Monday, October 31, 2022

Commodore 1541 Drive Repair Part 1

I recently attended a repair workshop at the System Source Computer Museum in Hunt Valley Maryland. This was my first time attending one of these events so I didn't bring anything with me to work on, I figured I might find someone else that needed help, which is exactly what happened. I met someone who had brought a bunch of Commodore 1541 drives and was hoping to find someone who could help repair them. Even though I had never worked on  a 1541 drive I knew they were 6502 based to I thought I would take a crack at it. 

Most of the drives would not even get through their power on self test, indicated by the activity LED flashing. One started to emit a burning smell when we powered it up, so we put that one aside. Another would not power up at all. We swapped chips on a few but didn't make any progress that way. There was one that powered up properly but as we were trying to do further testing with it connected to a C64, the computer failed. So, we didn't make much progress there but I took one of the drives home to work on.

Before I could dig into the drive I needed some documentation. I found this site which has a good collection of schematics for various versions of the drive:

I also found a couple good books on

Commodore 1541 Troubleshooting and Repair Guide

The Anatomy of the 1541 Disk Drive

The first thing I noticed was the C21 tantalum capacitor had burned up. This cap is between the +12V supply and ground so was probably acting as a filter cap. The +12V supply still looked good with the cap burned out so I continued to work on the drive until I was able to get a replacement. 

The next step was to troubleshoot the power on self test problem. In a previous post I talked about the IF65 in-circuit emulator that I used at a previous job. Troubleshooting this sort of failure was a perfect application for this device. I started by connecting it to a known good drive to make sure everything worked ok. 

With the IF65 setup verified I re-connected it to the unit under test. I started by testing the ROM on the bad unit, and that seemed to be ok. Next I ran a RAM test and immediately saw a failure across the whole RAM address range. The errors were pretty random so it didn't look like just a bad data or address line. Next I turned to the IF65's address trap functionality and checked out the chip enable lines which looked good. The addresses lines also looked good, but I was getting very odd signals on the data bus. 

The RAM chip on my good drive was soldered in, so swapping was not an option, so I removed all the other chips on the bad unit that were connected to the data bus, but the RAM test still failed. I started to look through my surplus chips to find an equivalent RAM chip and quickly noticed the problem. The chip in the RAM socket was actually a ROM from another drive and not a RAM chip! Not sure if this happened when we were swapping chips at the repair day or happened during a previous repair attempt. I did find an equivalent RAM chip in my collection, put that one in the drive and it passed the power on self test. 

This was not the extent of the problems with this drive, I will cover more of the repair process in my next post.

Saturday, September 24, 2022

Infotron Systems IF-65


Back in the late 80's and early 90's I worked for Infotron Systems (later Gandalf Technologies) which manufactured data communications equipment. A lot of Infotron’s equipment was based on the 6502 microprocessor, so much so that they designed and manufactured their own 6502 in circuit emulator (ICE) the IF65. The IF65 was a great tool for both developing embedded 6502 software and for troubleshooting 6502 hardware. The IF65 was mainly used in house, but I know of at least one other company that Infotron sold them to. Fortunately, I ran across a working IF65 at a flea market a long time ago.

The built in monitor software is accessed through a serial terminal. The monitor provides functions to read/write memory, test RAM, assemble and disassemble code, and access the EPROM programmer.

I worked in the repair department, initially doing manufacturing repair and then eventually customer return repairs. We used the IF65 to run special test programs and as a general troubleshooting tool for 6502 based boards. This version of the IF65 has 64K of static RAM that can be configured to overlay the product's memory in 4K blocks. You would normally set this up to overlay the ROM portion of the product's memory map. Code could then be loaded by reading it from an EPROM using the EPROM programmers, downloaded from a host computer (we used VAX mainframes at Infotron), or even entered using a built in line assembler.

A really useful feature for troubleshooting was the address trap function. If, for example, you wanted to troubleshoot the address decoding hardware you would set the trap address to the address you were trying to test and then set the switches for read, write, and/or opcode access. Now any time that address is accessed you would get a sync pulse output through the connector on the lower right side. You would hook this signal to one channel of an oscilloscope and then use the other channel to probe the circuit and you would see what a signal state was as the moment the memory access was happening. 

