Subject: TECH: Inside Bally's "Squalk and Talk" (AS2518-61) module (long!).
From: Clive Jones <[email-masked]>
Date: Wed, 24 Jul 96 14:07:00 PDT
Newsgroups: rec.games.pinball

Hi Chaps

Well, it's been a few months since I wrote a technical article for the   
group, so in looking for a suitable subject to cover, and, I haven't yet   
done anything on sound generation, we have todays offering - Bally's   
AS-2518-61 "Squalk and Talk" module.

Your probably going to need schematics to follow what I'm about to tell   
you otherwise you might get a little lost - you have been warned!!! This   
article assumes that you know something about how microprocessors work,   
if you do not, then go to the rec.games.pinball search database and pull   
one of the previous articles I wrote entitled "Understanding   
Microprocessors in Early Solid State Games", - search for "clive and   
microprocessor" (at this time the search engine is still down).

We're really going to tear the Squalk and Talk board apart with this   
article - so get ready for some heavy "tech-talk".

BTW, there are a number of references to "hair" in this article - sorry   
if I upset any of you "slap-heads" or "baldies" out there. :)

Before I start, I would like to thank fellow Englishman, pinball partner   
and RGP'er Pete Clare (who isn't bald) for providing the data sheets on   
the TMS5200, TMS6100 phrase ROM and the AY3-8912 PSG which saved me from   
pulling half my hair out! [hair ref.#1]

<<DISCLAIMER>>
This has been the most challenging technical article I have yet written   
for the group. The main problem being that both the MPU board game code   
and the Squalk and Talk code changed for every game that Bally made with   
the board fitted along with a few software "mysteries". Without actually   
hacking every peice of game/sound  code and having access to every Squalk   
and Talk ever released, it is impossible to conclusively say "this   
happens in every game", therefore, I've tried to base the foundations of   
the article on as much reverse engineering as I could possible do.
<<End>>

Few would dispute this speech and sound generating board is the best of   
it's generation (early 80's Bally pinball's) - I personally think it's   
something of a masterpeice with it's *very* clean design.

The squalk and talk has 11 major IC's in it's memory map (count 12 if   
your board has a 6810 fitted into the socket at U6), these are;

U1 - Motorola 6802 or 6808 8-bit microprocessor (see note).

U2 - ROM.

U3 - ROM.

U4 - ROM.

U5 - ROM.

U6 - 6810 RAM (only used if a 6808 microprocessor is fitted - otherwise   
this      socket is empty).

U7 - 6821 PIA for controlling the speech IC - TMS5200 VSP and TMS6100 VSM   
     "phrase" ROM.

U8 - TMS 5200 VSP Speech IC (does not occupy address space).

U9 - TMS6100 VSM 16k byte "Phrase" ROM containing speech data (if   
installed -      again, does not occupy address space).

U10 - AD558 DAC for coverting digital wave data in ROM to audio.

U11 - 6821 PIA for controlling the AY3-8912 sound IC and the test LED.

U12 - General Instruments AY3-8912 PSG (programmable sound generator) IC,   
      which again, does not occupy address space).

These aren't the only IC's on the board, they're just the most noticable.   
The others we will come to later.

[Note: As with Williams pinballs of the era, a Bally Sound board could be   
fitted with either a Motorola 6802 or a 6808 microprocessor. The 6802   
contained 128 bytes of NMOS RAM that had to be selected by pulling the   
'RE' (RAM Enable) line high , otherwise a 6808 was used, the RE line was   
grounded (via jumper-"L") , and a 6810 RAM IC (128 bytes) was located at   
U6 on the Squalk on Talk board. When a 6802 is used the RE line is   
strapped to the reset line of the processor (via jumper-"k") which is   
held high during normal operation].

**Memory map**

The devices that occupy the 64kb of address space in Squalk and Talk are   
mapped out thus;

$0000-$007F - (Page zero RAM) - internal to the uP (6802) or remote 6810   
RAM                at U6 (6808).

$0080-$0083 - PSG control PIA (the AY3-8912 ) and game MPU communications   
at               U11.

$0090-$0093 - Speech control PIA at U7 - the TMS5200 speech IC and   
TMS6100               phrase ROM.

$1000-$100? - DAC at U10 (I didn't have a data sheet available for this   
IC,               so, I'm assuming it's only a 1 byte location.

ROM's - I decoded these address's by hand and therefore are showing the   
maximum size using a 4k byte ROM (32k bit) instead of the smaller (half   
storage - 2k byte) 2516/9316 ROM's.

