What's new

ShootTheCore

Legendary
Joined
Jan 20, 2016
Messages
3,331
Reaction score
6,638
Location
Utah USA
I've been working on repairing a failed Spectrum vs Generation cart for the IGS PGM. This is one of the later carts that uses an ARM CPU on the PROG board as a coprocessor and for copy protection.

I'm pretty sure that the ARM has failed, but before giving up on it, I wanted to reach out to see if anyone has any suggestions - there may be something I've overlooked.

At boot, the cartridge immediately freezes with garbage displayed on the screen - the PGM BIOS does not initialize.

Here's a list of everything I've tried:

1) I cross checked the PROG and CHAR boards with a functional SVG cart and confirmed that the PROG board is the culprit.
2) I dumped the three EPROMs on the PROG board and confirmed that they matched the files in MAME.
3) I reflowed the ARM CPU.
4) I replaced the four electrolytic capacitors.
5) I replaced the three SRAM chips on the board with new parts - the 128K x 16bit SRAM at U33 and the two 64K x 16 bit SRAMs at U37 and U38.
6) I've confirmed that the ARM is getting a clock signal from the 33mhz crystal located at U35 on the board.
7) I've tried probing logic pins on the EPROMs, buffers, TTLs, etc for activity with a scope but haven't had much luck - all logic activity completely halts almost immediately after power up.

I would like to confirm the other signals on the ARM that it would need to boot (ie Reset, Halt) but I haven't been able to locate a pinout for the part. It's a 120 pin part that doesn't seem to match up to other ARM7 CPUs from the same era.

Anyway, as I said, I'm pretty sure the ARM CPU itself or the embedded ROM inside of it has failed which would end this resurrection project, but I welcome any suggestions for things I may have overlooked. Pinging @Fluffy, @GC8TECH and @iq_132 since I know you're familiar with the hardware.

IMG_1107.jpgIMG_1102.jpgIMG_1106.jpg
 
Last edited:
If it was just a dead ASIC, you should get an error on the screen, not just garbage.

*edit*
W/the ASIC completely disabled in FInalBurn Neo it shows this.
 

Attachments

  • svg-07-22-194942.png
    svg-07-22-194942.png
    1.3 KB · Views: 28
Last edited:
After swapping parts with the working cart, I have good news! The ARM isn't dead!

IMG_1117.jpg

The bad news - all three of the PALs on the board are bad. With all three PALs from the working cart in place, the faulty cart boots and runs fine.

Swapping back the original PALs individually, I get:
U15 - freeze before BIOS initialization
U21 - freeze after BIOS initialization on Initialize System screen
U34 - External RAM Test Fail after BIOS initializes with heavily corrupt graphics

IMG_1114.jpgIMG_1115.jpg

FYI: the 27C4096 EPROM at U30 was bad too, although it verifies good in the programmer. I flashed a fresh part and now that works fine.

What are my options now for replacing the three PALs?
 
Last edited:
it looks like the PALs on the PCB version are dumped so you can see if they're the same and try those: https://wiki.pldarchive.co.uk/index.php?title=Spectral_Vs_Generation

since you have a good cart with working PALs you can try dumping them. the PLD archive stated that the PCB version PALs were unlocked so the cart ones might be unlocked 2.

if they can't be dumped normally then you can use a brute-force dumper. If you need one of these let me know I made a bunch a while ago to send to people in your situation.
 
I'll order in some PALs and see if the files from the single PCB will work - thanks for the advice everyone!

And I'd definitely be interested in buying a brute-force dumper from you @twistedsymphony . :thumbsup:
 
I was going to build one of these.... http://dreamjam.co.uk/emuviews/readpal.php

Then dump ALL the carts i have here...
This is effectively what I've done in the past with an EPROM programmer: Connect the PAL/GAL inputs to the address lines and the outputs to the data lines, then read it as if it was an EPROM. The result is a giant truth table, that can then be resolved into equations. I think I used this one https://pypi.org/project/quine-mccluskey/ , and used a post process that created CUPL source code.
I've seen at least one other project where someone added diodes so he can detect tri-stated outputs.

Where this fails is if registers are used, like the Bee Storm GAL where I struggled some time ago. I think someone here worked on some algorithms to recover those, but that is non-trivial, and there are probably enough cases where this fails.

I looked into building a different adapter that can be used with an arduino, so you can try test vectors in any order, but never got around to writing the software.

Some GALs are recovered by "glitching" the read-protect fuse by over or under powering the GAL - definitely not something I'd try on a rare non-replaceable part. It is probably worth trying to read the GALs as normal in a programmer, though. If they're protected you'll get all '1' for most fuses. If the read protect fuse is set you can only get some device identifier in the last 64 bit.
 
Last edited:
A set of blank ATF22V10Cs arrived in today and I programmed them with the four PLDs used in the single SVG PCB. Unfortunately none of them work as a substitute for the three PLD parts in the SVG cart, so the cart PLDs will need to be dumped.

