Sunday, 4 May 2014

Timex contended memory timings, the TS2068 kludge board and EXROM at $4000 - $7FFF (continued)

This is a follow up post explaining the results of my oscilloscope investigation and my theories about how the TS2068 works.

The TS# signal is low most of the time, only going high to allow the SCLD to access the VRAM for drawing the screen. This means most of the time the line driver U5 and bus transceiver U9 are enabled. They're disabled for the SCLD video accesses. These accesses take the form of 16 square wave pulses in succession, then a period with no pulses (TS# low) in the time taken for 12 pulses, for each of the 192 lines on the screen, then no pulses at all for the next 70 lines.

The 2 ROMs and 3 banks of DRAM are selected by signals coming from the SCLD (ROMCS#, EXROM#, CAS1#, CAS2#, CAS3#) so that only one is selected at once, whether to accept a value from the data bus (for a CPU write cycle) or to put a value onto the data bus (for a CPU read cycle). For the CPU to read the video memory, the direction of bus transceiver U9 has to be changed so that data can pass from the SCLD/VRAM data bus onto the CPU data bus. There is an extra read signal coming from the SCLD, also called RD# according to the schematic in the Technical Manual, which drives the direction input on the bus transceiver. This read signal is asserted in the range $4000 - $7FFF. Outside that range the bus transceiver drives in the opposite direction (CPU data bus onto SCLD/VRAM bus).

This scheme falls down when other devices assert the data bus in the range $4000 - $7FFF. Although CAS1# won't be asserted (so that the video memory won't drive a specific value onto the SCLD/VRAM data bus), the bus transceiver U9 will still try to assert the CPU data bus with whatever is on the SCLD/VRAM data bus. The fix used by the Timex engineers was to deassert TS# when accessing cartridge memory or bus expansion memory. This ensures that both U5 and U9 are disabled.

The fix takes the form of a 74LS00 chip U21 and some diode/resistor logic on a mini printed circuit board mounted above the vias for U5. U5 is actually mounted on the mini PCB along with U21 and the board connects to the main PCB through the vias for U5. The SCLD signal TS# connects directly to the mini PCB along with MREQ#, ROSCS# and BE#, and the modified version of TS# is used to drive U5 on the mini PCB and U9 on the main PCB.

Looking at the modified version of TS# on an oscilloscope, the regular groups of 16 pulses coming from the SCLD TS# have a wide voltage swing (from ground to +5V), suggesting the SCLD is built using CMOS logic. The pulses coming from U21 have a lower voltage swing (from ground to a bit less than +5V), because U21 is built using TTL. The modified TS# signal drives two TTL logic devices which will accept both forms of logic high.

The fix doesn't apply when the CPU is accessing EXROM in the range $4000 - $7FFF, so U9 will still try to assert whatever is on the SCLD/VRAM data bus onto the CPU data bus. The EXROM chip will also try to assert the CPU data bus and you have a bus conflict - the value on the data bus can't be guaranteed.

Timex contended memory timings, the TS2068 kludge board and EXROM at $4000 - $7FFF

This was first posted on the World of Spectrum hardware forum.

I haven't seen this documented anywhere yet so I thought I'd share my findings. I've been investigating contended memory timings on the Timex Sinclair 2068, in particular what happens when you page in EXROM or cartridge memory in $4000 - $7FFF.

It appears the Timex SCLD still applies memory contention at these locations when the RAM is paged out. I've written a short program which plays beeps using a machine code routine which steps through $4000 - $7FFF making a memory access at each location during the beep timing loop.

When this program runs it plays the same modulated tone regardless of the setting of port F4 bits 2 and 3. When the program steps through $0000 - $3FFF or $8000 - $FFFF you get a higher, pure tone also regardless of the setting of port F4 bits 0 and 1 or 4 - 7.

So the Timex SCLD pays no attention to bits 2 and 3 in port F4 when applying memory contention; contention is applied whether the CPU is accessing contended video memory or "uncontended" ROM in the EXROM socket or the cartridge port. So we might as well call this "contended ROM".

This solves one other small mystery - the kludge board in every TS2068. Like the dead cockroach it consists of a 74LS00 quad 2-input NAND gate chip; however it is not there to fix I/O contention.

Timex SCLDs can be thought of as a modification of 5C112E ULAs. They have the fixed I/O contention of the 5C112E and the same sync pulse and colour burst timing. You get a nice, centred picture, at the expense of the display not working on some televisions because the colour burst comes too late.