$8000-$8FFF - ROM at U2 (2532/9332 ROM)
$9000-$9FFF - ROM at U3 (2532/9332 ROM)
$A000-$AFFF - ROM at U4 (2532/9332 ROM)
$B000-$BFFF - ROM at U5 (2532/9332 ROM)

**Power**

The power requirements for Squalk and Talk are generated thus;

The +5 volts required for the logic and the positive rail for   
TMS5200/6100 is generated by the LM323 5 volt regulator VR1 (lower right   
corner of the board, the larger of the two heatsinks). This regulators   
input is supplied from the 12 volt unregulated supply, which, also   
supplies the power too the test LED. The same unregulated 12 volts is   
filtered by the 4700uF/25v capacitor at C14 to remove unwanted AC ripple   
and supply DC power to the TDA2002 mono power amplifier.

The 7905 (the "9" indicates negative voltage as opposed to a 7805 which   
is a positive 5 volt regulator) -5 volt regulator at VR2 provides the   
negative voltage too the split rail TMS5200/6100 IC's. It is supplied   
from the 6.3v lamp supply and is *doubled* and *inverted* on input to   
provide -12.6v. The 6.3 volt lamp supply is too *low* an input voltage   
for the regulator as it requires at least -7.5 volts on it's input to   
output a steady -5 volts supply. The -5 volt regulator does not require a   
heatsink as the only devices drawing on it are the TMS5200/6100 speech   
IC's.

**ROMs**

The code/sound ROMs; - the ROM types/sizes/how many fitted into sockets   
U2, U3, U4 and U5 are *game specific*, and need to have the usual Bally   
method of wire jumpers correctly set according to the game manuals, so   
that they can be addressed correctly by the microprocessor. Bally made   
the board in a more tidy manner as the jumper positions are neatly above   
one another - unlike the MPU boards were you have to search the PCB for   
them! Squalk and Talk will accept Bally mask programmable ROMs   
(non-erasable) and EPROMs (erasable) into any of the 4 ROM sockets (not   
the 6100 socket however);

2716 16k-bit (2k byte) EPROM or equivalent Bally 9316 mask ROM.
2532 32k-bit (4k byte) EPROM or equavalent Bally 9332 mask ROM.

It's always a good idea to transfer the data in those mask ROM's to EPROM   
and keep a binary file of the ROM image stored safely away somewhere (on   
your hard disk for example) if you have access to an EPROM programmer.

**Speech Generation**

Squalk and Talk generates speech by using the Texas Instruments TMS5200   
VSP (Voice Synthesis Processor) IC located at U8, speech data in EPROM,   
or, the TMS6100 VSM (Voice Synthesis Memory) "phrase" ROM at U9 which   
contains upto 16k bytes (128k bit) of speech data.  Note that the 6100   
ROM is a custom device, and, to the best of my knowledge no EPROM   
equivalent is or will ever be available - the ROM is adressed over 4 data   
lines and outputs data serially - a slightly unusual configuration.

The 5200 uses a method of data compression known as "pitch excited linear   
predictive coding" or LPC, it can only process data compressed with this   
algorithm - speech data held in the 6100 ROM or S+T EPROM(s) is   
compressed in this manner. The 6100 is connected directly to the 5200   
which controls the *addressing* and fetching of speech data from the 6100   
for internal processing after *first* receiving commands from the Squalk   
and Talk 680x uP via the PIA at U7.

[I'm currently using an algorithm called "Bridgette Fonda excited hormone   
influence" - it doesn't get my bits down - it gets my bits up!]

When Squalk and Talk is required to generate speech *without* the 6100   
VSM in U9, then, the LPC encoded speech data is held in EPROM and passed   
through the PIA to the 5200 VSP. With this method of data transfer, the   
5200 is instructed to operate in a mode known as "speak external", in   
other words the uP says "forget about getting data yourself from the 6100   
VSM ROM ('cause it's not there), - I'll give you the data directly". I'll   
make all references to speech generation using the 6100 VSM from this   
point as it's a little more complex and less boring than refering to how   
the uP transfers byte-wide compressed data through a PIA to the 5200 VSP   
(but the 5200 processing description is the same no matter where the VSP   
gets it's data from).

The Squalk and Talk uP has access to the 5200's internal address pointer,   
which it modifies to point at new phrases in 6100 ROM. The uP then   
instructs the 5200 to fetch data from that address and process it for   
output as speech. 6100 ROM speech data is received into the 5200 in   
*serial* form (one bit after another on the same line as opposed to 1   
line for every bit) which undergoes serial to parallel conversion before   
being stored in the 16 byte internal buffer/stack. Amazingly, the 6100 is   
a 28 pin device, but, only 10 pins are used - the other 18 are *not*   
internally connected.

The TMS5200 is a microprocessor in it's own right, as it handles data and   
addressing of the 6100 with minimal external uP interaction, it also   
provides the bus timing for data transfer to the 6100 for synchronous   
data transfer itself.

