ICE T65/Z80/6809

[hoglet]

I was able to get the EZPIZZA programmed using a 64bit Pi4B running a 64bit beta version of the Pi OS and a current version of OpenOCD. Attached is a word.doc with my notes. Please share.

Thanks for that guide - I've updated the Programing using a Pi Wiki page to include a copy in PDF format.

Dave

[fraido]

Hi, the eepizza board has been delivered after more than 3 months and now i'm going to build the z80 adapter.
I didn't find any trusted source for the 74LVC4245AD, On farnell, rs, mouser they're out of stock. They can be purchased on ebay or aliexpress from china sellers but i'm not sure if the ICs will be genuine and fully functional. Is there a way to test them?
Have you any suggestions?
Thanks.

[hoglet]

I didn't find any trusted source for the 74LVC4245AD, On farnell, rs, mouser they're out of stock. They can be purchased on ebay or aliexpress from china sellers but i'm not sure if the ICs will be genuine and fully functional. Is there a way to test them?
Have you any suggestions?

Unfortunately many projects are in this situation at the moment.

The TI version of this part is the SN74LVC4245ADW (ADW = SOIC-24 package)

Mouser seems to have a small number of these in stock:
https://www.mouser.co.uk/c/?q=SN74LVC4245ADW

I can't think how you would test SMT parts bought on ebay, other than by building the board and seeing if it works!

Dave

[Prime]

Hi all,

For the 6809E target, does it generate AVMA / BA / BS and take notice of TSC? I'm trying to debug a machine** that uses those, and I can't get it to work.

**Yes it's a Dragon, but not a 32/64. The machine has two 68B09E in it

Cheers.

Phill.

[hoglet]

For the 6809E target, does it generate AVMA / BA / BS and take notice of TSC? I'm trying to debug a machine** that uses those, and I can't get it to work.

AVMS / BA / BS are driven directly by John Kent's CPU09 6809 Core.

Code: Select all

      vma      : out std_logic;                     -- valid memory address (active high)
      ba       : out std_logic;                     -- bus available (high on sync wait or DMA grant)
      bs       : out std_logic;                     -- bus status (high on interrupt or reset vector fetch or DMA grant)

I'm using version 1.26 of the core. The latest version is now 1.28, but the updates relate only to IRQ and FIRQ.

Data, Address and RnW are placed in the high impedance state as soon as TSC is taken high (i.e. it acts just like an asynchronous output enable signal). This is done independently of the CPU09 core. I implemented this bit, so it's more likely any errors are here than in John Kent's core.

Dave

[Prime]

For the 6809E target, does it generate AVMA / BA / BS and take notice of TSC? I'm trying to debug a machine** that uses those, and I can't get it to work.

AVMS / BA / BS are driven directly by John Kent's CPU09 6809 Core.

Code: Select all

      vma      : out std_logic;                     -- valid memory address (active high)
      ba       : out std_logic;                     -- bus available (high on sync wait or DMA grant)
      bs       : out std_logic;                     -- bus status (high on interrupt or reset vector fetch or DMA grant)

I'm using version 1.26 of the core. The latest version is now 1.28, but the updates relate only to IRQ and FIRQ.

Data, Address and RnW are placed in the high impedance state as soon as TSC is taken high (i.e. it acts just like an asynchronous output enable signal). This is done independently of the CPU09 core. I implemented this bit, so it's more likely any errors are here than in John Kent's core.

Thanks Dave,

I possibly need to download the latest version of the code too, my 6809E probe was programmed ages ago (couple of years).

Cheers.

Phill.

[fraido]

I finally build my Z80 CPU adapter ! Now i must get it working !

I use the ICE on an arcade board but i've got no signals from the board.

Code: Select all

ICE-Z80 In-Circuit Emulator version 0.994
Compiled at 12:32:26 on Sep 21 2021
8 watches/breakpoints implemented
Tracing every 1 instructions while single stepping
*** missing clock ***
CPU free running...
Mem Rd Brkpt hit at 0026 reading 0053:FF  .
04.534842 : 0026 :             :
Interrupted
04.563609 : 002C :             :
*** missing clock ***
>> m
002C FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
003C FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
004C FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
005C FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
006C FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
007C FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
008C FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
009C FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
00AC FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
00BC FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
00CC FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
00DC FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
00EC FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
00FC FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
010C FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
011C FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
>>

I tried it on a different board and it works!