The problem with the SCLD seems to be the tristate signal (TS#) which is used to put the Z80 multiplexed address bus and data bus onto the SCLD/VRAM buses. This signal should go low during memory accesses to $4000 - $7FFF but only when (HOME) RAM is enabled at those locations.

From the design of the kludge circuit it seems that TS# coming from the SCLD goes low at those addresses whether the RAM is switched in or not. The kludge circuit fixes this for the cartridge port and the Bus Expansion unit (BE# signal on the edge connector) but not for the EXROM. Otherwise the CPU would read or write to the VRAM at those addresses as well as the cartridge memory or bus expansion device. For reads there would be a conflict on the bus with two devices trying to assert the bus; for writes both devices would receive the written value.

Curiously the kludge circuit does not fix the problem for the EXROM. Presumably this was because the Timex engineers felt that no-one would ever page EXROM in at $4000 - $7FFF, or at least not usefully. The EXROM chip in the standard machine is only 8K long and is written for $0000-$1FFF. If the EXROM is selected at $4000-$7FFF, it will conflict with the VRAM at the same locations when those locations are read.

The Timex Sinclair 2068 cannot reliably access EXROM between $4000 - $7FFF.

Update:

I need to do a little more investigating, this time with an oscilloscope. I'm pretty sure TS# is low during memory accesses to $4000 - $7FFF with EXROM paged in, but I'm not sure what happens to the VRAM signals RAS1# and CAS1#.

Second update:

I did an investigation using an oscilloscope today. Results will be explained in a follow up post.

Monday, 25 November 2013

ROM image for BASIC Level 3 with 24K on the Tototek SMS-PRO 32M flash cartridge

At the end of the previous post I mentioned that the Tototek SMS-PRO flash cartridge doesn't support bit 4 of memory location FFFCh in the 315-5235 mapper - that's the bit that enables 16K of RAM at $C000 - $FFFF once the Master System's 8K internal RAM has been disabled. Therefore, the best way to run BASIC Level 3 on the Tototek cartridge is to enable 16K of RAM at $8000 - $BFFF and leave the internal 8K of RAM enabled at $C000 - $DFFF. This is a ROM image that does exactly that. I have tested it on my Tototek cartridge and it runs BASIC Level 3 exactly the same as my home built ROM and RAM cartridge, with 18428 bytes free on the startup screen. The patch code is:

0000    3E08    LD A, 08h
0002    32FCFF    LD (FFFCh), A
0005    C30068    JP 6800h

instead of

0000    C30068    JP 6800h
0003    FF FF FF FF FF

This, combined with the export header, removal of the checksum jump and patch for 24K memory detect routine, allows BASIC Level 3 to run on the Master System using the Tototek cartridge.

Sunday, 24 November 2013

EPROM images for BASIC on the Sega Master System

Here are the images I've used for running BASIC on the Master System.

Sega BASIC Level 2 (SC-3000) export header checksum removed.sms

Sega BASIC Level 3 V1 (SC-3000) export header checksum removed.sms

Sega BASIC Level 3 V1 (SC-3000) export header checksum removed 24K.sms

The first of these is BASIC Level 2 with the export header added and the jump for the checksum routine removed. This image runs as BASIC Level IIA with 515 bytes free on a machine with 2K (or more) internal RAM at $C000 - $FFFF, and as BASIC Level IIB with 2043 bytes free on a machine with 2K (or more) RAM at $8000 - $BFFF in addition to the RAM at $C000.

639C    C20963    JP NZ, 6309h // checksum first 32K - check bottom 8 bits of result is 0, jump to one beep error routine if not

becomes

639C    00    NOP
639D    00    NOP
639E    00    NOP

Header

7FF0    54 4D 52 20 53 45 47 41 20 20 A9 65 00 00 00 4C

The second is BASIC Level 3 with the export header added and the jump for the checksum routine removed. This image needs 16K of RAM at $8000 - $BFFF, and will run with 16K, 18K or 32K depending on how much RAM it finds at $C000 - $FFFF. It will run with 10236 bytes free if it finds no RAM at all at $C000, with 12284 bytes free if it finds 2K RAM at $C000 - $C7FF and with 26620 bytes free if it finds 16K RAM at $C000 - $FFFF. Those are the only possibilities it looks for. This image doesn't run on a Master System with 8K RAM at $C000 - $DFFF, because the RAM size detect routine only checks for a 2K SRAM at $C000 - $C7FF. Once that test passes, the routine assumes the machine has a full 16K RAM in $C000 - $FFFF and goes on to fail another memory test on the 8K mirror at $E000 - $FFFF.