The TMS5200 is too slow to place directly on the microprocessor bus - the   
uP would be waiting for a response/acknowledgement (forcing a uP to wait   
in this manner is known as inducing a "wait state") whilst it could be   
off performing other tasks,  therefore, a 6821 PIA is employed at U7   
which acts as a parallel interface for the 6802/8 uP to pass   
command/speech data. Because the TMS5200 is not directly connected to the   
address bus - it does not occupy address space, instead, only the PIA's   
address space (4 bytes) is visable to the uP as it's "in the way" of the   
path between the uP and the VSP. When the uP wants to talk to the VSP it   
has to do it through the PIA (the same thing occurs for the 8912 PSG as   
we'll see later). The uP can write parallel (8 bit) command/speech data   
for the 5200 through the PIA (which then controls the hardware side of   
interfacing/handshaking with the 5200), and therefore, does not have to   
wait for a response - the 5200 interrupts through pin 17 - "INT"   
(interrupt) via the edge sensitive CB1 line of the PIA when it requires   
data to be transfered to it's internal stack, which in turn interrupts   
the uP via the IRQ line.

The 5200 "excites" digitally encoded speech by using an internal digital   
filter to simulate the vocal tract of the human voice.  The exact   
description LPC encoding is not a trivial matter to put into easy to   
understand English if your not technically minded, the proceedure (as   
with most speech processing) is a complex one, but, it goes something   
like this;

LPC synthesizes human speech by recovering from the *original*   
recorded/sampled speech enough data to contruct a time-varying digital   
filter which attempts to model the vocal tract of the human voice. This   
filter is further "excited" with a digital representation of either   
glottal air impulses (for voiced sounds) or the rush of air (for   
un-voiced sounds). The filter model is then passed through the internal   
digital to analogue converter which outputs the final speech waveform.

The 5200 VSP *does not* encode speech data "on-chip" (unlike the CVSD   
speech IC's we're used to seeing which can both encode and decode). A   
seperate program/hardware is required to perform the encoding by analysis   
of the speech samples.

The LPC analysis program begins with a set of digitized speech samples,   
which are usually derived by passing the analogue speech through an   
analogue to digital converter (ADC) at a sample rate of 8 or 10 kHz.   
Consecutive samples are grouped together to form a "frame" of samples for   
analyzing - anywhere between 50 and 400 samples may form 1 frame, but,   
typically it is 200 samples. The LPC analysis program takes each frame,   
then, calculates the pitch, energy and spectral coefficient by   
*pre-emphasizing* the speech samples. The frames are then stored in   
serial data form within the 6100 VSM for recall or as parallel encoded   
speech data in EPROM.

This LPC method of speech encoding compresses speech data from 100,000   
bits/sec (raw speech data) to about 4800 bits/sec. The analyizer program   
reduces this figure still further - to 2000 bits per second or less by   
cleverly taking *it's own* 10 bit speech parameters and compressing them   
to between 3 and 6 bit codes (depending on whether all the parameters   
were used - if the sound is voiced or un-voiced).

Speech encoded data received by the 5200 is then *un-packed* and *tested*   
internally for validity before having the energy, pitch and spectral data   
associated with the sample stored in RAM for the modelling/conversion to   
occur.

The internal 128 bit FIFO stack (first in first out - also know as the   
"buffer") is arranged as sixteen 8-bit bytes to hold speech data passed   
to it/fetched from the 6100/S+T EPROM. As the data is pulled from the   
stack it is passed to the internal DAC for conversion to speech before   
being ouput as the final vocal phrase to the amplification circuits. If   
the 5200 stack decrements to 8 bytes or less (half empty), it raises an   
IRQ onto the squalk and talk uP via the PIA to ask for a command to fetch   
more data (or speech data if in "speak external" mode).

The 5200 also raises an interrupt when either the 5200 has finished   
speech processing and requires more data to process from the 6100 ROM/S+T   
EPROM.

5200 interrupts: The 5200 asserts "INT" on three occasions, but, they are   
basically the same thing;

Talk Status (TS) - the 5200 has finished processing speech and the buffer   
is now empty.
Buffer Low (BL) - The buffer (stack) is down to 8 bytes or less but not   
empty.
Buffer Empty (BE) - The buffer is now completely empty.

The three conditions above are given as flags in the 5200's internal   
status register, which, the Squalk and Talk uP can read at anytime to   
establish the current condition of the chip.

This means that the 5200 data transfer by the Squalk and Talk uP is   
"interrupt driven" - the uP on receiving an IRQ request from the PIA at   
U7 knows that the 5200 has processed data (the interrupt is determined by   
examining the PIA's internal interrupt flags) and the uP can transfer the   
next command/speech or modify the 5200's speech phrase address pointer   
and therefore, indirectly,  speech data to it.

