This is a ZX Spectrum 48K, issue 6A, from ZXevious. He asked me for advice on how to repair its speccy. Came with a faulty Interface 1, which I speak about in another article.

Upon switching on, the screen shows flashing blocks, hangs, and the screen data is mixed with something that seems digital noise. Maybe from poorly coupled data lines.

ULA is operational, Z80 too, so the main candidate is low memory. First thing is to try to isolate which memory chip (or chips) are damaged. The usual cartridge ROM tests I ran didn't give a clue, as it seemed that every chip was damaged. Strange enough that all power lines were ok.

Also, the ZX8401 (the chip that substitutes the six logic ic's on earlier issues) seemed to be working, as one of the tests showed me that the 32K expansion memory was ok.

So, I went to the lab and used our de-soldering station to put away everything that could be a possible noise source. Prior to that, I tried by isolating the VRAM data bus and the main RAM data bus (desoldering R1 to R8) with no success.

With a "comattose" Spectrum like that (no ROM, no Z80, no glue logic, only ULA and a SIMM module replacing lower memory) I tried once again and faced with the same synthomps: noise. It's not the ULA, it cannot be memory, so LM1889 will be. The scope agreed me when it showd a nasty pulse of about 100 kHz, added to the 4,43MHz wave.

But there's one more problem unsolved: the machine still hangs. Even with the SIMM in the low memory bank. I tried to load the well-known JetPac loading screen from the ROM cartridge and this is what I got:

This is the same screen, loaded with Spectaculator, then processed through Paint Shop Pro. The red/green/blue strips on the left mark each one of the three screen blocks. I've grey scaled the image to match what I see on my B/W TV set.

To analyze what's happening here, we have to remember how memory addresses translate to scan lines on the screen.

The Spectrum display file clever design allows for fast character based operation for a 8-bit CPU, while retaining high resolution graphics. This is how it's organized:

Memory address (15..0): 010 BB SSS RRR CCCCC
BB    = block number: 0,1,2 (also bits 3 and 4 of row position)
SSS   = scan number within a character position (0 to 7)
RRR   = row number within a block (0 to 7). Joined with BB, forms 
        BBRRR which is the character row position (0 a 23)
CCCCC = column position (0 to 31)

This is what might be happening: there's something wrong with one of the three blocks that forms the screen. Each block is 2048 bytes, so A0-A10 are needed to address a byte inside a block. A11 and A12 control what block to address. Moreover: if A12..A11 is 00, the first block (block 0) is addressed. If A12..A11 is 01, the second block (block 1) is addressed, and if A12..A11 is 10 the third block (block 2) is addressed. A12..A11=11 addresses the attribute block (and the memory following it: printer buffer, system variables, etc.)

So, A12..A11 represents the block number.

What I can see here it's that A12..A11 = 00 (block 0) behaves the same as A12..A11 = 10 (block 2). A12..A11 = 01 (block 1) behaves normally. Is A12 stuck? It shouldn't, as if it were stuck at high level, block 1 didn't show up.

On the other hand, row contents inside a block show a repeated pattern, in which some rows stay at the right place, and some others don't show at all. Instead, the previous row gets repeated again.

Which rows are affected?. Let's see: the copyright symbol at the right of the ULTIMATE word happens twice at the "wrong" picture, while the copyright symbol at the back of the jetman, near the right edge, is missing from the "wrong" picture. These two symbols fit in one character row: row 3, block 2 for the former, row 0, block 1 for the later

One more: the "PLAY THE GAME" slogan is completely missing from the wrong picture. This is located at row 4, block 2 and spans several characters inside that row.

So, every even row is missing, every odd row is at its right place, and it's repeated at the previous character row too. I mean: row 0 and 1 are row 1, row 2 and 3 are row 3,...,row 6 and row 7 are row 7. Recalling the memory organization describe avobe, this behaviour happens if bit 0 of RRR is set to 1, that is, if bit 5 is permanently set to 1.