Another feature that comes in really handy for running test software is the ability of the 6502 code to access the serial ports on the IF65. This allows the test software to interact with the user even if the unit under test is totally non-functional. This functionality, when enabled, is accessed with the 6502 BRK instruction. The byte after the BRK command contains the command you want to execute and the Accumulator is used to pass data. For example, to print a character you would do this:

LDA #$30
.BYTE #$11

Sunday, September 4, 2022

HLL65F - INDEN/UNDEN - Mystery Solved

In my previous post I talked about some mysterious code in the macro definitions for the Atari Crystal Castles arcade game source code. Someone responded to my post about this and pointed me to Franz Lanzinger who was one of the original authors of Crystal Castles who in turn pointed me to Dave Shepperd who wrote that assembler. He confirmed that this was a custom assembler developed for Atari:

"Yes, I wrote both versions of mac65. We called it macxx way back when (because it would assemble for the 6502, 65C02, 6800, 68000, and others). The first version was written in PDP11 assembly for RT11 and it used linkm as a linker, the other tool I wrote. We used those tools for a year or so after getting the VAXen. The second and current version was written in C (first DEC C for the VAX, then subsequently others and finally gcc) and compiled on various O/S. I've only been maintaining it on Linux, but it probably will still build on many others, especially those Linux like. Not sure if it would work anymore on 16 bit machines. This version uses another of my tools also written in C: LLF (Link+Locate+Format) as the linker."

He also provided an explanation of how he believes the two mystery lines worked:

.LIST SRC(...S1,1)

The .LIST pseudo op controls what get's output to the listing file. The SRC flag says to turn on the output of the assembler source code and the values in parenthesis after it control the details of the output. The first parameter tells the assembler which columns to start outputting the source on. The second value, if present and not zero, tells the assembler to wait until the next line before changing the output column instead of doing it on the current line.

.PRINT ..NST$(37,1,16,1,38'->')

The .PRINT pseudo op prints text to the listing file. The expression after .PRINT is evaluated and the result it what will be printed. Again, we have a list of parameters to control this output. This is a pretty esoteric command so I am not sure if I would have every figured this out:

37 = Column to start the print on
1 = How many characters of the value to print out 
16 = The radix of the value, in this case it will be printed as hexadecimal
1 = If present and non-zero, print the leading zeros
38=This parameters is usually used to indicate that the sign should be output, but since it has a text string after it it functions differently. In this case the text "->" will be output starting at column 38.

Let's look at the end result of all of this. Here is a chunk of source code using two nested IF macros:

LDX 40

The listing output would end up looking something like this:

           F004  D0 FE                      BNE .
   10      F006  E8                         INX
           F007  D0 FE                         BNE .
   12      F009  A6 28                         LDX 40
           F008  02                            .BYTE ...S0
   14      F00B  88                         DEY
           F005  06                         .BYTE ...S0

Sunday, August 7, 2022


Notes: Since writing this post I have solved the mystery of the two cryptic lines, I wrote another post about this:

In my last post I introduced the HLL65 high level language 6502 macro library used in the Atari Crystal Castles source code. The macro definitions used macros called INDEN and UNDEN that I assume are for handling indentation of the code in the listing file. Exactly how these work is a little but of a mystery to me. Here is the code for INDEN:


..NST$ = 0

...S1 = ..NST$+1*3+..SRC$
.IIF GT,...S1-<9.*3+..SRC$>,...S1 = 9.*3+..SRC$
.LIST SRC(...S1,1)
.PRINT ..NST$(37,1,16,1,38'->')
..NST$ = ..NST$ + 1

Like most macros is starts by saving a variable on the stack. The ..NST$ variable is used to keep track of the depth of the indent, so the next block of lines checks to be sure the code hasn't undented further then it has indented and if it did it throws an assembler error. 

When the macro library is initialized ..SRC$ is set to 41, so the next line sets ...S1 to 41 + 3 times the current number of indents. The next line checks if ...S1 is beyond 9 indents and if it is, it sets it back to the value for 9 indents. 

The next line is the first one I don't understand. According to documentation I found for a VAX assembler, .LIST is used to control what gets displayed in the listing, but the documentation does not list the argument syntax used in this code. It's possible this is displaying the current line at a specific place on the line. 

The .PRINT pseudo-op is used to write text to the listing output, but the rest of this line is quite cryptic. The string '->' makes sense as an indication of indentation, but I am not sure what the numbers before it do. I also don't understand the parenthesis right after the ..NST$ variable. 

The next line increments the indent counter and finally the value of ...S1 is restored. 

The OUTDEN macro works the exact same way as this macro, but it just reduces the indent. 

If anyone has any ideas about the two cryptic lines, let me know. 