689C    C20968    JP NZ, 6809h // checksum first 32K - check bottom 8 bits of result is 0, jump to one beep error routine if not

becomes

689C    00    NOP
689D    00    NOP
689E    00    NOP

Header

7FF0    54 4D 52 20 53 45 47 41 20 20 06 20 00 00 00 4C

The third is BASIC Level 3 with the export header, the checksum removed and the RAM detect routine modified for 8K of RAM at $C000 - $DFFF. This provides 24K of RAM in total for BASIC, and displays 18428 bytes free on the startup screen.

68F5    11FFC7    LD DE, C7FFh // check for RAM at C800h, de = last byte of RAM C7FFh

68FB    26C8     LD H, C8h // now try hl = C800h

becomes

68F5    11FFDF    LD DE, DFFFh // check for RAM at E000h, de = last byte of RAM DFFFh

68FB    26E0    LD H, E0h // now try hl = E000h

Header

7FF0    54 4D 52 20 53 45 47 41 20 20 36 20 00 00 00 4C

I have now also tried running a patched image of BASIC Level 3 that accesses port 3E and memory location FFFC on the Tototek flash cartridge. The idea here, assuming the Tototek cartridge emulates the 315-5235 mapper fully, is to disable the internal RAM and enable 32K of cartridge RAM, the first 16K at $C000 - $FFFF in place of the internal RAM, and the second 16K at $8000 - $BFFF. This used the following additional code:

0000    3EBB    LD A, BBh
0002    D33E    OUT (3Eh), A
0004    3E1C    LD A, 1Ch
0006    32FCFF    LD (FFFCh), A
0009    C30068    JP 6800h

instead of

0000    C30068    JP 6800h
0003    FF FF FF FF FF FF FF FF FF

Unfortunately the Tototek cartridge doesn't implement all of the 315-5235 mapper's functionality. 16K RAM appears at $8000 - $BFFF (bit 3 of FFFCh) but nothing appears at $C000 - $FFFF (bit 4 of FFFCh) once the internal RAM is disabled (using bit 4 of port 3Eh). BASIC does run but only detects 16K RAM.


It would be better to leave the internal RAM enabled and use the 24K patch to run BASIC Level 3 on the Tototek cartridge with the same 18428 bytes free as in the home built ROM and RAM cartridge.

Saturday, 23 November 2013

BASIC on the Sega Master System

I decided to do some hacking on the Sega Master System, to see if I could get it running BASIC. It has long been a dream of mine to program the Master System. When I first got my Master System in 1992, I saw it as an upgrade on the ZX Spectrum I previously used, the kind of upgrade on the graphics I had wanted since the Spectrum 128K came out in 1986. I didn't know anything about the differences between the two machines back then, about sprite graphics, hardware scrolling, tile mode versus bitmap mode graphics, but the Master System taught me about those.

In principle it should be very simple running BASIC on the Master System. The Master System is backwards compatible with an earlier console called the SG-1000 and a home computer called the SC-3000. Versions of BASIC exist for both the SG-1000 with SK-1100 keyboard attachment and the SC-3000.

However, the Master System I have is a UK PAL version, referred to by Sega in their documentation as an Export version, and that has a completely different cartridge slot from the Japanese models. Furthermore, the BIOS in export Master Systems checks for the presence of a ROM header in the last 16 bytes of a cartridge, checks that the ROM is intended for export Master Systems and performs a checksum on the ROM. Domestic (i.e. Japanese) Master System cartridges and all SG-1000 and SC-3000 cartridges (whether domestic or export) do not contain this header.

Thus, my UK PAL Master System will not run SG-1000 BASIC Level 2 or SC-3000 BASIC Level 3 images without some hacking.

First I tried running BASIC Level 2 and BASIC Level 3 images in my Tototek flash cartridge. The Tototek DreamWriter software had problems identifying the ROM images; it seems it too was relying on the header information, and the lack of a header in the ROMs was causing DreamWriter to make incorrect assumptions about the images.

So first I tried patching the images using a hex editor to include a correct export version header. This would be something like:

54 4D 52 20 53 45 47 41 20 20 -- -- 00 00 00 4C

where -- -- is the checksum of the image (from $0000 - $7FEF for 32K ROMs) in little endian format.