I've just altered the above picture in a PC, using the information I have at the moment (block 2 in the place of block 0, and every odd character row copied to the previous character row). This is the "scrambled" result, along with the original scrambled picture, for comparison:

And this is the matter: A12 and A5 are two inputs (pins 18 and 17) for one output at one of the multiplexors embedded in the ZX8401. A delayed version of the RAS signal from ULA selects A5 when high (RAS is already low, but its delayed version is still high), then A12 when low (by the time CAS goes down too). Output is pin 19, which goes to A5 at the 4116 chips.

I have to re-check the ZX8401.

A first visual inspection has led me to this: bad soldering in a capacitor pin, one of the capacitors that belongs to the ZX8401 surroundings. Unfortunately, this has not solved the main issue.

(the picture was taken with a standard digital camera, using a 10x magnification lens with built-in light right in front of the camera lens).

I didn't want to blame the ZX8401, as upper memory is ok, but I'm starting to think that not all is ok within that chip. Fortunately, the ZX8401 (or PFC1306P) is not as obscure as ULA is, and bsides, it's far less complex than the former. José Leandro Novellón did a very good job reverse-engieering its functions, and designing a replacement with standard TTL chips. Also Yarek Adamsky studied the subject.

Based upon the work of these two hardware hackers, I've just designed a ZX8401 replacement, but with only one chip: an Atmel 2500C CPLD. This chip is a 40 pin DIL CPLD, powerful enough to mimic the behaviour of the ZX8401. I've just ordered some 2500C chips and finished a PCB prototype, suitable to fit almost the same space as the original chip does. This is its footprint:

To my surprise, I have taken a working ZX8401 and have tried with it: no success. The pressumed faulty ZX8401 works in another machine!

Suspecting that the SIMM module was not working as I expected, I took eight brand new 4116 chips...

...and tried with them. The JetPac test showed me this:

The A12 and A5 mess ceased to happen! So something wrong was with the SIMM module. So, it's not the ULA, it's not the CPU, it's not the ZX8401, it's not the glue logic, it's not the memory... Back again to the noise and its origin.

The more prominent effect of this noise is seen on the screen. Taking away the LM1889 causes the noise to dissapear from the screen. If I put it again, I can see a series of spikes overimpossed to the 4,43 MHz color subcarrier.

The quartz crystal and associated components are working. But the 12V power supply... exhibits the same noise!! Going from the digital part to the supply part on the schematic, we can see that the 12V line is obtained by rectifying the signal generated in the coil. D19 rectifies and C44 filters.

The scope shows me a series of pulses on the anode of D19, but there's not a steady signal in the cathode... but a steady signal with the same spikes I saw on the LM1889!!

Clearly, C44 is to blame. Replacing it and guess what? Everything worked again!

So, what happened in the end?: a faulty C44 capacitor (rated for 16V when there's spikes that go beyond that voltage) causes noise in the 12V line. That noise spreads to LM1889 and the low memory bank, as both sections use the 12V rail (and in fact, they are the only sections that do so). The noise on the LM11889 causes it to show bands and waves on the screen. The noise in the 12V rail at 4116 chips causes them to fail randomly. What was seemed to be a digital failure, which affected the eight memory chips was in fact a failure in voltage supply. I didn't notice at first, because I trusted the value that the tester gave me. What the tester couldn't show me is that those 12V were with noise added. Besides, C44 is the capacitor nearest to the 4116 12V supply rail. A failure in this gives no AC filtering to the low memory bank.

To finish this article, and as this Spectrums belongs to a person nicknamed "ZXevious", I've tried his Spectrum loading and playing Xevious. Here you have a snapshot while loading, and another one while in play.

Some of you may wonder what will be with the ZX8401 replacement I've talked about. That work is still in progress, waiting for the 2500C chips to arrive. In the midtime, I've milled two PCB's to test the design. This will be the subject of another article.