The conversion of speech data by the 5200 introduces an unwanted gift -   
"digital conversion noise", this is a very common problem when performing   
digital to analogue conversion of audio or speech data. To overcome the   
high frequency noise which has been superimposed onto the speech phrase,   
a "Low Pass Filter" (LPF) is used which attenuates speech phrases at a   
rate of 12db per octave above 5kHz. One quarter of U13 (one amp) - a   
LM3900 operational transductance amplifier is used as a second order LPF.   
The speech is "cleaned up" and rounded off. I think this matches the   
speech bandwidth that Williams had at the time using CVSD technology   
(continous varaible slope delta modulation) - but don't quote me on it!   
The speech is then fed into a "voltage controlled amplifier" (VCA) at U14   
(another LM3900 op-amp), to be, errrr....amplified, before being further   
fed into the 8 watt TDA2002 mono power amp (U18) which drives the 8 ohm   
speaker.

[Note also, audio/speech data that has been filtered in this way has   
tonal colour added or "timbre" to the sound by the circuit components.   
This was a common method of synthesized sound generation in the early   
80's when synthesizers used voltage controlled circuits to generate   
waves, modify them and then perform the final filtering (by subtracting   
elements from the original sound). If you built two LPF's to perfom the   
same task using very different components - the audio/speech data would   
sound different, - "coloured". It wasn't that Bally intended to do this   
with the speech filter (there's nothing wrong with it), it's a factor   
based on the design of the circuit. Squalk and Talk has three LPF's - all   
generated from a single LM3900 OTA which contains four operational   
amplifiers in a single package (the last op-amp is used as a DAC)].

The VCA's output amplitude can be directly controlled by a "control   
voltage" (CV) at it's input - hence it's name. The VCA control voltage is   
generated by the another amplifier in the LM3900 OTA at U13 which is   
acting as a DAC. The DAC's output amplitude is controlled by "weighting"   
it's input with 4 resistors in series with the PIA port B output at U7   
(pins PB4 through PB7 to be exact). The 4 bit code passed to the DAC from   
the PIA allows for 16 steps of amplification which translates to 16   
different speech output levels at the VCA, and, ultimately the power amp.

**Sound Generation**

Sound generation/special audio effects are handled in two ways;

1 - A General Instruments AY3-8912 PSG IC fitted in U12 under control of   
the PIA at U11 (which is in turn controlled by the S+T uP) generates   
basic square wave tones, noise and sound shaping envelopes that control   
the output amplitude to the amplifier cicuits - these tones are limited   
in scope (how many different square waves can you have?).

Sound selection for the PSG is *not* made by S+T - the "solenoid/*sound*   
select" lines (the signal that also selects solenoids on the playfield to   
fire via the driver/power regulator board) of the *MPU* board select the   
sounds required - S+T merely writes *command* data to the PSG telling it   
what pitch to play etcetera via the 8 lines of port A (PA0-PA7) linked to   
the bi-directional bus lines of the PSG (D0-D7). The uP can at anytime   
write too or examine the internal registers of the PSG to find out the   
current state of the chip. Sound select triggers from the MPU board   
arrive at Squalk and Talk via connector J1.

The PSG contains 3 channels for producing audio - A, B and C. In addition   
to these channels, the PSG also contains waveform mixers, a noise   
generator, and amplitude (loudness) control for each channel through   
independant DAC's that can have one of ten different amplitude envelopes   
applied to them. The 10 envelopes are all differing from each other, they   
simply raise, lower or sustain (hold) the volume, either repeating the   
envelope or as a "one-shot" (once) operation. Adjustment of the envelope   
frequency is also provided. Repeatedly modifying of the waves amplitude   
without affecting the pitch is of course known as  - amplitude modulation   
(AM).

The 3 audio channels are then summed together by linking the 3 output   
pins. The chip also contains a bi-directional 8 bit data port - used in   
Squalk and Talk to pass the incomming sound select strobes in it's I/O   
pins (input/output) to the S+T uP via the PIA.

[The AY3-8910 used on earlier Bally sound boards have exactly the same   
internal sound generating architecture as the 8912, with the exception   
that the 8910 is a 40 pin device and contains two 8 bit I/O ports.]

The 8912's 16 internal registers and they're permissable values are;

00 - Fine frequency channel A (0-255)
01 - Frequency channel A (0-15)
02 - Fine frequency channel B (0-255)
03 - Frequency channel B (0-15)
04 - Fine frequency channel C (0-255)
05 - Frequency channel C (0-15)
06 - Noise period (0-31)
07 - Mixer (0=enable, 1=disable);

bit 0 - Channel A tone enable
bit 1 - Channel B tone enable
bit 2 - Channel C tone enable
bit 3 - Channel A noise enable
bit 4 - Channel B noise enable
bit 5 - Channel C noise enable
Bit 6 - I/O port A mode (0=input, 1=output)
bit 7 - I/O port B mode (0=input, 1=output)

(you'll notice two port enable bits - as previously mentioned the 8912   
has the same architecture as the dual port 8910)