Saturday, August 6, 2022


HLL65F.MAC is a standard Atari macro library that adds some high-level language constructs to the 6502 assembler. It adds IF/THEN statements, conditional loops and a few other miscellaneous helper macros. Let's start by looking at an example of a conditional:

CPX #78
   ADC #2

First, keep in mind that this is not conditional assembly, there are pseudo ops for that, this is an actual runtime conditional. This macro check if the zero flag is set and if it is the code between the IFEQ and ENDIF is executed. Let's look at how these macros are expanded. First, a macro is used to define the IFEQ macro:


DEFIF is defined with this macro:

.MACRO DEFIF .1.,.2.

  .MACRO .1.
IFXX .2.

It will expand to this:


.NOCROSS tells the assembler not to add this symbol to the cross reference list. The rest of the expansion is the definition of a new macro which is just the IFXX macro with "bne" as the parameter. Here is the IFXX macro:


.1. .

This expands to:

bne .

The first line is another macro which we will look at next. The second line branches back to itself. Since the macro is looking for Equals, this line will branch over the code in the block if the condition is Not Equals. Until the ENDIF is assembled the assembler doesn't know what the actual branch target should be, so the branch to self is used as a placeholder. Here is the LOC macro:

.PUSH REGSAV,...P0,...S0,...P1,...S1
...P0 = .
...S0 = type
.PUSH PC,...P0,...S0
.POP REGSAV,...S1,...P1,...S0,...P0

and here is the expansion:

.PUSH REGSAV,...P0,...S0,...P1,...S1
...P0 = .
...S0 = 0
.PUSH PC,...P0,...S0
.POP REGSAV,...S1,...P1,...S0,...P0

There are two possible values for the type parameter, 0 for IF blocks and 2 I believe is for a loop block but I haven't figured that one out yet. The INDEN macro is for doing indents in the listing and doesn't impact the code that is generated, I will code this macro in another post since it is a little mysterious. The second line saves a couple variables onto the REGSAV stack. ...P1 and ...S1 aren't  used so they didn't actually have to save then. Next it puts the current program counter into ...P0 and the type into ...S0 and pushes these on the PC stack, these will be used later to end the block. Finally the original variable values are restored from the stack.

Now that the block has been started we need to look at how it ends, in this case with the ENDIF macro:


This macro is simply composed of another macro called THEN. I haven't dug into how you would use THEN by itself. THEN looks like this:


just like $INDEN, $UNDEN is used for indentation in the list and I will cover this in another post, so that just leaves the FND macro:

.PUSH REGSAV,...P0,...S0,...P1,...S1
...P0 = .
.POP PC,...S1,...P1
.if eq,...s1&2
    . = ...P1+1
    .IF EQ,...S1&1
        ...S0 = ...P0-...P1-2
        .IIF GT,...S0-127.,.ERROR ...S0 ; BRANCH OUT OF RANGE
        .IIF LT,...S0+128.,.ERROR ...S0 ; BRANCH OUT OF RANGE
        .BYTE ...S0
        .WORD ...P0
     . = ...P0
     .ERROR TYPE ;inappropriate END for structure type
 .POP REGSAV,...S1,...P1,...S0,...P0

This is the workhorse of this entire macro. It is basically going to use the information on the stack to modify the BNE opcode that was assembled in the IF macro so that it will branch past the block of code if the condition wasn't met. 

 First it saves that registers on the REGSAV stack so they can be restored at the end of the macro. Next the type is popped from the stack and stored in ...S1 and the program counter is popped and stored in ...P1. Next it checks if bit 1 or the type is set, in this case it will not be since the type is 0 so the condition will be met since the conditions is "equals zero". The next line will set the current program counter to the original program counter + 1 which will point it to the offset in the BNE opcode. Next bit 0 of the type is checked and again the condition is met. Next the offset for the branch is calculated by subtracting the original program counter from the program counter as it was when the macro started and then subtracting 2 and storing the result in ...S0. The next two lines check if the branch will be out of range, and if it is shows an assembler error.   After the just check is a .BYTE pseudo op that injects the new calculated offset into the BNE opcode that was assembled in the IF part of the macro. After the inner condition the current program counter is restored to where it was at the start of the macro, and then finally the registers are restored. 

These macros are a little complex but they do provide a clever way of implementing run time conditional blocks. The use of the assembler stack in the macros allows you to next IF blocks several levels deep just like in a higher level language. 

Sunday, April 24, 2022

Crystal Castles Assembler - Stacks

This is a continuing look at some of the features of the 6502 assembler Atari used for arcade games like Crystal Castles. One of the unique features, one I haven't seen in any other 6502 assembler, is the ability to define assembler level stacks. These have nothing to do with the 6502 stack, but instead are used to control the assembly process. 

