diff --git a/src/mess/drivers/cat.c b/src/mess/drivers/cat.c
index 536148d46c7..cec975ef203 100644
--- a/src/mess/drivers/cat.c
+++ b/src/mess/drivers/cat.c
@@ -136,15 +136,6 @@ ToDo:
 * Canon Cat
 - Find the mirrors for the write-only video control register and figure out
   what the writes actually do; hook these up properly to screen timing etc
-- The 2.40 firmwares both get annoyed and think they have a phone call at
-  random.
-  (hit shift or usefront a few times to make it shut up for a bit or go into
-  forth mode); The 1.74 firmware doesn't have this issue.
-  Figure out what causes it and make it stop. May be OFFHOOK or more likely
-  the DUART thinks the phone is ringing constantly due to incomplete duart or
-  an ip bit hooked up wrong.
-  You can alsp make it stop by going to SETUP and change the serial port from
-  'alternate printer' to SEND.
 - Floppy drive (3.5", Single Sided Double Density MFM, ~400kb)
   * Cat has very low level control of data being read or written, much like
     the Amiga does
@@ -165,7 +156,6 @@ ToDo:
 - Centronics port
 - RS232C port and Modem "port" connected to the DUART's two ports
 - DTMF generator chip (connected to DUART 'user output' pins OP4,5,6,7)
-- Hook duart IP2 up to the 6ms timer
 - Correctly hook the duart interrupt to the 68k, including autovector using the vector register on the duart
 - Watchdog timer/powerfail at 0x85xxxx
 - Canon Cat released versions known: 1.74 US (dumped), 2.40 US (dumped; is this actually original, or compiled from the released source code?), 2.42 (NEED DUMP)
@@ -182,7 +172,7 @@ ToDo:
   happens inside an asic) for the SVROMS (or the svram or the code roms, for
   that matter!)
 - Hook Battery Low input to a dipswitch.
-- Document what every IPx and OPx bit on the DUART connects to.
+- Hook the floppy control register readback up properly, things seem to get confused.
 
 
 * Swyft
@@ -299,7 +289,7 @@ public:
 	DECLARE_READ16_MEMBER(cat_0080_r);
 	DECLARE_READ16_MEMBER(cat_0000_r);
 
-	UINT8 m_duart_inp;// = 0x0e;
+	UINT8 m_duart_inp;
 	/* gate array 2 has a 16-bit counter inside which counts at 10mhz and
 	   rolls over at FFFF->0000; on rollover (or maybe at FFFF terminal count)
 	   it triggers the KTOBF output. It does this every 6.5535ms, which causes
@@ -785,10 +775,13 @@ TIMER_CALLBACK_MEMBER(cat_state::keyboard_callback)
 	machine().device("maincpu")->execute().set_input_line(M68K_IRQ_1, ASSERT_LINE);
 }
 
-// This is effectively also the KTOBF line to the d-latch before the duart
+
 TIMER_CALLBACK_MEMBER(cat_state::counter_6ms_callback)
 {
-	// TODO: emulate the d-latch here and poke the duart's input ports
+	// This is effectively also the KTOBF line 'clock' output to the d-latch before the duart
+	// Hence, invert the d-latch on the duart's input ports.
+	// is there some way to 'strobe' the duart to tell it that its input ports just changed?
+	m_duart_inp ^= 0x04;
 	m_6ms_counter++;
 }
 
@@ -800,7 +793,7 @@ IRQ_CALLBACK_MEMBER(cat_state::cat_int_ack)
 
 MACHINE_START_MEMBER(cat_state,cat)
 {
-	m_duart_inp = 0x0e;
+	m_duart_inp = 0;
 	m_6ms_counter = 0;
 	m_video_enable = 1;
 	m_video_invert = 0;
@@ -907,25 +900,33 @@ static void duart_tx(device_t *device, int channel, UINT8 data)
 #endif
 }
 
+/* mc68681 DUART Input pins:
+ * IP0: CTS [using the hardware-CTS feature?]
+ * IP1: Centronics ACK (IP1 changes state 0->1 or 1->0 on the falling edge of /ACK using a d-latch)
+ * IP2: KTOBF (IP2 changes state 0->1 or 1->0 on the rising edge of KTOBF using a d-latch; KTOBF is a 6.5536ms-period squarewave generated by one of the gate arrays, i need to check with a scope to see whether it is a single spike/pulse every 6.5536ms or if from the gate array it inverts every 6.5536ms, documentation isn't 100% clear but I suspect the former) [uses the Delta IP2 state change detection feature to generate an interrupt; I'm not sure if IP2 is used as a counter clock source but given the beep frequency of the real unit i very much doubt it, 6.5536ms is too slow]
+ * IP3: RG ("ring" input)
+ * IP4: Centronics BUSY
+ * IP5: DSR 
+ */
 static UINT8 duart_input(device_t *device)
 {
 	cat_state *state = device->machine().driver_data<cat_state>();
 #ifdef DEBUG_DUART_INPUT_LINES
 	fprintf(stderr, "Duart input lines read!\n");
 #endif
-	if (state->m_duart_inp != 0)
-	{
-		state->m_duart_inp = 0;
-		return 0x0e;
-	}
-	else
-	{
-		state->m_duart_inp = 0x0e;
-		return 0x00;
-	}
+	return state->m_duart_inp;
 }
 
-// TODO: hook to speaker and dtmf generator
+/* mc68681 DUART Output pins:
+ * OP0: RTS [using the hardware-RTS feature?]
+ * OP1: DTR
+ * OP2: /TDCS (select/enable the S2579 DTMF tone generator chip)
+ * OP3: speaker out [using the 'channel b 1X tx or rx clock output' or more likely the 'timer output' feature to generate a squarewave]
+ * OP4: TD03 (data bus for the S2579 DTMF tone generator chip)
+ * OP5: TD02 "
+ * OP6: TD01 "
+ * OP7: TD00 "
+ */
 static void duart_output(device_t *device, UINT8 data)
 {
 #ifdef DEBUG_DUART_OUTPUT_LINES