08 - Volume channel A (0-15 or 16=envelope control)
09 - Volume channel B (0-15 or 16=envelope control)
10 - Volume channel C (0-15 or 16=envelope control)
11 - Envelope fine frequency (0-255)
12 - Envelope frequency (0-255)
13 - Envelope shape (0, 4, 8-15 select the desired envelope)
14 - Port A (status of pins on input, byte value/pin status on output)
15 - Port B (status of pins on input, byte value/pin status on output)

The U11 PIA on the *game* MPU board outputs the sound (solenoid) select   
signals, all the incomming signals are inverted on Squalk and Talk by a   
CMOS 4049 hex inverter at U16 before ending up as a 4 (or 5 bit) bit   
binary code on the AY3-8912's I/O port pins IO0-IO4 (there are eight IO   
lines but IO5-IO7 are not used - they are grounded). Squalk and Talk   
knows of an incomming sound request as the PIA at U11 interrupts the uP's   
IRQ line (Interrupt ReQuest) after receiving an interrupt on it's own CB1   
line. The "solenoid/sound select" line of the game MPU (J1/10) which is   
connected to the PIA at U11's CB1 pin is forced high by the game MPU   
board - this forces a *low* IRQ interrupt on Squalk and Talks uP via the   
one of the inverters at U16 (pin2 - inverted output of the   
"solenoid/sound select" line from the game MPU board). The interrupt   
forces S+T to look at the I/O input port register (14) of the PSG (via   
port A of the PIA) and read the code presented by the MPU board, which is   
then transfered by the S+T uP for decoding.

Bally state: "The code number of the sound/speech required is passed as   
two half-bytes (nybbles - 4 bits) over the solenoid select lines which   
are the sound select inputs to the Squalk and Talk".  So, when a solenoid   
was required to fire as a result of a valid switch closure detection on   
the playfield or in the cabinet, the game code would pass a "sound code"   
associated with the solenoid to the Squalk and Talk board in binary   
format via the solenoid select lines (and the game MPU board would also   
fire the solenoid via the driver board).

<Techie timing bit - crash helmets on!>

Data transfer of the two 4-bit "code" nybbles to S+T is synchronous with   
no "data taken" handshake back from S+T indicating it has received the   
data. The sound select interrupt that arrives on the CB1 pin of the PIA   
at U11 is low for 40 microseconds, before going high again. Following a   
22 microsecond delay (probably due to the time the S+T uP has to process   
the interrupt service routine), the first nybble is presented by the game   
MPU on port A, which, S+T must take within 145 microseconds. The second   
nybble is sent immediately afterwards but only lasts for 78 microseconds.   
If S+T does not take the data within the specified time (say, it only   
gets the first nybble because S+T the bus is running slow due to failure)   
 - S+T may actually play the wrong sound!

<End of techie timing bit>

Note: The same lines 4/5 lines passed from the game MPU through the PSG   
are also used to select *speech*.

Strangely, the schematics that I'm checking against show a *fifth*   
solenoid select line wired to PA4 (if the "EE" jumpers are installed,   
which, we'll come too shortly) or IO4 of the PSG,  maybe Bally kept there   
options open by keeping this fifth solenoid select line available on S+T?

More probably - bit 5 of this line is present to pass *command* data from   
the *game* MPU uP to the Squalk and Talk uP. At power up the game MPU   
board passes a basic code for S+T to enable it to initialize the onboard   
VCA's to a predefined level of amplification - this level is user   
changeable through an audit as part of the coin door tests. Consult your   
game manual for the exact audit parameters. This begs the question "what   
other command codes are passed from the game MPU uP to the S+T uP?". 256   
command codes are possible using the two 4 bit nybbles in conjunction   
with the 5th line - the 5th line signals "command code" rather than   
"sound/speech code". Total number of codes possible then is 512 - 256   
sound/speech and 256 command. This of course is pure speculation on my   
part, and, only hacking game code or talking to S+T's hardware/software   
enginners will provide the answer.

When S+T has the sound/speech select code, it changes the state of the   
PIA's port A from input (sound/speech code read) to output so that it can   
write the command data to the PSG which will then generate tones/noise   
(this isn't done of course if S+T is only required to output speech). The   
PSG has internal latches to, err.....latch the tonal data it generates   
and therefore sustain the sound without the uP having to refresh pitch   
command data to it in order to keep the sound playing. S+T will continue   
in this fashion until either the sound routine ends (it's finished) or it   
is interrupted and forced to play another sound. Unlike modern games, S+T   
(as far as I can tell) has no sound *priority* - all sounds are equal,   
and, the previous sound will be cut-off and a new sound played on receipt   
of a new sound interrupt.