So the issue on the first board should be related to the signals levels provided and/or maybe by its pullups resistors on CPU lines ...

[bluearcus]

Latest from vendor eepizza is that FPGA supply is an issue at the moment, with prices at an uneconomic level. As and when the supply / price issues calm down, they will resume their production batches.

[cyberbarter]

I finally build my Z80 CPU adapter ! Now i must get it working !

IMG_20220317_180905.jpg

IMG_20220317_180844.jpg

I use the ICE on an arcade board but i've got no signals from the board.

Hi Friado

Your build looks super nice. I am a SMT noob and about to build my adapters and was curious on the soldering techniques you used to build yours.
Did you drag solder the pins for the SMT chips or did you use solder paste and/or a stencil?
I would be curious as to the details of your construction.
What manufacture partnumber for the solder, flux, Solder iron/rework station and tip and temp settings? Any help regarding the details would be most appreciated. I can only hope to build mine as nice as yours.

Much thanks.
Cyberbarter

[hoglet]

I am a SMT noob and about to build my adapters and was curious on the soldering techniques you used to build yours.

For the ICs, use a couple of small blobs of blu-tack at each end to stop the chips from moving.

Next solder two diagonally opposite pins to secure the chip in place, allowing the blu-tack to be removed.

Then rag solder, one side at at time:
- apply some decent flux (like this)
- use a large/flat bit that covers 2-3 pins at a time - a pointy bit will be useless
- apply a bit of solder to the bit
- drag slowly down one side of the chip re-applying solder if needed (try to avoid damaging the silk screen/solder mask)
- when you get to the end, move the bit away in a perpendicular direction to avoid bridging the last two pins

I use a 2mm bevel tip:
https://www.hakko.co.uk/t18-c2-bevel-ti ... -t-2c.html

Others (Charlie) uses an even larger (3mm) bevel tip:
https://www.hakko.co.uk/t18-c3-bevel-ti ... -t-3c.html

If you get bridges don't panic. Either remove with solder braid, or apply more flux and drag again.

Dave

[KenLowe]

I am a SMT noob and about to build my adapters and was curious on the soldering techniques you used to build yours.

For the ICs, use a couple of small blobs of blu-tack at each end to stop the chips from moving.

Next solder two diagonally opposite pins to secure the chip in place, allowing the blu-tack to be removed.

Then drag solder, one side at at time:
- apply some decent flux (like this)
- use a large/flat bit that covers 2-3 pins at a time - a pointy bit will be useless
- apply a bit of solder to the bit
- drag slowly down one side of the chip re-applying solder if needed (try to avoid damaging the silk screen/solder mask)
- when you get to the end, move the bit away in a perpendicular direction to avoid bridging the last two pins

I use a 2mm bevel tip:
https://www.hakko.co.uk/t18-c2-bevel-ti ... -t-2c.html

Others (Charlie) uses an even larger (3mm) bevel tip:
https://www.hakko.co.uk/t18-c3-bevel-ti ... -t-3c.html

If you get bridges don't panic. Either remove with solder braid, or apply more flux and drag again.

Dave

Good advice! Almost identical to what I do (minus the blu-tack, but I may actually try that next time).

[cyberbarter]

I am a SMT noob and about to build my adapters and was curious on the soldering techniques you used to build yours.

For the ICs, use a couple of small blobs of blu-tack at each end to stop the chips from moving.

Next solder two diagonally opposite pins to secure the chip in place, allowing the blu-tack to be removed.

