yeah, okay, you want me to crack it open now.

The screws are glued in a bit tight and I had to grab the jeweler's screwdriver with a set of pliers to get them loosened.

After doing the four in the battery compartment, don't forget about the one at the base of the TV connectors. We're just going to open the main compartment, not the second paddle.

My first impression is that there's a lot of gunk on the board plus an extended visit from the hot glue fairy. I can understand why many people thought this was a NOAC device because the board superficially resembles one, but the big difference is the crystal at Y1 (next to the blobtop at U2) with a 27MHz value. This is the only supported operating frequency for the W55V9x series, divided down by four to yield the 6.75MHz CPU clock for the '816, and is not a known master clock value for any NOAC I could find.

A bigger question is that the Winbond data sheet makes the SoC sound like a single chip, but we have two blobtops here. The crystal feeds U2, so the CPU core is probably there, but we can't make too many conclusions about U1 without digging the board out to trace the vias. Some of the marked spots on the board are not populated and there is a whole string of test points on one side.

Unfortunately, the hot glue fairy worked her viscous magic within as well as without and I was unwilling to whale on it with a metal pry tool lest I damage the board or its components. But we still have one more thing we can crack open which might give us a clue.

(Pro tip when reassembling: this is the wrong way for the side button. Turn it over so those divots sit on the case outcroppings provided for them.)

The joystick precedes the paddles by about two years. Really, Toymax (and by extension DC Studios, who did the development and later went on to work on the C64 DTV) made it harder on themselves by starting off with technologically advanced VCS games like the Activision series first. These would have been very difficult to get right in simulation due to their complex programming. Most contemporary reviews complained about the conversion quality in both the Toymax Activision and DC Studios VCS DTVs, and they might have been better served cutting their teeth on the simpler games Digital Eclipse cloned with good success. None of this is to take away anything from the quality of DE's ports; they merely benefitted further from less technically demanding games that could be fully characterized more easily.

The stick itself, while fatter and a little bottom heavy due to the electronics in the base, actually feels a little flimsier and less substantial than my real CX40. You can still "grab" it pretty well, but I always preferred Wico sticks to these anyway.

Title screen, using a PC-like CGA 8x8 font.

Main menu for the joystick VCS DTV and an example instruction screen provided for each game (a nice touch). However, an immediately bad sign is that games like Breakout, Pong and Circus were meant to be played with paddles. The Pong here in fact Video Olympics, all three of which were also on the paddle DTV, and does have proper variations.

Interestingly, the menu and background colour on this device extend right out to the very edges of the display. There is no text there, but there is colour and some lines. These could be sprite effects or the use of a register not documented in the datasheet to widen the viewport.

The text on the instruction screen is wide enough to demonstrate it has the same basic resolution as the paddle DTV, and thus can't be generated as such by a standard NOAC. If you compare these grabs to video captures of the Toymax Activision DTV, you'll see it's the same in nearly every respect except for the included games.

Adventure felt really wrong. I never played it heavily on the real system but even as a casual player this version just felt, um, off. Other players opined that the dragons and game objects had different properties, and Warren Robinette's famous easter egg is apparently unobtainable. When you've lost Curt Vendel ...

Again, as a simulation it would have been exceptionally difficult to track down all the behavioural edges in a game this densely packed, and it shows. It would have been a big job for anybody. But that doesn't mean it gets a pass.

Besides the inexact paddle-to-joystick conversions, another game that got some criticism was its port of Yars' Revenge (not to be confused with Yar and a Man Called Insipid, a reference I refuse to explain).

The easy stuff: it properly simulates the game's internal copyright message.

The hard stuff: the screen and gameplay. It plays pretty well most of the time. However, it does strangely lag sometimes when you land a hit, and some players complained that the appearance didn't quite match the original. I wasn't able to trigger the Warshaw initials easter egg but I'm not a skillful player, so that doesn't mean it can't.

On all of these titles, sound was largely regarded as "inspired by" rather than "perfect cover band." Most of the games didn't sound much like the VCS originals at all, whereas at least the paddle DTV sounds were close, just not perfect.

Okay, time to gut it. I am amused by the Radio Shack tag on this one and apparently Radio Shack had some exclusives deals with Jakks, which was a very Tandy thing to do.

Removing the four base screws allows the top stick to come off, but to get to the top of the mainboard we'll need to remove a second set of screws and then pry it up. Take note of how the wires are packed for reassembly because everything is crammed in tight.

Fortunately the hot glue fairy hadn't blessed this stick too much and we could dig it out along with the attached front board where the game control and reset buttons are.

Here is the front (upside down in the unit) and back of the mainboard. The back has a plate on it which I took off to look at the traces; I left the buttons alone, but they just attach with little rubber pegs that can be popped out with care.

We again see our U1 and U2 globtops along with the 27MHz crystal we saw in the paddle DTV. This almost certainly has to be the same Winbond 65816 SoC, and because the Toymax DTV uses the same menu and interface, it's almost certainly the same hardware as well. The crystal again feeds U2.

The audio line is the white wire at the top left (northwest) corner of the board. We can trace it along L4 down to C1 to enter U2. The video line is the red wire between sound and ground (ha ha). It goes through L6 and past an unpopulated C6 to enter U1. U1 also has an interesting "P/N" jumper at JP2 that is not bridged (the solder blob is on N). In the W55V91 datasheet pin 28 selects PAL (high) or NTSC (low), so leaving the circuit broken appears to be setting it to NTSC.

The button pads are bit harder to trace because they start on the back and exit in the front under some of the gobs of glue, but appear to enter U2. Similarly, the lines from the front control board (yellow, blue, teal and orange wires) also track into U2, including what looks like the reset line, which is one of the yellow wires.

A number of lines bridge between U1 and U2 but some cursory continuity testing of the exposed vias didn't connect them with anything else. These are likely some sort of bus. The block diagram shows two halves with DMA between them, but the division isn't clean on these boards because while U1 seems to have more of the video features, to match the block diagram it should also have the audio PSG, which is apparently in U2. U2, however, appears to have all of the CPU facilities and I/O. Whatever split we're seeing here doesn't seem to match the documentation.

Ideally we would like this to be set up the same as the NOAC where the ROMs are on one side and the full SoC is on the other, but if first appearances are to be believed, this apparently divides into a video chip and "everything else."

Reassembling is easiest if you do it upside down like you disassembled it, or otherwise the stick insert and button will fall out. The buttons all have little thin guides that they slot into.

The NOAC DTVs are cheap and nasty, but they're surprisingly hackable if you're prepared to do some fiddling, and their contents can be transplanted to bigger units. Unfortunately, assuming the ROMs on each end (VROM in U1, PROM in U2) are all blobbed together in each die, it doesn't look like it's possible to dump — let alone reprogram — the Winbond 65C816 SoCs without decapping and destroying them to visually inspect their contents. Maybe that was on purpose. But these devices at least are so cheap and exist in such numbers that such a sacrifice seems reasonable to yield useful insight into other such units. If you've done this or want to partner on it, post in the comments.

Either way, though, it turns out the 65816 was in a lot more devices than just the obvious explicit ones. The Winbond W55V9x series is no Super NES in a chip, but it'll do until one comes along. Let's hear it for tiny 16-bit consoles.