I was probing around the Genesis and checked out some of the signals (all while /CART is grounded). Address ranges that make the system lock up (no DTACK) weren't included.
Cartridge port:
/ASEL is asserted for reads and writes within 000000-7FFFFF
/CAS_2 is asserted for reads and writes within 000000-7FFFFF
/CE_0 is asserted for reads and writes within 000000-3FFFFF
/CAS_0 is asserted for reads *only* within 000000-7FFFFF
/TIME is asserted for reads and writes within A13000-A130FF
Timing-wise, pulses on /CAS_0, /CE_0, /AS are identical, pulses on /ASEL and /DTACK are identical but longer, /CAS_2 was the longest.
Other signals (68K work RAM):
/RAS_2 is asserted for reads and writes within E00000-FFFFFF
The schematics show /RAS_2 on the expansion connector; I haven't tested it but a multimeter check on the console I was using showed that /RAS_2 on the expansion port was not related to the work RAM /CS pins, which are connected to '/RAS_2' in the schematic.
Expansion port:
/FDWR is asserted for writes only within A12000-A120FF
/DISK is asserted for reads and writes within A12000-A120FF
/FDC is asserted for reads and writes within A12000-A120FF
/ROM is asserted for reads and writes within 400000-5FFFFF
Not sure what's with all the duplication of the floppy disk related signals. I don't know which one(s) the Sega CD uses to map it's registers to the $A120xx range.
Probably /ROM changes to 000000-1FFFFF (or 3FFFFF as the high range?) when /CART is high for use by the Sega CD's BIOS ROM.
When A11200=$0100 (DRAM enabled), there is an extra pulse on /CE_0 about every 200 EDCLKs. This same pulse also appears on /CAS_2 regardless of A11200, both occur at the same time.
Likewise, about every 222 EDCLKs there is something like a /DTACK delay where all signals (/CAS_0, /CE_0, /DTACK, /ASEL, /CAS_2) are stretched out for 2 or 3 68000 clocks. This occurs when running out of ROM or RAM. I checked /BR to see if the VDP was taking over the bus for DMA, but it isn't. Not sure what that's all about.
Cartridge port:
/ASEL is asserted for reads and writes within 000000-7FFFFF
/CAS_2 is asserted for reads and writes within 000000-7FFFFF
/CE_0 is asserted for reads and writes within 000000-3FFFFF
/CAS_0 is asserted for reads *only* within 000000-7FFFFF
/TIME is asserted for reads and writes within A13000-A130FF
Timing-wise, pulses on /CAS_0, /CE_0, /AS are identical, pulses on /ASEL and /DTACK are identical but longer, /CAS_2 was the longest.
Other signals (68K work RAM):
/RAS_2 is asserted for reads and writes within E00000-FFFFFF
The schematics show /RAS_2 on the expansion connector; I haven't tested it but a multimeter check on the console I was using showed that /RAS_2 on the expansion port was not related to the work RAM /CS pins, which are connected to '/RAS_2' in the schematic.
Expansion port:
/FDWR is asserted for writes only within A12000-A120FF
/DISK is asserted for reads and writes within A12000-A120FF
/FDC is asserted for reads and writes within A12000-A120FF
/ROM is asserted for reads and writes within 400000-5FFFFF
Not sure what's with all the duplication of the floppy disk related signals. I don't know which one(s) the Sega CD uses to map it's registers to the $A120xx range.
Probably /ROM changes to 000000-1FFFFF (or 3FFFFF as the high range?) when /CART is high for use by the Sega CD's BIOS ROM.
When A11200=$0100 (DRAM enabled), there is an extra pulse on /CE_0 about every 200 EDCLKs. This same pulse also appears on /CAS_2 regardless of A11200, both occur at the same time.
Likewise, about every 222 EDCLKs there is something like a /DTACK delay where all signals (/CAS_0, /CE_0, /DTACK, /ASEL, /CAS_2) are stretched out for 2 or 3 68000 clocks. This occurs when running out of ROM or RAM. I checked /BR to see if the VDP was taking over the bus for DMA, but it isn't. Not sure what that's all about.