Pr0f wrote:My gut feeling is that these video ULA's are connected directly to the outside world on the 8 pin connector - so if someone has got a badly wired plug or cable, who knows what damage can ensue.
Indeed, there is zero protection on the TTL video outputs from the ZX8301 ULA (see annotated schematic). Whether the loading from the 8-pin connection or some other interaction from defective PAL components/MC-1377 could render the observed behaviour is unclear, but a possibility.
Isolating the start-up sequence from the 8302 by simply removing it and powering-up if only briefly does seem like a sensible - and easy - test to try.
On the Iss5 board, neither 8301 nor 8302 are directly connected to the CPU data-bus - both pass through the bus-transceiver. This changed slightly on Iss6, when the 8302 was placed 'outside' 8301's private bus (it never needed to be inside.) That said, they both directly connect to a sub-set of the address-bus (8301: A16..17, 8302: A0..1, A5) and the 8302 _might_ be messing with these.
The fact that touching the CPU changes the display pattern does suggest a grounding issue somewhere...
Replacing the 15Mhz crystal 'can' oscillator by the 8301 is another simple and inexpensive job - the fact that this (along with the other two can oscillators) rises above the average component elevation renders it sensitive to mechanical breaks which are hard to spot (being soldered tight against the board.) The 32KHz oscillator in your photo (used for the real-time clock on the 8302) for example, has obviously been forced-back at some point.
The mod to replace originally fitted EPROMs with the two (MGI) ROMs looks intact, but worth checking those wire-links (JU2..JU4 - look like resistors but with a single black-band indicating zero Ohms) are making reliable contact (JU3, JU4 feed ROMOE, for example). The fact that the ROM start-up commences at all, however suggests that they are good - but no harm in checking.
Coming back to the 'continuous Interrupt' possibility - either shorts on these lines, or either of the 8302 or 8049 holding IPL0/2 and/or IPL1 low could trigger an apparent freeze, though I suspect that interrupts are not enabled until after the memory test (would require checking in the ROM disassembly), so only an NMI equivalent (INT#7 = both IPL lines low) should interfere at this early stage of start-up.
If you have an oscilloscope-type solution, well worth checking the CPUCLK and some of the other lines against your other 'known-good unit'. I personally use both a cheap-and-cheerful digital scope and a 2-channel scope connected to my laptop - search Google and check out:
Hobby Components 8CH USB Digital Analyser (around £13)
Sainsmart DD120 USB 2-CH Virtual USB Oscilloscope (around £60)