@twistedsymphony is that something you'd be willing to take on? I've been in contact with Apocalypse and he's willing to dump them, but I thought I'd check with you first since we're both in the United States and there would be less risk of the carts getting lost in post than there is with overseas shipping.

EDIT: I also tried reading the PLDs from the good cart with my EPROM programmer but they appear to be protected - I got the same pattern of almost all 1s out of all three parts.
 
Last edited:
I had a dozen of those pcbs made up from that link I need to remember where I put them but I'd be happy to send you one or if you want to send me the pals I can do the dumping myself.

EDIT: found my kits
IMG_20240728_001154258.jpg


If you (or anyone else) wants one shoot me a PM. I made these up specifically to send to people to help get PLDs dumped. they're FREE as long as you actually dump something with it.
 
Last edited:
I’d like to get into dumping PLDs but I noticed that your PCBs are for 20 pin parts while the PLDs used with this PGM cart are 24 pin parts. Do you have some 24 pin PCBs as well or would we need to come up with something else for these parts?
 
You could try the same trick for a 27c322 to 24 pin socket.
 
A set of blank ATF22V10Cs arrived in today and I programmed them with the four PLDs used in the single SVG PCB. Unfortunately none of them work as a substitute for the three PLD parts in the SVG cart, so the cart PLDs will need to be dumped.
As a test, please try Lattice 22v10 if you find them cheaply. ATF22v10 has a power saving feature which defaults to "on". If your programmer doesn't write the last fuse it may still be on, and throw off any logic that uses pin 4...

EDIT: I also tried reading the PLDs from the good cart with my EPROM programmer but they appear to be protected - I got the same pattern of almost all 1s out of all three parts.
"1" is common for unused logic, so if you get some 0 in the first few thousand fuses it may still be useful. You could try the jedtool in the MAME tools package if the logic makes sense.

As a test I translated the schematic from 16v8 to 22v10, and it is one address line short.... Not a problem if the last io pin is configured as output, which it will most likely be. If someone fancies giving it a go I can add a quick PCB layout as well.
It may make more sense to make a connector for a Microcontroller of your choice (PIC, Arduino, STM32, ESP32, PI Pico, etc), though unfortunately I don't have time for that. (Mostly no time to write the firmware.) If you add a 12V charge pump for the program pin you could even read and program the GAL, maybe working around the limitations of common Eprom programmers with the 22v10...
There was a circuit for something called "GalBlaster" making the rounds, which is connected to a parallel port. You'd replace the parallel port with a microcontroller. It seems to have fallen off the internet, though.
Edit, BTW, you get ZIF sockets for GAL sized chips as well: https://www.ebay.de/itm/124041384723 , which reduces the risk of bending pins.
 

Attachments

  • PldDump22V10.pdf
    102.7 KB · Views: 48
Last edited:
Ok, no warranty and all that...
Here is a KiCad 8 project that includes a socket for both 22v10 and 16v8. This is just autorouted with minimal cleanup.
Someone will need to write a tool to analyse the dump and convert it back into CUPL equations.
 

Attachments

  • PldDump22V10.zip
    50.2 KB · Views: 44
ah, I didn't realize these were the larger chips. yeah my adapters wont work for thsoe. someone like Apoc will work out the logic by hand. I've not tried any of the other methods. for 22v10s
 
As a test, please try Lattice 22v10 if you find them cheaply. ATF22v10 has a power saving feature which defaults to "on". If your programmer doesn't write the last fuse it may still be on, and throw off any logic that uses pin 4...

I'm using a Dataman-48Pro2C programmer which officially supports the ATF22V10 parts. In the Device Options for the ATF22V10, I told it to program them without using the security fuse.
Screenshot 2024-07-30 001022.png

Nevertheless, I have ordered a set of Lattice 22V10 parts that will arrive in a week or so. Can I program the ATF22V10 dumps on PLDArchive directly to the Lattive22V10, or do I have to convert them first somehow?

As for what I'm able to dump from the working PLDs, here is a link to one of the dumps:
https://tinyurl.com/bden33cy

Let me know if that's useful.
 
Nevertheless, I have ordered a set of Lattice 22V10 parts that will arrive in a week or so. Can I program the ATF22V10 dumps on PLDArchive directly to the Lattive22V10, or do I have to convert them first somehow?
Yes, you can write them, no, you don't need to convert them. The common fuses that drive the same features are at the start, differences are at the end, which is mostly the signature and the power saving mode.
My Top3000 supports the ATF22V10 as well (it has a special programming algorithm different from other GAL), but it doesn't write to the fuse controlling the power saving mode.
 
I really need to build one of these dumpers.. and dump my almost complete PGM collection Pals/Gals.

Am i reading it right some one has made up a PCB to build these dumpers?? i'd love to build the 20.. and a 24pin dumper while i'm at it.
 
Back
Top