A cycle-faithful Intel i860 interpreter now runs the game's actual shipped firmware — booted, initialised, and fed a complete recorded mission over the wire. It replays every command, emits the real PXPL5 IGC render stream, and projects the scene geometry. Below is an object it drew, its vertices and normals pulled straight off the emulated chip and reconstructed in 3D — geometry this board's firmware has not computed in thirty years.
Nothing here is re-interpreted by us. Each stage is the firmware's own code executing on the emulated i860 — from parsing the wire packet to writing the bit-serial micro-program the Pixel-Planes array runs.
The firmware DMAs the render to the card as an opcode stream (DMAENGN.H). Both panels below are captured verbatim from the emulator. Left: a real per-region command list — every region references the same tile-relative payloads and differs only in its TILE id and the GOTO link. Right: inside a SEND — the payload isn't opaque, it interleaves control words with the actual float coefficients, swept bit-plane by bit-plane into pixel memory.
# addr opcode 0x08015000 SEND(4) ; edge coeffs 0x00000000 FLUSH 0x08015020 SENDE(0x45) ; z / colour 0x00000000 FLUSH 0x08014100 TXDN 0x08015260 SEND(0x21) 0x08015380 SEND(0x29) 0x00000020 TILE ; tile id 0x0801f008 GOTO ; → next region
# bit-serial sweep (MEMpluseqMEM) +000 00000100 ; header +004 3a804834 ; = 9.79e-4 float +008 8401213a +00c 00000021 ; bit-plane 0x21 +010 ba01253a ; = −4.93e-4 += A +018 8381213a +01c 00000022 ; bit-plane 0x22 …
Pull the floats out of those payloads and they line up into clean ×2 chains — 0.0079 · 0.016 · 0.032 · 0.063 · 0.126 · 0.252 · 0.504 · 1.009 — a coefficient stored as its binary place values C·2ᵏ, one per bit-plane, exactly how a bit-serial adder holds a number. And the recovered values are the object's own geometry: a payload edge coefficient (0.12527) lands on the edge normal computed from the captured vertices (0.12555) to 0.2%. The plane constants sit alongside as fixed-point screen coordinates (0x0000ec00 = 236.0, a vertex x). The coefficients feeding the array simulator (§05) are the ones the hardware actually shipped.
At the frame flush the firmware walks the screen-bin array and hands the IGC one descriptor per 64×128 region. This grid is drawn from the real captured descriptor scan — filled cells are regions that received transformed geometry. A full mission view fills nearly the whole frame: ground plane and sky, exactly as expected.
The surface above is the same 45 vertices, sorted back into model space — they form an exact 9 × 5 height-field grid (x and z in even 2-unit steps, y the height at every node; all 45 cells filled). What the board actually wrote to screen is below: cap7's death-camera views that surface nearly edge-on, so the frame the i860 projected is a thin, folded sliver. It is authentic output — just an awkward angle. Left, that projection Gouraud-shaded; right, its raw VSTRIP wireframe.
This is the final stage in silicon — and it now runs in software. The PXPL5 IGC is a region rasteriser: the screen splits into 64 × 128 tiles; every pixel carries a 26-byte bit-memory and an enable bit; all pixels evaluate one linear tree in lockstep — eval_ltree(x,y,A,B,C) = (int)(x·A + y·B + C). A triangle becomes three edge trees into the enable register, then Z and R/G/B planes interpolated per pixel and z-buffered in pixel memory (IGCOPS.C). Fed the captured surface, the model lights the tiles below and renders pixels that match our reference rasteriser to within edge anti-aliasing — the array reproduced faithfully.
What this is not, yet: a full from-scratch run of the compiled micro-code the DMA ships (§02) — the form the ground and sky take, since they carry no stored vertices. But that stream is now largely decoded: the command lists read cleanly, the SENDE z-sweep resolves into a regular 4-word instruction, and its coefficients are the same ones driving this depth buffer — the array's inputs are cross-validated against the hardware's own compiled stream. What remains is numeric reconstruction across every region, not reversing an opaque binary.
The i860 core was corrected against the toolchain's own assembler output and MAME's validated i860 model. A selection of the load-bearing fixes: