Adapter for HP Logic Analyzers
In August 2009, I made an adapter to easily connect my logic analyzer
to the address, data, and control lines of the CPU chip. It
allows complete access to the operation of the CPU board
core. This board is a modification of the 68B09 adapter
from the WPC project.
Adapter board in operation on a System 11 board. This allows
accurately trace the program execution and better find what is wrong
with a board.
Typical view of Logic Analyzer connected to a CPU chip. The
last two lines
are spare signals that the user can clip to the board (blue clip in
Adapter for 16 pin DIPs
had some small amount of space leftover on the above circuit board for
the Logic Analyzer, so I added two smaller boards. One is
here, and allows a LA pad to monitor all 16 lines of a 16-pin DIP IC.
This adapter allows a straight-through connection of a 16 pin DIP and
tap for a LA pod. All 16 pins of the DIP can be easily
LA screen display with an example test.
Siamese board setup with
the Logic Analyzer
is better than a CPU board being observed by a Logic Analyzer?
Why two boards of course. After 10 years of
boards, I have encountered one or two that pass all tests on the
individual components, but still do not boot and run. I
brute force way of finding the problem, and imagined a setup where a
good reference board was compared step-by-step with the bad board.
The setup below shows this configuration.
Twin boards on the Logic Analyzer to find why one does not
crystal oscillator and reset circuit from the master board is used on
the slave board by removing selected components from the power up reset
circuit and the crystal oscillator. They are passed by a
wire bridge shown as the grey cable in the image above. This
cable plugs into the sound CPU socket.
With this setup the two
boards will run precisely in sync and their data and address busses
will have identical contents (using identical copies of the game ROM of
course) until the bad board deviates. By inspecting the data
address busses, we can see why the bad board has failed.
Screen snap of the Logic
Analyzer for the Siamese setup
above screen shows an example output of the siamese setup.
first box shows a write to ram location 0x9B and 0x9C with the number
0x2100 (big endian). The second box shows a read from that
location, and we see the same data coming out of RAM.
a second read a few clock cycles later, this data is now 0x9B82.
After replacing the RAM chip and seeing no difference, I
that the problem was with the RAM power circuit. Indeed
that issue fixes the bad board. Success.
Logic Analyzer with a System 3-7 System I
find the System 3-7 series harder to debug as they have the simpler
diagnostics and the finicky interboard connector. It occurred to
me that the entire bus is available on the Driver Board, and that I
could solder in a set of Logic Analyzer pods to debug any CPU board
that fails to boot or has problems.
Logic Analyzer connected to the Driver Board of a System 3-7.
decided that ribbon cables would be the neatest way to go and
soldered in a 40-wide strip to the back of the Driver Board. The
LA adapters then plug into that and the short stub of ribbon is out of
the way when not in use.
Logic Analyzer display during a generic read/write interval.
the above screen we can catch a write from the CPU (at the "X" marker)
to address 0x3002. We can see that the waveforms are consistent
with the writes/reads occurring at the falling edge of the Phase 2
clock and agrees with the 6800 data sheet.
two pods (each 16 channels), I have four spare inputs left over.
These can be used by monitoring other signals so that I can
better diagnose problems. For example, on one System 3 board, I
can tell that an intended write with the data "0xff" actually shows up
as an "0xe" on the databus. By hooking one of the spares to the
output of the PIC68 CPU emulator, I can see that the problem is in the 8T28 bus transceiver (IC9).
PIA focused Logic Analyzer adapter There
are times when I need to know why a particular PIA is showing a
malfunction. Unfortunately, they have three chip selects and that
makes it tricky to know exactly when it is being addressed. It is
for example not easy to use a scope to trap a write or read. Even
with my CPU chip logic analyzer adapter, as some
of the decoding and address lines to the PIA could be broken. To
address this, I decided to make an adapter specifically for the PIA,
but to make it more universal, I decided to build it into a 40-pin IC
test clip. This allows me to check any PIA even if it is original
and soldered into the board.
This is the IC test clip with the ribbon cable to the Logic Analyzer
purchased a 40-pin 0.6" wide test clip on Ebay for about $12, and found
one that did not have mushroom caps on the pins (pins protruding were straight shaft). This was
important so I could mate it to a row of sockets and then soldered to
the exposed pins. This allows me to pull the sockets off and
reuse the clip with a different set of cables.
of the 16 inputs is leftover as a spare, and that is connected to the
minigrabber shown above. This allows me to monitor an output pin
or the IRQ, and be able to trigger on it. This way I can catch
writes to an IO port or other similar activity.
Logic Analyzer display with the PIA adapter.
above display shows a sample run with a working CPU board. At the
'X' marker, you can see CS go to '5' (binary '101'), which is the
correct configuration for Chip Select to address the PIA. At that
moment, the R/W line is low, showing a write. The RS lines show
the register selected in the PIA (0). The databus contents is
0xFF (DATABS line). So this is a write by the CPU into register 0
with the data 0xff. You can see that shortly after the falling
edge of the E clock, the Data and control lines change, marking the
point where the CPU is doing the next bus transaction.
Interconnection with sound board (click for big image).
above diagram shows how the System 11 Sound board connects to the test
setup. Both the D-11581 and the D-11298 sound boards interconnect with
the same harness set.
Power 'Tee' for the sound board
made a special 'Tee' cable to provide a power tap for the sound board.
It is shown in the photo above, partially demated to show the
construction. The top colored ribbon goes to my CPU tester,
the grey is to the sound board. The black plastic is a double
male (board type) connector that allows the top connector to plug into
the top of the middle one.
1J21 command simulator with a Jokerz sound board.
1J21 connector on the CPU board sends sound/music commands to the
external sound board, and I built a small command generator (shown
above) to be able to test without a CPU board. All that is
is the conventional 5/12/-12V supply. With the logic
can see the byte sequence to send, and the board can be completely
tested with this small fixture.
Schematic of sound board command generator. Just some switches and a pull up resistor pack RP1.
Video is in the image below.
One issue with testing sound boards is that quite often they require
multiple AC voltage sources that are stacked to form Center
For example, the pre-DCS WPC audio board needs 24Vac that is
Center Tapped. Using the discarded transformer from a large
I was able to put together a supply that offers great flexibility.
Multi-output transformer from an old UPS. My trusty variable
transformer (blue box) is in the background.
know that one winding of this transformer was designed for 120Vac, so
we can use that as the primary. It was now a question of what
other winding ratios this transformer had and if any are in the useful
An important tool for this kind of investigation
is a variable tranformer like the one you see in the image above (blue
box). It allows you to gradually raise the line voltage for
I first started by measuring the inductance of all
the windings and using a DVM to see which windings were isolated.
The primary needs to have an inductance of at least several
hundred mH. This will keep the quiescent magnetizing
down to reasonable levels. Once that is determined, I applied
output of the variable transformer to this winding with a current meter
in series. I could see less than 10mA of current flowed once
cranked the voltage up to the full 120V (make sure all output wires are
not touching). Now that the transformer could be safely
from line voltage, it is a simple matter of measuring the output
voltage and phasing on all the other windings. I then mounted
barrier strip to the transformer and wired everything to it for easy
access. The 120V leads are terminated with the white pair
above, which lead to a 120V power plug. Incidentally, this
plug is from a discarded Christmas lighting set which has two
integrated tiny fuses. I then stacked the resulting five
to get me a variety of outputs depending on which taps I used.
know can have 20VCT (20Vac total, Center Tapped), 16VCT, 56VCT, and
many other assymetric combinations. This will come in very
in future audio board tests.
Testing plasma display boards
Plasma display board being tested.
above video shows a System 11A alphanumeric display board being checked
out along with its associated power supply board. The segment
control lines for both display rows have been jumpered to +5 (all
segments lit), and I select one column at a time by jumpering to one
pin at a time on J3 and J4. With my variable transformer I am
able to apply the minimum of voltage to light the display digit.
Since I am not strobbing, I wanted to make sure I did not
overstress the display by applying too much power.
Display Data Tester
System 11 displays have two rows. The top row is
thus it is able to display numbers as well as the complete alphabet.
The bottom row is numeric only for 11A and B, but
for 11C. Each row is 16 digits wide, so a total of 2x16 of
display data. My
desire for this tester is to display a particular row and column to
isolate what is
happening with the control lines. This examination and use is
convenient to do with the high-voltage displays, and I thought it would
be too expensive to buy both types of LED displays as diagnostic tools
(about $300 each). I decided to make a single digit
display. I could then use it to display the information in a
particular row and column of the larger display.
The display data tester
connected to a System 11A board.
"HIGHEST SCORES" is being output by the board
and the first two columns are displayed.
The columns are selected by the blue/green jumpers.
started the project by looking for an inexpensive single digit
alphanumeric LED display, but found that it was cheaper to buy them as
twin digits. In looking at the schematics, it was also clear
the easiest thing to do would be to show both the top and bottom digits
of the selected row(s). The user is able to select which two
columns of the 16 to display.
The image above shows the
completed tester. It connects to 1J22 and 1J3 for the segment
information, and the two columns selected for display is controlled by
connecting the blue and green jumpers (connecting to 1J1 for the left 8
digits and 1J2 for the right 8). It can work for any System
board but it requires the changing out of four of the chips to go from
11AB to 11C. This is due to the data difference between the
generations of boards. System 11C board have all their
data inverted from the previous generations.
The video below shows the display scrolling "HIGHEST SCORES".
Display Data Tester isolates the data from two of the 16 columns of the
The flashing is because this video is being played in slow motion.
also built a test setup for the System 9/11 power supply boards.
They include an AC multi-output transformer (left) for
the low voltage sections, and a connection to my variable transformer
for the high voltage circuits. This latter arrangement allows
to turn the input voltage up gradually to prevent damage in
of a fault, and allows me to check how well the board regulates the
output high voltage. These plug into the unusual 3x4 pin 3J1
Checking out the
solenoid circuits for safe power up
to the high power circuits they contain, pinball machines can sometimes
require great care when powering up an unknown machine or
configuration. One such situation is the solenoid power.
a playfield switch is shorted closed (along with possibly an incorrect
fuse), power could be enabled continuously to a number of solenoids.
The result can be melted coils, burned components, or even a
fire. I have repaired numerous boards that have complete
burned into them. I have always thought that it would be good
easily put in a way to checkout a newly acquired machine. One
would be to replace the solenoid circuit fuse (F2) with another
component that increases its resistance if current through it is
increased. After some thinking about it I realized that
incandescent bulbs do this, and I decided to try this idea.
checked what I had in storage and found that the #89 is the highest
voltage bulb I have. It is rated for 13V and draws 0.58 Amps
that voltage. This is a resistance of 22.4 ohms at full
brightness. However, when cold I measured only 1.7 ohms.
That is an increase of better than 10x! Since the
voltage is about 30V on Space Shuttle, I decided to use two #89s in
series and assembled the prototype with some alligator clips.
Test lamps in place of F2.
the original 2.5 Amp F2 in place, I measured about 0.27 Amps
standby current on solenoid power. Actuating a pop bumper
4.2 Amps of steady state current. Since the fuse is
this would have to persist a few seconds before blowing it. I
able to keep the coil on for two seconds without blowing the fuse.
The unloaded solenoid bus measured 30.8V, and the pop bumper
measured 3.8 ohms on my testbench.
I then removed F2 and clipped
the bulbs in. The standby current through the bulbs (in
diagnostic mode) was enough for them to glow. I measured
0.23 Amps and 4.6V across the bulbs. So that is 10 ohms per
Placing the machine into coil test allowed me to tell that
solenoids do pull in, but the larger ones do not. Coils such
the slings produced a weak movement, so can still tell they are being
pulsed. When they do, the lamps light up brightly.
same pop is turned on, the current through the bulbs goes to 0.54 Amps
and there was 21.6V across them, or a resistance of 20 ohms per bulb.
I am quite sure that no harm would come to any circuit with
kind of steady state current.
Video of test lamps in use.
system should work for board sets that use 30V solenoid power such as
System 9, System 11, and System 11A. So to use this system,
sure the lamps are not brightly lit unless a coil is intended to be
fired. Once you have that condition, it should be safe to put
actual fuse in for F2. In review, I think I would have liked
slightly higher current, such as around 1 Amp. That would
a total resistance of 25 to 30 ohms for the lamp(s).
like a #315
might be closer to optimal. This is rated for 28V/0.9 Amp/25
early System 3-7 CPU boards use 2532 ROMs. These are similar
2732s except for a slightly different pinout, and were originally
made by TI. My PROM programmer, the Dataman S4,
does not have an entry for the 2532, so I decided to make adapters to
program these ROMs. I used a wire-wrap socket and a
socket stacked on top of each other. This is shown on the
the image below. I found that using the Toshiba setting for
2732 worked best on my Dataman.
Adapters to allow a 2532
to be plugged into a location for a 2732 (left)
and using a 2732 into a location meant for the 2532 (right).
I was making the adapter anyway, I decided to make the reverse adapter.
Namely one that allows the use of a 2732 ROM in an
requiring a 2532. That is shown on the right above.
A note on System
9 to 11 conversions (sound)
In July 2016, Joe George sent me his findings on using a System 11 in a
my System 9 CPU Board quit working, I converted a base System 11 board
in System 9 following the instructions at the end of the System 9
Troubleshooting Guide I found at http://gamearchive.askey.org/Pinball/Manufacturers/Williams/pdfs/pinball_troubleshooting_sys9.pdf.
It turns out though the memory map in the manual is wrong. It implies
4 2732 speech ROMs would be stacked in order (U4, U5, U6, U7) into a
for the System 11 Sound ROM at U22. However, the memory map is wrong,
some reason the Space Shuttle manual I have doesn’t include a schematic
speech board, so I couldn’t tell that the conversion doc was wrong.
found a Speech board schematic in the manual for Sorcerer and it said
memory address space was occupied by (in order) U7, U5, U6, U4. I
4K speech ROM images I had from the speech board in that order and
27128 ROM, and my speech works great now!
ROMs for System 3-7 In December 2019 I found this ROM set for testing various
One set focuses on the System 3-7 series and consist of a set
about two dozen ROM images. The original intention was to
ROM for each test and put that into the IC17 spot on the board to run
the test. I immediately thought of building an adapter board
DIP switches to select the test. Reading further I saw that
had designed a board for this purpose.
This design accomodated up to 16 types of tests, but the
of the ROM series had since increased the number of tests to about two
dozen, requiring an upgrade to handle up to 32 tests.
board design by 'barakandl' made me wonder if a conventional perf board
(with predefined traces) could work reall well and I decided to try and
build a board.
Original design by barakandl shows many horizontal connections.
made me wonder if a perfboard with bars would make the job easier.
Indeed all I needed to do was to cut two of the bars (near top left)
and a standard perf board will do the job. On the left are the
double ended male pins I use to build adapter boards.
Board completed. The double ended male pins are sticking up
out of the image and plug into some extender sockets and then
into the System 3-6 board under test.
On the 'top' side of the board I mounted a socket for the 27512 PROM
and the five DIP switch module to select which of the 32 test pages
each original 2316 ROM was 2Kx8, and we want to be able to accomodate
up to 32 of these ROM images, we would need a 64kx8 ROM, which happens
to be the 27512. In looking through my parts bins I saw I had
the parts, and completed construction of the above adapter in one
I next had to obtain the image of the PROM, and I downloaded the
package from the pincoder.ca
web site. The lowest slot or "00000" of the combined ROM is
for the original IC17 image from Williams but wide distribution of that
would probably violate copyright rules, and is why it is not included
in the download. So I copied the bytes over from an original
and combined it into the file from pincoder. In the future, I
will make this available here via a link.
After correcting a
small error in the board, the combined test ROM worked like a champ.
On a known-good System 3 board, I could boot into the
functions by setting the DIPs to 00000, and then execute Test 1, which
is the LED alternate flash test.
Other CPU Testers
These are Ebay auction
prices and photos I have gathered over the years on these
testers. The Williams factory appeared to have made three
kinds of board testers. One for System 3-7, the second for
System 11 (and 9?), and two WPC testers (WPC89 and WPC95).
February 2006, this System 3-7 tester (6253871562)
Close-up of the control panel of the above tester.
Feb 2006, this System 11 tester (6254290420)
It looks home-made.
Close-up of the test panel. Note lack of solenoid and lamp
Feb 2006, this System 3-7 unit (6255704954)
Closeups of the test panel.
August 7, 2006 - First unit sells with BIN on ebay for $500
July 2, 2007 - Case #6
Conversion to MOSFETs for the high-side lamp matrix driver.
This board was bought on Ebay for $35 (+$15).
August 2009 - As of this date, I have successfully repaired
more than 50 System 9 and 11 boards. I am glad to say that
despite the varied challenges (battery leakage, burns, failed parts,
etc), I have not failed to repair a single one. That is about
one board per month since 2005.
August 2009 - Made adapter
board to easily connect Logic Analyzer to a 6802/6808 CPU