The AY3-8912's analogue output *is* filtered with yet another LPF (the   
last quarter - one amp of the LM3900 at U13) which has a cut-off   
frequency of 3.5Khz and a roll-off of 12db/Octave as with the speech   
filter design. The filter is in place *not* to eliminate conversion noise   
(that's done "on -chip") but to round off/soften the harshness of the   
square waves being output making them more pleasant to the ear. The   
filters cut-off frequency is fixed at 3.5Khz, but, the PIA at U11 is able   
to kick-in a 2n3904 NPN transistor (Q2) which drops the frequency to an   
*extremely* low cut-off of 200Hz for special audio effects (this is   
loooooowwww!).

It's a shame that Bally's S+T designers did not add programmable   
resonance control or low frequency software controlled modulation to the   
filters or make them 2/4 pole switchable with a 12/24db per octave   
roll-off, as, this could have extended to tonal capabilities *far* beyond   
what they are now and would have blown the nearest pinball audio   
technology at the time clean out of the water.

2 - As the PSG is limited to generating square waves or noise the Sound   
ROMs contain additional wave data/wave generating algorithms that the uP   
can shove through a digital to analogue converter for audio processing   
without interaction of another PIA. The uP is able to do this because the   
DAC in question (U10 - AD558) will interface directly with the uP bus (it   
has a "chip select" pin and  3 state data lines) and sits on the data   
bus. This method of reading wave data from ROM and shoving it through a   
DAC is similiar to what Williams did at the time with it's sound with the   
exception that Williams used a PIA between the wave data and the (1408)   
DAC. Note also that the output of the AD558 DAC is clean enough not to be   
filtered and enters the amplifier circuit at the VCA input stage of U14   
(between the AY3-8912 LPF output and the VCA).

Five jumpers  - "EE" are used to connect the sound/speech select strobes   
directly to the PIA A port when the AY3-8912 PSG is *not* installed in   
S+T. With this configuration, the sounds are generated soley by using   
software generated waves and effects through the DAC. The PIA at U11   
interrupts the uP after receiving a request from the game MPU board as   
previously discussed, this forces the uP to look at the PIA port A lines   
*directly*, and take the four (or 5 bit?) code presented on the pins over   
two nybbles as previoulsy discussed.

*Gain Control*

Three sources are available to adjust amplification (gain) control - the   
VCA's under control of the uP, R69 and R70 on the board for local   
adjustment or remote 1K pots (substituting R69 and R70).

Bally give you the option of disconnecting the local speech pot (R69) and   
the sound pot (R70) or the VCA's (if connected) with wire jumpers so that   
remote 1k pots can vary the speech/sound gain/mix. Remove jumper "m" and   
install jumper "n" for the remote speech pot and remove jumper "cc" and   
install jumper "dd" for the remote sound pot. If you so wish, you could   
disconnect both R69/70 *and* the remote pots in the cabinet/coin door and   
control the amplification/sound+speech mix by audits alone (VCA control).

As with the AS2518-xx MPU boards, Squalk and Talk's PIA's are wired OR-ed   
together, so, the internal interrupt flags of both the PIA at U7 and the   
one at U11 need to be examined by the uP to determine which PIA was   
making the request (see the article I wrote on "Undertstanding   
Microprocessors in Early Solid State Games" for further clarity on IRQ   
interrupt servicing of Bally and other MPU boards).

**Other circuits**

The power-up reset circuit comprises of a timing capacitor (C1), a charge   
resistor (R1) and a "quick discharge" diode (CR1) being fed through two   
inverters in series at U15 (74LS14) and onto the reset pin of the uP. The   
LS14 is a schmitt trigger inverter, meaning, it will not switch it's   
output state until the input threshold voltage is reached or exceeded   
(approx 3.15 volts) - this stops the output rising linearily which could   
start the uP running before it has had time to stabilize correctly (reset   
timing equal to or greater than 8 clock cycles) and also prevents fast   
glitching due to rapid changes at the inverter input. The diode quickly   
discharges the capacitor should the logic 5 volt rail collapse - if it   
was not present, a positive charge may keep the inverters input active   
and prevent the uP from going into reset. This may cause the data and   
address lines to drop to a dangerously low level as the supply collapsed,   
were, the bus devices would not be able to correctly identify active high   
and active low states. For the uP this could translate to a wrong   
intruction decode and may result in a write (store) when it should have   
been a read (load) instruction resulting in possible memory overwrite.   
Two inverters are used in series as a tap off is made at the output of   
the first inverter (pin 2) and fed into the "power sequencer" circuit for   
the TMS5200/TMS6100 speech IC's. This circuit provides +/-5v to the   
5200/6100 via three PNP transistors (Q3-Q5). The circuit does not allow   
power to the speech IC's until the correct reset timing has occured. The   
second in-series inverter is used to correct the state of the reset   
signal to the uP reset pin (the reset line is high to the uP during   
normal operation, but enters the speech "power sequencer" circuit *low*   
during normal operation to switch the on PNP transistors).