Then rag solder, one side at at time:
- apply some decent flux (like this)
- use a large/flat bit that covers 2-3 pins at a time - a pointy bit will be useless
- apply a bit of solder to the bit
- drag slowly down one side of the chip re-applying solder if needed (try to avoid damaging the silk screen/solder mask)
- when you get to the end, move the bit away in a perpendicular direction to avoid bridging the last two pins

I use a 2mm bevel tip:
https://www.hakko.co.uk/t18-c2-bevel-ti ... -t-2c.html

Others (Charlie) uses an even larger (3mm) bevel tip:
https://www.hakko.co.uk/t18-c3-bevel-ti ... -t-3c.html

If you get bridges don't panic. Either remove with solder braid, or apply more flux and drag again.

Dave

Thanks Dave for the great info. For practice I have been removing SMT Chips and components from old donor PCBs with a rework station and resoldering them back onto the PCB with a Hakko solder station and I was using the T18-CF2 chisel tips. I ordered the T18-C2 bevel tips and will give them a try.

I have been setting the Hakko solder station temp to ~350C. Close to the melting point of the solder I am using. May I ask what manufacture and part number you are using for your solder andd what temp you have your station? Also I would like to know how and what you use to remove any flux after soldering your components.

I have been using the Blue Tac to hold my PCB onto a ceramic hot pad and I move that hot pad around under the microscope. Your idea to use the Blue Tack to secure the chip onto the PCB while you tack it down is worth a million bucks. Line the pads up, secure with Blue Tack and solder tac the opposite corners. Thanks so much for all the great pointers.

Cyberbarter

[baz4096]

Worth shopping around for that Chip Quik liquid flux. It's available on Amazon UK for cheaper than Farnell, and no minimum order for free delivery (if you have prime that is - cheaper delivery if you don't have prime):

[hoglet]

I have been setting the Hakko solder station temp to ~350C. Close to the melting point of the solder I am using. May I ask what manufacture and part number you are using for your solder andd what temp you have your station? Also I would like to know how and what you use to remove any flux after soldering your components.

I'm still using a large reel of old leaded solder that I picked up at a radio rally a couple of years ago. It was unbranded.

I have my Hakko set to 310 degrees C.

What solder type are you using?

Leaded solder melts at approx 183 degrees C; Unleaded solder melts at approx 217 degrees C. The iron needs to be quite a bit hotter then the solder melting point.

The above ChipQuik flux is I think meant for unleaded solder. I haven't tried using it myself yet, but it comes highly recommended. The last batch of board I made about 18 months ago I used a Chemtronics CW8100 Flux Pen.

For cleaning up I just use plenty of 99% IPA and a toothbrush/kitchen roll.

The leaded vs unleaded business is somewhat of a pain, as I it affects:
- the PCB surface finish (HASL-with-lead vs HASL lead-free)
- the finising on the SMT IC Pins
- the solder
- the flux
- the soldering iron bit

In an ideal world, all of these should be the same flavour.

Dave

[cyberbarter]

I have been setting the Hakko solder station temp to ~350C. Close to the melting point of the solder I am using. May I ask what manufacture and part number you are using for your solder andd what temp you have your station? Also I would like to know how and what you use to remove any flux after soldering your components.

I'm still using a large reel of old leaded solder that I picked up at a radio rally a couple of years ago. It was unbranded.

I have my Hakko set to 310 degrees C.

What solder type are you using?

Leaded solder melts at approx 183 degrees C; Unleaded solder melts at approx 217 degrees C. The iron needs to be quite a bit hotter then the solder melting point.

The above ChipQuik flux is I think meant for unleaded solder. I haven't tried using it myself yet, but it comes highly recommended. The last batch of board I made about 18 months ago I used a Chemtronics CW8100 Flux Pen.

For cleaning up I just use plenty of 99% IPA and a toothbrush/kitchen roll.

The leaded vs unleaded business is somewhat of a pain, as I it affects:
- the PCB surface finish (HASL-with-lead vs HASL lead-free)
- the finising on the SMT IC Pins
- the solder
- the flux
- the soldering iron bit

In an ideal world, all of these should be the same flavour.

Dave

Hi Dave

I am using Kester 24-6040-0010
https://www.digikey.bg/en/products/deta ... 010/265622

The below data sheet does recommend solder iron tip temps of 315 - 343 C for leaded. It also mentions that IPA does not clean off the flux residue.
https://www.kester.com/DesktopModules/B ... 0&TabId=96

I have been using a GC Flux Remover https://www.alliedelec.com/product/gc-e ... /70624648/

Once the new Hakko T18-C2 tips arrive, I will make some small temp tweeks to the solder station and practice some more before my final build.