You start by defining a stack using this pseudo op:


There are two parameters. The first, in this case "REGSAV", is the name you want to give to the stack. You will use this to interact with the stack.

The second parameters, 4, is the size of the stack, so this stack will be able to hold up to 4 values.

To put a value on the stack you use the .PUSH pseudo op:


This will push the value 1 onto the stack named REGSAV. The second parameter can also be an expression. I don't know if the original assembler allowed text strings to be pushed onto the stack but my version of the assembler only allows numbers to be pushed onto the stack. 

To get a value off the stack you use the .POP pseudo op:


This will pull the top value off the stack named REGSAV and put it into variable S1. The second parameter here must be a variable, not an expression.

You can use the .GETPOINTER pseudo op to get the stack pointer for a specific stack:


This will put the stack pointer for stack REGSAV into variable P1. The stack pointer works from high to low, so if you declare a stack with the size 4, the initial pointer will be 4. If the pointer is 0 it means that stack is full.

Since I can only go by the source code I don't know what happens if you try to push a value onto a full stack or pull a value from an empty one. My version of the assembler currently doesn't handle these scenarios.

In a later post I will show how this features is used in the Crystal Castles source.

Sunday, April 3, 2022

Crystal Castles Assembler

When I found the Crystal Castles Source code I thought it would be cool to able to re-assemble the source so modifications could be made to the game from the original source. I didn't take long to realize that the assembler used by Atari had a lot of differences from assemblers I was familiar with. I started Googling some of the unusual pseudo ops in the source to see if I could identify an assembler that was compatible with this code. I found manuals for similar assemblers but nothing was a perfect match.

The best resource I found was the VAX MACRO and Instruction Set Reference Manual:

It is not surprising that this assembler is close, Atari did a lot of their arcade development on DEC VAX mainframes. This became my go-to document for writing my assembler. If there was anything that was not clear from the source, but was answered in this document, I used what was in this document. 

Addressing Modes

One of the strangest differences between this assembler and other common 6502 assemblers is the syntax to define addressing modes. All the modes can be defined with prefixes to the operand, so for example, for absolute X you would do LDA AX,$1000 instead of LDA $1000,X. There are even multiple ways to define the same mode, at it appears different programmers used different ones. Here are the prefixes for the addressing modes:

# or I, - Indirect
ZX, - Explicit zero page X
ZY, - Explicit zero page Y
Z, - Explicit Zero page   
NX, - Indirect X
NY, - Indirect Y
AX, - Absolute X
AY, - Absolute Y
A, - Absolute
X, - Absolute or Zero Page X determined by the assembler 
Y, - Absolute or Zero Page Y determined by the assembler 

There are also two suffixes that can be used, (X) and (Y). You would think that these would be for indirect modes, but they are not, they are for absolute X and Y. I also found "(X" in the code. I assume this is an anomaly of the assembler where it doesn't parse the entire addressing mode identifier. 


The Atari assembler provides two different ways of controlling the radix (base) of numbers. First, the radix can be specified using a prefix on the number ^H for Hex and ^B for Binary. There is probably a prefix for octal but the Crystal Castles code doesn't use it. The second way of specifying radix is to use the .RADIX pseudo op which specifies the default radix to use when parsing numbers. For example if this is in the source:

.RADIX 16 

it will set the default radix to hex so that if a number doesn't have an explicit radix prefix it will be interpreted as hex. To avoid confusion with symbols, a hex number must start with a number if it doesn't have a prefix, so for example A5 would have to be written as 0A5. In my version of the assembler I always treat the parameter for the radix pseudo op as a decimal.


The .REPT pseudo op looks pretty straight forward but there turned out to be some tricky parts to it. This pseudo-op repeats a block of code a specified number of times during assembly. It is passed one parameter which is the number of times to repeat it. 

The first interesting thing I found about it is that the Crystal Castles sources often uses it with a repeat count of zero. The basically works like a block comment, preventing the block of code from being assembled at all. 

The other interesting thing I found in the code was the .REPT blocks were sometimes ended using .ENDM, which ends a macro definition, instead of .ENDR. My theory on this is that if a repeat block is started inside a macro definition then it would make no sense for it to extend beyond the end of the definition, so it's possible that the assembler explicitly ends open repeat blocks at the end of a macro definition. This was probably an un-intended side effect of the way the assembler was written. 

I will cover some more differences in a latter post.