You type dir on an Amiga and press Return. To produce the directory listing, the Amiga reads
directory data from disk. We’ll use a logic analyzer connected to a running Amiga to follow that read
from start to finish. The analyzer records the signals entering Paula and the DMA requests and bus words
leaving it. Where no pin exposes the intermediate state, my earlier functional analysis of the reconstructed circuitry explains
what happens inside Paula. Then we’ll decode the captured words. If we truly understand the read path,
they will become sectors with valid checksums and recognizable filesystem names.

That method combines two sources of evidence.

The first is the capture. I put a logic analyzer on a running PAL Amiga and probed the
chip data bus, the register address bus, the DMA request line, the interrupt lines, the color clock, and
Paula’s three floppy pins. Then I recorded a complete floppy read and the start of the next with Workbench
up and a dir running. The recording places flux pulses, register traffic, requests, bus words,
and interrupts on one timeline.

The second is the functional model. Other researchers decapped and photographed Paula,
produced the vectorized die trace, and worked out rough schematics of its circuit blocks. Starting from
their work, I analyzed what those blocks do and how they operate together as a complete floppy controller.
That functional model explains what happens inside Paula between the events visible on its pins.

If you crave the internals

Inside
Paula’s Floppy Controller, Part I

The complete functional analysis is a paper of its own. This post borrows only the details needed to
explain what the analyzer sees at Paula’s boundaries.

Read
my paper

The capture and functional model together make a prediction at each boundary. The observed input and recovered
logic say what should appear next. The next captured boundary confirms that prediction.

In the steps below, the dark panels present captured values, model predictions, and results reconstructed
from the capture; each panel header identifies its role. Where a step names a region of the chip, it carries
a small tag like 10c next to the title. The tag identifies the corresponding
module in the paper linked above, where its circuitry and function are described in detail.

How we watched Paula

The proof depends on observing many signals on one timebase.

An oscilloscope shows analog behavior such as voltage levels, rise and fall times, overshoot,
undershoot, and ringing. A logic analyzer compares each input with a voltage threshold and records the
result as a zero or a one. That digital representation lets it record dozens of signals together across
millions of time aligned samples, covering the entire read while retaining enough timing detail to resolve
individual pulses and bus cycles.

For this capture, the analyzer records every channel once every 10 nanoseconds across 335.544
milliseconds. The resulting buffer preserves the register setup, the complete disk read, and the start of
the next read on one timeline.

This article reports custom register addresses as byte offsets. The captured RGA bus contains address
bits 8 through 1, so raw code $04 shifts left one bit and appears here as byte offset
$008.

The analyzer produces a file of raw digital levels. Every measured result in this
post starts here:

Where the probes went

This capture uses a PAL Amiga 500 motherboard running Workbench and a Gotek loaded with the disk’s
.adf image so the same track can be presented again on demand. Most analyzer probes attach individually to contacts on the
DIP clip over Paula, where the data bus, RGA lines, timing signals, DMA request, interrupt lines, and
floppy signals are all available. A separate nearby connection supplies ground. One capture and one
timebase cover both ends of the transfer.

Each signal answers a specific question.

The analysis rebuilds the color clock grid from those channels, numbers every scan line and DMA
slot, and turns register addresses into cycle names. The analysis software recovers bit cells from the
flux, allowing each word on the chip bus to be traced back to the transitions that produced it.

Disk vocabulary

1. STEP1

   The Shell asks the filesystem for the directory

   dir asks the filesystem to walk the current directory, and the filesystem requests the
   disk blocks that describe it. That request supplies the real disk read this story follows.

2. STEP2

   The directory request requires a track read

   trackdisk.device keeps data
   from a previously read track in a memory buffer. If the requested track is already there, it can
   supply the sector without another disk transfer. In this capture, the requested track is absent, so
   the system asks the drive for it and reads the resulting data through Paula into chip RAM. That is
   the disk transfer traced in the remaining steps.