Thanks for all of your insight.

Cyberbarter

[Witchy]

Hello folks,

I’ve been reading about this project for ages and bemoaning my lot that I have a need for a plain 6809 ICE while godil boards are unobtanium. Is it right that the eepizza project will only do a 6809e?

Cheers!

Witchy

[hoglet]

I’ve been reading about this project for ages and bemoaning my lot that I have a need for a plain 6809 ICE while godil boards are unobtanium. Is it right that the eepizza project will only do a 6809e?

Unfortunately that is correct.

What system do you want to use it in?

Dave

[Witchy]

Hi Dave,

It's my Positron 9000 - https://binarydinosaurs.co.uk/Museum/Positron. 6809 powered with the capability of taking 8x 6829 MMU's, quite a beast! Also only one of perhaps 2 known to exist.

Cheers,

Witchy.

[hoglet]

It's my Positron 9000 - https://binarydinosaurs.co.uk/Museum/Positron. 6809 powered with the capability of taking 8x 6829 MMU's, quite a beast! Also only one of perhaps 2 known to exist.

Does a schematic exist? (I suspect I know what the answer is going to be....)

Another less intrusive option for diagnosing machines as valuable / unique as this is to use a 16-bit logic analyzer to capture a trace of the data bus and control signals and then attempt to decode it back to instructions.

Do you have access to a logic analyzer?

For the 6502, 65816 and Z80, I have developed trace decoding tools:
- 6502: github forum thread
- 65816: github forum thread
- Z80: github forum thread

These give you and instruction level view of what's happening, for example:

Code: Select all

$ decode6502 --phi2= -sh test/beeb/reset.tmp | head -20
???? :          : RESET !!       : A=?? X=?? Y=?? SP=?? N=? V=? D=? I=1 Z=? C=?
D9CD : A9 40    : LDA #40        : A=40 X=?? Y=?? SP=?? N=0 V=? D=? I=1 Z=0 C=?
D9CF : 8D 00 0D : STA 0D00       : A=40 X=?? Y=?? SP=?? N=0 V=? D=? I=1 Z=0 C=?
D9D2 : 78       : SEI            : A=40 X=?? Y=?? SP=?? N=0 V=? D=? I=1 Z=0 C=?
D9D3 : D8       : CLD            : A=40 X=?? Y=?? SP=?? N=0 V=? D=0 I=1 Z=0 C=?
D9D4 : A2 FF    : LDX #FF        : A=40 X=FF Y=?? SP=?? N=1 V=? D=0 I=1 Z=0 C=?
D9D6 : 9A       : TXS            : A=40 X=FF Y=?? SP=FF N=1 V=? D=0 I=1 Z=0 C=?
D9D7 : AD 4E FE : LDA FE4E       : A=80 X=FF Y=?? SP=FF N=1 V=? D=0 I=1 Z=0 C=?
D9DA : 0A       : ASL A          : A=00 X=FF Y=?? SP=FF N=0 V=? D=0 I=1 Z=1 C=1
D9DB : 48       : PHA            : A=00 X=FF Y=?? SP=FE N=0 V=? D=0 I=1 Z=1 C=1
D9DC : F0 09    : BEQ D9E7       : A=00 X=FF Y=?? SP=FE N=0 V=? D=0 I=1 Z=1 C=1
D9E7 : A2 04    : LDX #04        : A=00 X=04 Y=?? SP=FE N=0 V=? D=0 I=1 Z=0 C=1
D9E9 : 86 01    : STX 01         : A=00 X=04 Y=?? SP=FE N=0 V=? D=0 I=1 Z=0 C=1
D9EB : 85 00    : STA 00         : A=00 X=04 Y=?? SP=FE N=0 V=? D=0 I=1 Z=0 C=1
D9ED : A8       : TAY            : A=00 X=04 Y=00 SP=FE N=0 V=? D=0 I=1 Z=1 C=1
D9EE : 91 00    : STA (00),Y     : A=00 X=04 Y=00 SP=FE N=0 V=? D=0 I=1 Z=1 C=1
D9F0 : C5 01    : CMP 01         : A=00 X=04 Y=00 SP=FE N=1 V=? D=0 I=1 Z=0 C=0
D9F2 : F0 09    : BEQ D9FD       : A=00 X=04 Y=00 SP=FE N=1 V=? D=0 I=1 Z=0 C=0
D9F4 : C8       : INY            : A=00 X=04 Y=01 SP=FE N=0 V=? D=0 I=1 Z=0 C=0
D9F5 : D0 F7    : BNE D9EE       : A=00 X=04 Y=01 SP=FE N=0 V=? D=0 I=1 Z=0 C=0