Fortunately Bally got rid of the two phase clock generator and clock   
buffers using multivibrators used on previous uP based boards and   
replaced them with a 3.58Mhz crystal oscillator wired between pins 38 and   
39 of the 6802/8 uP - this makes fault finding the clock signals   
significantly easier (check the clock directly at the uP pins).

A 74LS155 - a dual 2 of 4 decoder/demultiplexer at U17 is used to   
generate chip select signals for all the memory mapped devices (ROM's,   
PIA's, DAC) on the bus by decoding address lines A11-A15 in conjunction   
with the VMA (Valid Memory Address) signal ouput by the uP (pin 5) on   
either a read or write cycle. The 6810 RAM at U6 ($00-$7F) also uses this   
address decoder. It is automatically *deselected*  when A7 goes high   
($xx8x) and when the address on the bus  *exceeds* $0FFF (1st 4 k   
boundary - start of DAC address space). The uP does not need to issue an   
address onto the bus when the internal RAM is selected using a 6802,   
therefore the address decoder has no bearing. No bus drivers are used on   
S+T as only one device will be active on the bus at any one time, and the   
uP has adequate power to drive the one TTL load each device will   
represent (the other devices will be "tri-state" - in "standby").

**Capacitors**

Problems with the onboard electrolytic capacitors have been mentioned   
before on RGP. Basically these capacitors dry out and de-polarise with   
age, aggrovated by the fact that some capacitors are close to heatsinks.   
Squalk and Talk is no spring chicken - it's some 14-15 years old now and   
it's probably a good idea to change those capacitors now before they fail   
on you. The capacitors are either used in a smoothing role or a stage   
coupling role for the amplifier circuits.

Some well known US pinball repairers have capacitor replacement kits   
available (and I'm not sure all the caps I've listed are in the kits), in   
the UK, you can get these common electrolytic caps from RS components,   
Maplin and possibly Tandy (I get mine in work!). The 16 *axial*   
capacitors in question are;

C1  - 47uF/16v
C14 - 4700uF/25v
C15 - 10uF/16v
C19/C24/C25/C28/C31/C34/C42 - 1uF/25v
C27- 1000uF/16v
C29 - 470uF/6v
C36/C43 - 2uF/25v
C37/C38 - 330uF/50v

A word of WARNING. Nearly all capacitors today have the *negative*   
terminal marked with a black arrow on the capacitor can. On S+T the   
opposite occurs - I've just looked at two boards and the old capacitors   
are marked showing the *positive* terminal, the board also has the   
positive terminal silk screened on it's surface. MAKE SURE YOU GET THE   
POLARITY CORRECT!

If you insert a capacitor around the wrong way then apply power (give it   
a reverse voltage) the dielectric will be removed from the anode and a   
*large* current will flow as oxide builds up on the cathode. This causes   
a gas build up and that's what makes the canisters EXPLODE! If you've   
ever been unfortunate enough to smell or even get electrolite in your   
hair [hair ref.#2] as a result, you'll know exactly what I mean (the   
smell makes me feel physically sick!). No - I haven't done it, but I've   
been too close to some engineers who have! :( - that was the only day I   
can remember when I wished I was bald! [hair ref.#3]. I wonder if   
Bridgette Fonda goes for bald men? [hair ref.#4] :(

**Self test**

As with other Bally uP boards of the era, the S+T uses a single LED to   
show the status of the board after power up. The self test is   
automatically launched after boot-strapping in an attempt to verify the   
onboard hardware will operate correctly.

For some reason better known to Bally, the ROM's do not appear to be   
tested - there is no provision for them in the self test. Whether they   
are actually tested by checksum for validity, but not displayed as part   
of the test, remains a mystery. In this case, it is probable a board   
could pass the test but output bad audio data or run corrupt operating   
system code! - it could even run a corrupt self test routine!

After power-up and the correct reset timing/voltage regulation,  the LED   
briefly flickers (for approx 300 milliseconds) before;

*1st flash*
The test program attempts to validate the condition of the 128 bytes of   
NMOS RAM located at page zero - address $0000 through $007F. Note that I   
haven't said "the test program attempts to test the RAM at U6" - why?   
Because Bally made an oversite with the test documentation.

If you have a 6802 uP installed in your S+T then the *internal* 128 bytes   
of RAM are tested and *not* U6 providing the uP's RAM Enable line (pin   
36) is strapped high (to the reset line) via jumper "k". The software   
doesn't care were the RAM is physically, as long as there is RAM at page   
zero (it's transparent to the software). The test program attempts to   
write a bit pattern to address $0000, starting with $00 and counting upto   
$FF. If the test program sucessfully manages to write and then read back   
(validate) the count, it then moves onto the next byte $0001, until all   
128 bytes have been checked - 256x128 = 32,768 write cycles with   
validation. If this is sucessfull, the LED flashes for the *first* time   
(the initial flicker is not counted as a flash).