Well this worked for the DreamWriter software, and I was able to load BASIC Level 2 and BASIC Level 3 into my flash cartridge, correctly recognised as 32K ROMs. These ROMs would now start in the Master System, but they didn't get as far as the Ready prompt. BASIC Level 2 would give a black screen with a repeating single beep error code and BASIC Level 3 would give a black screen with a repeating double beep error code.

So I disassembled the two ROMs and found the cause of BASIC Level 2's single beep. There is a checksum routine in the code of BASIC Level 2. It sums all the contents of the ROM from $0000 to $7FFF and checks that the least significant byte of the result is zero. Looking at the final 16 bytes of the ROM before I inserted the header, most of the unused bytes in the ROM are FF but the final byte in the ROM is something else - 38h. This was clearly intended to make that checksum byte equal zero.

Since there's already a checksum operating on this ROM at BIOS level now, I decided to remove the jump for this now redundant checksum and after updating the checksum in the header to account for this change to the ROM, the BASIC Level 2 image would now run in my flash cartridge, giving the following startup screen.



The 32K ROM now works fine and the image runs as a BASIC Level IIA cartridge, with 2K internal RAM at $C000 - $C7FF.

I couldn't get BASIC Level 3 to work, however. Even with the checksum jump patched out and the correct header in place, it would fail with a two beep error code. So I studied the BASIC Level 3 RAM checking routines and I found one of the first things BASIC Level 3 does is set the stack pointer to 8B30h. A few instructions later it does some stack operations and checks to see that the stack can be written to and read from properly. If this fails, then it jumps to the two beep error code routine.

So BASIC Level 3 expects to find, and indeed relies on, RAM at $8000 - $BFFF. I decided to build a cartridge to support BASIC Level 3, using a game cartridge PCB, a 27256 EPROM and a 62256 SRAM. I used a Miracle Warriors PCB, mainly because it provides two sockets, one for the ROM and one for the RAM. Using the pinout diagrams now available on www.smspower.org I worked out that there were four pins that needed changing on the ROM socket and four on the RAM socket. I took out the battery and battery backup circuit, made three PCB track cuts and made the new connections with wire. A 74LS32 quad 2 input OR gate was used to decode the address ranges for the EPROM and SRAM. The EPROM goes at $0000 - $7FFF, fortunately there is a signal M0-7# on the cartridge slot which goes low in this address range when MREQ# is low. I combined this with the chip enable pin for that cartridge slot, CE3#, using one of the OR gates and applied the result to the CS# pin on the EPROM. I connected the output enable pin OE# to RD# of the Z80 processor. For the SRAM I used the address range $8000 - $BFFF and the signal M8-B#. This was combined with CE3# in the same way and the RAM socket already had OE# connected to RD# and WE# connected to WR#.



The Japanese version of the Master System / Mark III and the SC-3000 computer all have a signal on the cartridge slot called CSRAM# which allows the internal SRAM in the console to be disabled. That's how BASIC Level IIIB disables the internal 2K SRAM of the SC-3000 in the $C000 - $FFFF address space and puts 16K DRAM in that space. The export Master System has no such signal on the cartridge slot; instead the internal 8K RAM in that address space can be disabled by writing a bit to I/O port 3Eh. However, this requires that any cartridge that wishes to put RAM in that space has a 315-5235 mapper chip, so that the cartridge RAM can be enabled only once the internal RAM has been disabled.

My simple EPROM and SRAM cartridge has no mapper chip and so half of the 32K SRAM is unused in this design. BASIC has access to RAM at $8000 - $BFFF from the cartridge and at $C000 - $DFFF from the internal RAM (mirrored at $E000 - $FFFF). This comes to a total of 24K, higher than the 18K of BASIC Level IIIA but lower than the 32K of BASIC Level IIIB. The machine actually has 40K of RAM in total, but only half of the 32K SRAM is accessible.

I tried this cartridge with a BASIC Level 3 ROM image burnt onto an EPROM and it still failed with a two beep error code so I tried an SMS Boot Loader EPROM I had previously burnt and that worked fine so confirming that the address decoding for the EPROM worked okay. Next I tried a BASIC Level 2 ROM image and got this screen:



This is the startup screen for BASIC Level IIB. Having now studied the RAM checking routines in BASIC Level 2, it looks for 2K of RAM between $C000 - $C7FF and 2K of RAM between $8000 - $87FF. It runs as BASIC Level IIB (with 2043 bytes free) if it finds both and as Level IIA (with 515 bytes free) if it only finds the latter. It fails with a two beep error code if it doesn't find any RAM at all, and with a three beep error code if the 16K VRAM is not working properly.