They also model memory, and warn if the value read differs from the original value.

The most important tool in facilitating this is a high quality 40-pin DIP test clip.

If you were able to capture a long trace of the machine after reset, then this technique is applicable. I would be happy to start work on a decoder for the 6809.

For valuable old machines, this technique is I think a better first step than the ICE, because it is completely non-intrusive, and much less likely to cause any damage than trying to use an ICE.

Edit: I've just noticed this wonderful picture on your website:
https://binarydinosaurs.co.uk/Museum/Po ... ld-18.jpeg

So it does seem like you should be setup to capture a trace from the 6809. The only issue with the HP 1660A is the low memory depth (4K/8K samples). But it would be a start if triggered properly on reset.

Dave

[Witchy]

Hi Dave,

I've been drawing a schematic in KiCAD as I've been working on it, now up to 2 pages and growing. I've just noticed I haven't got it on the Posi page so I'll export it and stick it up there in a bit. I've been working on logic tracing it, and Mike Miller has done an excellent Wiki which he's posted on Notion but I'm not sure if it's public yet. Soren has done a disassembly of the ROMs too. Between Pernod (from these very pages) and Mike they've got it sort-of-running in MAME which is excellent.

Currently I'm trying to trigger on finding 0xFFFE then searching for 0xFFFF with BS high but it still looks like the CPU isn't getting instructions from ROM after that and is just free running through the address space, certainly that seems true if I trigger on 0xFEF6 which is the DATinit routine. All the buffer control lines SEEM to be correct but the data bus at the CPU and ROM at the time of sampling are completely different. They're consistent though, so 0x54 at the CPU always equals 0xF6 at the ROM, not got to the bottom of that yet.

Cheers,

Witchy

[hoglet]

I've been drawing a schematic in KiCAD as I've been working on it, now up to 2 pages and growing. I've just noticed I haven't got it on the Posi page so I'll export it and stick it up there in a bit. I've been working on logic tracing it, and Mike Miller has done an excellent Wiki which he's posted on Notion but I'm not sure if it's public yet. Soren has done a disassembly of the ROMs too. Between Pernod (from these very pages) and Mike they've got it sort-of-running in MAME which is excellent.

It looks like an interesting machine.

Let us know when the schematic and wiki are publically accessible.

Currently I'm trying to trigger on finding 0xFFFE then searching for 0xFFFF with BS high but it still looks like the CPU isn't getting instructions from ROM after that and is just free running through the address space, certainly that seems true if I trigger on 0xFEF6 which is the DATinit routine. All the buffer control lines SEEM to be correct but the data bus at the CPU and ROM at the time of sampling are completely different. They're consistent though, so 0x54 at the CPU always equals 0xF6 at the ROM, not got to the bottom of that yet.

If you do want try capturing a trace, here's some suggestions.

The schematic would help decide what control inputs would be useful to capture (no point in capturing ones that are just pulled high). For example, is nDMA and mRDY used?

The following would provide a good starting point:
- D0..7
- RnW
- BA
- BS
- nRESET
- nIRQ
- nNMI
- nFIRQ

On the 1660 logic analyzer use the state analysis mode, with the sample taken on the falling edge of E.

Trigger the capture on the rising edge of nRESET.