If your using a 6802 and the RAM test fails (you don't get the first   
flash) - you might be lucky. Move jumper "k" (the internal RAM enable   
jumper) to position "L" and install a 6810 RAM IC in U6 then run the test   
again, else, you'll need to change the uP (the internal uP architecture   
is damaged).

An interesting point here. Joel and Vickie (the Pinball Liz) listed a   
problem in their tech tips #34 with the self test button on S+T not being   
debounced which sometimes causes the board to crash after attempting a   
test.  Because the switch is not debounced, the switch contacts make and   
break a number of times translating to a *number* of valid NMI requests   
to the uP. The *stack* and *workspace* RAM in S+T is only 128 bytes wide   
(page zero $0000-$007F, the exact stack length is unknown to me). The uP   
has to save the contents of it's internal registers onto the stack when   
it encounters an NMI (or IRQ) interrupt. A number of interrupts recieved   
in this manner will cause "nesting" (interrupts are "queued" to be   
processed in last in first out [LIFO] order) and the most probable cause   
of the board crashing is the stack overflows, wraps around, and starts to   
overwrite itself wiping out the data previously saved onto the stack. The   
conclusion? The uP crashes because it pulls data off the stack that   
didn't match the data it originally saved. Power-cycling is the only   
option to clear the problem (there is no reset button on S+T). The   
problem is further agrovated by the fact that speech data transfer   
requires an IRQ interrupt - further stack usage translating into IRQ and   
NMI data colliding caused by the over-write when the uP "pops" (pulls   
data off) the stack.

*2nd flash*

The uP attempts a bit-pattern write to the internal registers in the PIA   
at U7 (the speech control PIA) in the same manner as the RAM test - if   
the LED flashes for the second time, then the test was sucessfull. If the   
test failed - check the sockets/swap out the PIA.

*3rd flash*

Exactly the same test as U7 is carried out on the PIA at U11 (PSG control   
PIA). A successfull test causes the LED to flash for the third time. If   
the test fails, then perform diagnostics as for U7.

*4th flash*

The uP attempts to write to the internal registers of the AY3-8912 PSG   
and then read the data back using the PIA at U11 as a parallel interface.   
A pass is indicated by the fourth flash of the LED. If the test fails -   
swap out the PIA at U11 for another (the U11 PIA self test cannot test   
the input/output state of the actual pins as there is no data "loop back"   
 - it can only write to internal I/O *registers* of the PIA, and, whilst   
the PIA may test okay - the output buffers may be faulty). If the fault   
continues swap-out the PSG and check the sockets of both the PIA and the   
PSG.

*5th flash*

The uP now attempts a 9 byte transfer of data to the TMS5200 speech IC.   
As the 5200 stack is empty on power-up, it will flag an interrupt stating   
"buffer/stack low" for every byte transfered until it has 9 bytes (it   
only flags an interrupt if the stack becomes half empty - 8 bytes or   
less). The uP writes a single byte at a time and waits for the buffer low   
interrupt until it has fed all 9 bytes - on receipt of the 9th byte the   
5200 asserts "Buffer low" *no more* and does not assert another   
interrupt. If this occurs, S+T assumes to IC is good.

[Bally state: "Every time a write to the speech chip is performed, the   
speech chip responds with an acknowledgement".]

Note that Bally's test documentation is misleading here because it is so   
vague. The 5200 *does not* acknowledge every byte sent to it except in   
the above case, that is, if the buffer contains more than 8 bytes it will   
not assert "INT" and therefore will not acknowledge. If the buffer is at   
max (16 bytes) it changes the state of it's "ready" line (pin 18)   
connected to the PIA, effectively, telling it not to pass more data until   
the 5200 asks for it (it's "not ready") by asserting "INT" again.

If the test is successful the LED flashes for the fifth and final time   
and the PIA's are initialised to their correct configuration in readiness   
for game operation (waiting for a sound select interrupt from the MPU   
board). If the test fails then swap out the PIA for the reasons indicated   
in the 4th flash test above, else, swap out the 5200 and/or check the   
sockets. Check the state of the 5200 supply pins (pin 4 - [+5v], pin 5   
[-5v]) as the power sequencer circuit may be faulty. It is also possible   
for a faulty 6100 phrase ROM to "pull-down" the 5200 and may be worth   
swapping out if all else fails (that's if it's installed of course!).

Note, that for S+T to actually test tha PIA's they have to be intially   
configured/programmed by the uP *before* they are tested. PIA's always   
default to port A, B, CA2, CB2 as inputs and *all* interrupts are   
disabled at power up - this is no good as the self test requires CA2/B2   
to be tested as *outputs* by writing to the port output registers for   
both the PIA at U7 and U11, therefore,  they will require re-configuring   
after internal intialization.

Clive
English Lord and Squire of property.....<[email-masked]> - okay yar?