Operation successful ...
... patient dead. Or at least in a coma. 😒
I spent all of last week fixing the timing problems I described in my last blog. I cross checked the timing constraints for the different Apple II models and combined them to form a worst case scenario. This includes the long time the II+ takes to establish a valid address and the short data hold time of the IIgs. To verify that timings were by the book, I learned how to write VHDL testbenches (how have I lived without them?). The simulation showed me some flaws but I corrected them and now everything is fine. I even wrote a driver test that writes a block of data, reads it back and checks for errors.
However, one thing I did not realize was that 27xx type EPROMs are relatively slow. They take up to 450ns to output data after the address is valid. The select signals that activate the ROM and forward the address bus are valid for 500ns. With my timing redesign, the signal is cut off by about 70ns at the beginning to avoid bus fights. I think you can see where this leads to... 🤔
So, how did this ever work? I guess it kind of worked, because in the ROM I used the same addresses for the $CsXX space and the $C8XX page. Bits 8 to 10 of the address bus were always set to 0 there. The lower 8 address bits are connected straight through. Because the address bus becomes valid in the first half of the CPU cycle, this gave the ROM enough time to look for its data when this first page was accessed. When accessing any of the other pages however, the higher address bits were only forwarded in the later half of the CPU cycle and that was too short for the chip to get off its rear end. So, every time the firmware tries to run in an address between $C900 and $CEFF it vanishes into thin air, because the ROM has not awaken, yet. I think you could call that hardware's equivalent to dereferencing a null pointer.
Fortunately I'm in a stage where still I can change the hardware and make use of address line A11. Using the schematic of Apple's Super Serial Card, I think I can replicate the address mapping they used back then. I'll report back how this went.