Dave

[Witchy]

The following would provide a good starting point:
- D0..7
- RnW
- BA
- BS
- nRESET
- nIRQ
- nNMI
- nFIRQ

On the 1660 logic analyzer use the state analysis mode, with the sample taken on the falling edge of E.

Trigger the capture on the rising edge of nRESET.

Dave

That's *almost* exactly what I'm doing nNMI and nFIRQ are pulled low anyway and I haven't got as far as needing to scan nIRQ, This afternoon I was watching it free run and read the ROM correctly, but something was clobbering the databus between ROM and CPU. Puzzled over that for ages until I was studying the bottom of the board again to hopefully spot things I'd missed and what I HAD missed was that between ROM and CPU there is also the entirety of the RS232/comms side of things, full of 74LS245 drivers, multiple MC6850 UARTs and an MC6840... all with that databus going to them.

I hadn't got as far as tracing those lines out so that's what I'm doing now, along with giving myself a kicking for not spotting these WEEKS ago.

Cheers

Witchy

[Witchy]

I'd already drawn out the destination circuits of these traces but hadn't linked them together. I isolated those last night and got the CPU to execute code and I could see it running and looping through the init routines and RAM tests. Obviously the RAM tests failed because I'd removed all the RAM, but aside from that it's now running

It's entirely possible the device causing the problems was a single 74LS245 that doesn't connect to anything useful - an external keyboard.

Cheers

Witchy

[hoglet]

Thanks for the update.

What's the best way to follow your progress on this?

Twitter?

https://twitter.com/hashtag/positronJapes

Dave

[Witchy]

Hi Dave,

I try to remember to put that on Posi posts but doesn't happen all the time. Pretty much everything I post, picture wise, is the Posi at the moment though. I've still not captured the reset vector but last night watched it loop through a section of code that is setting up a despatch table for user OS calls. At the end of the routine is an RTS which would appear to be missing the stack pointer or whatever mechanism a 6809 uses to return from subroutines, so it falls off the end and starts free running at 0x0000.

At least with this trace we can compare it with the original Coco3 OS9 source and also have a direct comparison with what the code is doing in MAME since that does successfully boot and give us a 'Welcome' prompt. Something I never thought I'd see!

Cheers

Witchy

[BigEd]

Just a thought - might that failing RTS be the first time a value is read back from RAM and is critical? It's possible stack writes are not happening properly.

[bluearcus]

It looks like an interesting machine.

Let us know when the schematic and wiki are publically accessible.

Hi Dave,

If you drop me a pm will sort out wiki access.

Kind regards,

Mike

[bluearcus]

Just a thought - might that failing RTS be the first time a value is read back from RAM and is critical? It's possible stack writes are not happening properly.

You're not wrong there. Suggests RAM reads are junk.

[Witchy]

It does go through a RAM clear routine before it gets to this SetSvc routine, but maybe it's not error checked. I agree though, this is the first time the RAM decoding etc may have been accessed. I know all 16 4164s I have in there are good as is the LS244 buffering the DOUT lines. DIN is fed directly from the CPU buffer and I know that's good. Need to check RAS/CAS etc.

[Witchy]

This is the code it loops through 32 times before falling foul of a mispointed PC:

Code: Select all

************************************************************
*
*     Subroutine SetSvc
*
*   Set Service Routine Table entries
*
* Input: Y = Routine Initialization ptr
*
* Output: none
*
* Data: D.SysSvc, D.UsrSvc
*
* Calls: none
*
SetSvc10 clra
         aslb            make table offset & set flag
         tfr  D,u        save offset
         ldd  ,Y++       get routine offset
         leax D,Y        make routing ptr
         ldd  D.SysDis   get system dispatch table ptr
         stx  D,u        set routine entry
         bcs  SetSvc     branch if system only
         ldd  D.UsrDis   get user dispatch table ptr
         stx  D,u        set routine entry
SetSvc   ldb  ,Y+        get next request code
         cmpb #$80       end of table code?
         bne  SetSvc10   branch if not
         rts
         page

(snipped taken from Soren's site at roug.org). I'll re-run the trace later with R/!W present so I can see where it's at least attempting to write to RAM.

Cheers

Witchy