So both my EPROM and SRAM address decoding were working fine. I wondered if the different RAM size in my design versus the original BASIC Level IIIA and IIIB cartridges was causing the problem so I examined the BASIC Level 3 RAM checking routine and sure enough, it had been hard coded to write to RAM at $C000 and then at $C800, and see whether separate results could be stored at those two locations. If they could, it assumed it was running on a 32K RAM machine and if they couldn't, it assumed 18K RAM. My 24K system was passing the test at $C800 and so BASIC Level 3 was assuming a 32K machine and failing another memory test later on. So I modified the code to check $C000 and $E000 instead, for 24K RAM, and finally BASIC Level 3 booted.


In conclusion, for now at least, I have a 24K version of BASIC Level 3 running on my Sega Master System. I still need to put together a keyboard to type on this system; for now you can type a few characters on the 12 switches of two control pads, but it really needs an SC-3000 keyboard with an Intel 8255 PPI chip and a 74LS145 open collector decoder/driver to read the keyboard properly. I have some ideas about how to build one of these reversibly out of an SC-3000H computer and connect it to this Master System which I will try next. I also have some ideas about doing some more ROM hacking to BASIC Level 3 to get my Tototek flash cartridge to recognise it as a 32K ROM 32K RAM cartridge with the 315-5235 mapper hardware emulated at the appropriate addresses.

Sunday, 10 November 2013

EPROM images for switchable Timex Sinclair 2068 modification

These are the images for the EPROMs used in the switchable TS2068 modification.

Switchable TS2068 27256.rom

Switchable TS2068 27128.rom

The Timex halves of the two EPROMs are completely standard TS2068 ROM images. The Spectrum half of the HOME EPROM is a very slightly modified version of the Spectrum ROM, modified to reset port 0xF4 and 0xFF on startup. The Spectrum half of the EX EPROM is a very slightly modified version of the Timex EX ROM, modified to jump to the START-NEW location in the Spectrum ROM on startup instead of the Timex HOME ROM location.

These modifications are necessary to ensure that the computer starts up every time reliably when in Spectrum mode. Unfortunately it is not possible to boot reliably on a TS2068 from a 100% exact Spectrum ROM.

In the Spectrum 48K half of the 27256 EPROM image, the standard Spectrum 48K ROM is patched as follows:

11D0    3E 3F    LD A, 0x3F
11D2    ED 47    LD I, A
11D4    00    NOP
11D5    00    NOP
11D6    00    NOP
11D7    00    NOP
11D8    00    NOP

becomes:

11D0    AF    XOR A
11D1    D3 F4    OUT (0xF4), A
11D3    D3 FF    OUT (0xFF), A
11D5    3E 3F    LD A, 0x3F
11D7    ED 47    LD I, A

In the Spectrum 48K half of the 27128 EPROM image, the standard TS2068 EX ROM is patched as follows:

0057    C3 31 0D    JP 0x0D31

becomes:

0057    C3 CB 11    JP 0x11CB

Switchable Spectrum 48K / Timex 2068 ROM for Timex Sinclair 2068

I have just finished a switchable TS2068 / Spectrum ROM modification and implemented it on two TS2068s. It uses a 32K EPROM chip for the HOME ROM and a 16K EPROM chip for the EX ROM. The channel 2 / 3 switch on the underside of the case is re-purposed as a ROM select switch. It controls the upper address bit on the two EPROMs.

The Timex halves of the two EPROMs are completely standard TS2068 ROM images. The Spectrum half of the HOME EPROM is a very slightly modified version of the Spectrum ROM, modified to reset port 0xF4 and 0xFF on startup. The Spectrum half of the EX EPROM is a very slightly modified version of the Timex EX ROM, modified to jump to the START-NEW location in the Spectrum ROM on startup instead of the Timex HOME ROM location.

These modifications are necessary to ensure that the computer starts up every time reliably when in Spectrum mode. Unfortunately it is not possible to boot reliably on a TS2068 from a 100% exact Spectrum ROM.

--

The motivation for putting a Spectrum 48K ROM in a Timex Sinclair 2068 is to be able to run Spectrum 48K software. Whereas there are probably less than 100 Timex Sinclair 2068 programs, there are more than 10,000 Spectrum 48K programs. The Spectrum 48K ROM is also somewhat faster than the Timex Sinclair 2068 ROM and has fewer bugs. It therefore provides a good platform for exploring the TS2068's extra video modes.