3. STEP3

   The Amiga selects a track through the drive interface

   One of the two Complex Interface Adapter (CIA) chips asserts the drive select, side, motor, and step
   control lines; the other reads drive status such as track zero, write protect, ready, and disk change.
   The Gotek electrically appears to the Amiga exactly as a floppy drive does. It receives those
   same control lines and returns the same status and read data signals. From the mounted .adf
   disk image, it supplies the track and side selected by the Amiga. Paula sees the resulting read pulses
   on DKRD. That pin is Paula’s entire view of the drive’s read stream.

4. STEP4

   The read pulse stream is already reaching Paula 10c

   The Gotek presents the selected track as low pulses on DKRD, with each pulse representing
   a flux reversal in the disk image. Those pulses arrive before software arms the transfer. Arming chooses
   where Paula begins collecting the already flowing stream into words.

   The interval between successive pulses carries the data. This interval is often called delta t,
   written Δt. A transition becomes a one in the recovered cell stream, and each empty cell
   before the next transition becomes a zero.

   DKRD, Paula pin 37captured input

   falling edge	one pulse	one detected flux reversal
   cell period	about 2 µs	the timing unit Paula recovers
   delta t between edges	about 4, 6 or 8 µs	2, 3 or 4 recovered cells

   About 4 µs contributes 10, 6 µs contributes
   100, and 8 µs contributes 1000. Joining those groups reconstructs the raw
   MFM cell stream. Longer gaps occur outside the valid sector contents, including the track gap.

5. STEP5

   Software configures the destination and arms Paula 10p 10i

   Before a disk word crosses the bus, the CPU supplies the destination, prepares the completion
   interrupt, and writes the transfer length twice.

   writes that configure this readcaptured register writes

   1	DSKPTH $020	$0000	destination high half
   2	DSKPTL $022	$6B14	destination $006B14 in chip RAM
   3	INTREQ $09C	$1002	clear a stale disk interrupt
   4	INTENA $09A	$8002	enable the block complete interrupt
   5	DSKLEN $024	$9CBE	set enable, read, and 7,358 words
   6	DSKLEN $024	$9CBE	the second write arms the transfer

   Agnus owns the destination pointer and supplies every bus cycle and RAM address.
   Paula supplies requests and disk words. The length covers more than one complete track, so the read can begin
   anywhere in the track stream without ending before every sector has been presented.

   Why write the length register twice? The Amiga
   Hardware Reference Manual specifies this sequence. The write strobe is registered one stage
   earlier than the enable bit. On the first write, the sequencer sees the strobe before enable. On the
   second, enable is visible and the sequencer arms.

   what the arming instant predictsmodel prediction, confirmed later

   Aligning the captured bus words with the
   recovered cells places the first word boundary at the second DSKLEN write. That
   arming instant therefore establishes how Paula groups the already flowing stream into 16 bit
   words. No captured write sets the word sync enable in ADKCON, so word sync is
   disabled for this read and the sync marks should cut across DMA words at
   a stable phase. The later sync scan and the software shift provide the confirmation.

6. STEP6

   Each DKRD pulse becomes one internal event 10d

   A Schmitt trigger cleans the external pulse, and synchronizing latches bring it into Paula’s clock
   domain. The resulting internal level lasts for more than one clock. Paula reduces that active level
   to one event per flux reversal.

   This is standard clock domain crossing practice. Successive
   clocked storage stages give an edge that arrives near a clock boundary time to settle before the rest
   of the circuit uses it. A modern block diagram often shows this as two flip flops back to back. Paula
   reaches the same functional result with latches and surrounding gating.

   The synchronized path provides the current level and a copy delayed by one clock. A single gate
   combines them:

   event = current level AND NOT(previous level) AND enabled

   The expression is true for one clock after the internal level rises. Each pulse therefore becomes
   one event, regardless of how long the pulse remains active.

7. STEP7

   The DPLL recovers the embedded cell clock 10j 10k 10s 10t

   The floppy interface carries no separate clock signal; one wire delivers one pulse stream. The clock is
   embedded in that stream instead. MFM interleaves clock cells with data cells, so the stream carries
   its own timing and guarantees another transition within four cells. Paula recovers that timing to
   decide which cells contain transitions and which are empty.

