Mysterious origins of the AP-64 EPROM programmer

Last December I posted in Apple II Cards about the utterly bizarre firmware of my APX-EPROM-1 Programmer, a clone of the AP-64e that was sold to me by Nexo Distribution in the 1980s.  The APX firmware changes, depending on which slot it's installed in:

• When installed in slot 1, slot 2, slot 5, or slot 6: the bootstrap firmware starts with a BIT $CFFF instruction to safely access the $C800-$CFFF expansion ROM address range.  There are only 20 instructions in the bootstrap ROM address range $Cx00-$Cx24, and the rest of the slot ROM is filled meaningless $34 bytes.
• When installed in slot 3 or slot 7: the bootstrap firmware starts with a BIT $CFFF instruction, same as the slots above.  But, in addition to the 20-instructions at $Cx00-$Cx24 there's an additional string-printing subroutine at $CxA2-$CxC0 which does not appear when the card is installed in any other slots.
• When installed in slot 4: the bootstrap firmware starts with a JSR $CFFF instruction, a bug that causes 6502-equipped machines to jam the processor at the $F2 byte at $D01B.

APX firmware slots 124567.jpg

APX firmware slots 67.jpg

This peculiar behavior arises because the card's peculiar wiring uses IOSTRB as the high-address-bit to its 2716, thereby partitioning the ROM into 1KB of bootstrap ROM and 1KB of expansion ROM.  It would be a strange way to design a card from scratch, but I suspect the APX and AP-64 evolved from an earlier design that might have used an LS471 for 256 bytes of bootstrap firmware and a 2708 for its 1KB of expansion ROM.

Further examination suggests there are two branches of the APX's family tree:

• AP-64 branch has a 28-pin socket for programming EPROMs.  It supports only 2716, 2732, and 2764.  Configured via an 8 (or 10) position DIP switch.  Inconsistent details in the circuit and abandoned instructions in its firmware suggest it was adapted from a board that could program 2708 and possibly 23xx EPROMs.  Someone traced out the schematic and uploaded it to the Internet Archive.  That schematic proposes some clumsy revisions to extend its capability to larger EPROMs, apparently by someone who doesn't understand the circuitry well enough to exploit the many leftover pins on the IO controller.
• EP-7 branch started with a 24-pin socket for programming EPROMs.  It supports 2708, 2716, 2732, and 2364.  Configured via a DIP-16 jumper module that is plugged into one of several DIP-16 sockets on the card, much like the Memory Selection blocks on the early Apple ][ motherboards.  Although it can program 8K EPROMs, its 24-pin programming socket can't accept a 2764.  I suspect that the 8K capability was added by someone who understood the card's firmware but not its circuitry, as the extra address bit was kludged into the circuit by cascading the flip-flop from the high bit of the ripple counter instead of connecting it to one of the many leftover pins on the IO controller.

Attached to this blogpost is a schematic from the EP-7 branch of the APX's family tree.  Despite its superficial differences, it's unmistakeably the same basic circuit as the AP-64 family...including the use of IOSTRB as the high-address-bit on its 2716 and the strange slot-specific bootstrap ROM behavior.

EDIT: The SCREAMING RUNAWAY CURSOR bug was recorded in this Facebook video comment.  As far as I can find, all versions of the EPROM programmer firmware exhibit this crazy, noisy bug it you start the card with IN# instead of PR#.