To perform the modification, the components connected to the channel 2 / 3 switch need to be removed and the switch re-used as a ROM select switch. Take the TS2068 apart by undoing the seven case screws on the underside of the machine and unplugging the keyboard membrane from its header on the PCB. There are two sizes of case screw so preserve where each screw went. Then undo the three screws holding the PCB onto the bottom half of the case and take out the PCB. Take the cover off the RF modulator shield and examine the inside.

Remove C46, R57 and R56 by desoldering them from the PCB and removing them with pliers. These three components are connected to the channel 2 side of the switch. and are in a line in the top left corner of the shield to the right of the solder pads for the switch itself. Leave C47 in - this will provide a useful anchor point to connect +5V to on the underside of the PCB (the solder side). Remove R28 and R24. These are the next two components down after C47. Finally, remove R58. This is the component to the left of the bottom pin of the channel switch.


Solder a link wire in the pads where C46 used to be. This connects the channel 2 side of the switch to GND. I used black plastic covered wire to indicate that this wire is at ground potential. On the underside of the PCB, solder another link wire between the side of C47 connected to the switch and a +5V point. This connects the channel 3 side of the switch to +5V. Looking at the underside of the PCB, it is the leg of C47 on the right. A suitable +5V point to use is the top leg of Q2 - this has a thick trace snaking away from it to the left and down.


Now the switch provides +5V or GND, the next step is to take this signal to the ROM sockets and reconfigure them for EPROMs instead of mask ROMs.

On the standard machine, jumpers W1 and W2 are fitted in the centre of the PCB. This connects MREQ# to CS# on the HOME ROM and ROMCS# to pin 27 of the HOME ROM. The mask ROM in the standard machine has an output enable pin at this location. The ROM is decoded by three signals, MREQ# connected to CS#, ROMCS# connected to OE1# and RD# connected to OE0#.

In the modified machine, a 27256 EPROM is used for the HOME ROM. Pin 27 becomes A14 which is connected to the channel 2 / 3 switch. ROMCS# is connected to CS# (pin 20) and MREQ# is connected to OE# (pin 22).

Remove jumpers W1 and W2 and solder a link wire between the bottom left pad and the top right pad. This connects ROMCS# on the bottom left to CS# (pin 20 of the HOME ROM) on the top right.

Solder a wire from the pole of the channel 2 / 3 switch to the bottom right jumper pad. This connects the new ROM select signal to A14 of the new HOME EPROM (pin 27).

On the underside of the PCB, cut the track between pins 26 and 27 of the EX ROM socket. On the component side of the PCB, cut the track leading from pin 26 of the EX ROM socket to the left. On the standard machine this carries RD# to pins 26 and 27 of the EX ROM. The track is best cut just below the text for C43 on the PCB, where it emerges between a pair of vias.


In the modified machine, a 27128 EPROM is used for the EX ROM. Solder a wire from pin 27 of the HOME ROM socket to pin 26 of the EX ROM socket. This connects the new ROM select signal to A13 of the new EX EPROM.

Solder a wire from pin 28 of the HOME ROM socket to pin 1 of the same socket. Solder a wire from pin 28 of the EX ROM socket to pin 1 of the same socket and to pin 27 of that socket. These wires carry +5V from pin 28 (Vcc) to pin 1 (Vpp) of the EPROMs and also to pin 27 of the EX EPROM (PGM#).


Next, cut the track above and to the right of the top right jumper pad. In the standard machine this carries RD# to pin 22 of the HOME ROM. Solder a wire from the top left jumper pad to pin 22 of the HOME ROM socket. This connects MREQ# to OE# of the new EPROM.


Now the machine is ready for the two EPROMs. Remove the original Timex mask ROMs from the two ROM sockets and install a 27256 EPROM programmed with the file "Switchable TS2068 27256.rom" into the HOME ROM socket. Install a 27128 EPROM programmed with the file "Switchable TS2068 27128.rom" into the EX ROM socket.

Test the machine at this point by connecting a power supply and a composite video display to the PCB and turn the power switch on. It should boot up in one of the two modes, Spectrum 48K or Timex Sinclair 2068, depending on which position the channel 2 / 3 switch is in. Spectrum 48K mode is the channel 2 position and Timex Sinclair 2068 mode is the channel 3 position. You can mark the case to this effect if you like.


Assuming all is well, put the PCB back in the lower half of the case, put the PCB screws back in, reconnect the keyboard and put the case screws back in. Enjoy your switchable Timex Sinclair 2068 in its original mode and in its new Spectrum 48K compatible mode.