   A DPLL is a digital phase locked loop. A PLL compares the phase of incoming transitions with a local
   timing reference and continuously adjusts that reference to stay locked.

   In Paula, an early or late event corrects the phase, while a repeated bias corrects the estimated
   cell rate. The result is one bit decision for every cell, including cells with no transition.

8. STEP8

   Paula copies sixteen raw MFM cells into one word 10q 10r 10h

   The disk data sent over the bus is still raw MFM. On each recovered cell boundary, Paula shifts the
   cell value into the receive register: one for a transition and zero for an empty cell. After 16 cells,
   the register holds one 16 bit Amiga word.

   Those 16 raw MFM bits do not represent 16 bits of usable file data. They still contain MFM clock bits,
   and the AmigaDOS data remains separated into odd and even halves. Software realigns and decodes the raw
   words in steps 16 and 17.

   Starting from the arming point in step 5, each successive group of 16 recovered cells therefore
   predicts the next raw word in the captured bus stream.

9. STEP9

   Sector sync preserves the existing word phase 10q 10r 10e

   Each sector begins with two $4489 sync marks. A missing clock bit makes that pattern
   illegal in ordinary MFM data, so it can identify a sector boundary from any starting position in the
   stream.

   The first read contains 13 sector starts, so it should contain 26 sync marks in 13 pairs. The
   recovered stream contains all 26 at one stable position within the DMA words. Paula keeps the word
   phase established at arming.

   $4489 in the recovered cellsreconstructed from captured flux

   sector starts	13	one pair at each start
   sync marks	26	all 13 expected pairs found
   whole DMA words	0	every mark straddles two words
   position within DMA word	cell offset 6	zero-based from the left, or MSB, side

   The word sync feature is switched off for this read. Here,
   cell offset 6 means the seventh cell from the left, counting from zero at the MSB side
   of the captured word. It is a serial-stream position, not conventional hardware bit 6; in conventional
   numbering, the sync begins at bit 9. Paula’s framing remains fixed to the arming instant from step 5,
   so every sync mark begins after six earlier cells, leaving ten cells in that word and six in the next.
   Step 16 shows the exact fit.

10. STEP10

    Finished words wait in a three stage queue 10l 10g

    Recovered cells arrive continuously, while Agnus provides three fixed disk slots during each scan
    line. Paula holds each completed word until the next available slot.

    The silicon reveals three 16 bit data stages and three matching valid bits. The capture shows their
    externally visible result:

    what queueing changespredicted external behavior

    usual delivery	2 words	during one scan line
    catch up delivery	3 words	when arrival phase requires the third slot
    word value and order	unchanged	delivery time moves

    The queue delays delivery while preserving word value and order.
    The next part follows the preserved value and order onto the chip bus.

    Each valid bit travels with its data word. Queue occupancy therefore predicts Paula’s external
    DMAL requests.

11. STEP11

    Paula asks Agnus for a slot 10g

    Agnus controls memory addressing and the register address lines. When a word needs moving, Paula
    requests a bus slot through DMAL.

    DMAL carries a fixed 16 slot serial frame at the start of each scan line, one bit per
    color clock from $00 through $0F. The Hardware Reference Manual names the pin’s
    audio and disk DMA request function, but does not spell out this format. The recovered circuit and the
    capture show how it works: the first two slots are zero, the next six describe disk DMA, and the final
    eight carry two bits for each of the four audio channels.

    The six disk bits are transmitted consecutively as three direction and request pairs, one pair for
    each queue stage. Disk bit 1, in slot $02, gives stage A’s transfer direction; bit 2, in
    $03, requests its bus transfer. Bits 3 and 4 do the same for stage B in slots
    $04 and $05, followed by bits 5 and 6 for stage C in $06 and
    $07. During a read, every direction bit is zero and a request bit is one when its stage
    contains a word for Agnus.

    
    

    
    

    DMAL request to Agnus grantcaptured result, whole capture

    serial frame	16 bits	one position encoded bit per color clock
    disk field	slots $02 through $07	direction and request for stages A, B and C
    request to grant	4 color clocks	7,752 of 7,752. Zero exceptions.
    request positions	$03 $05 $07	granting $07 $09 $0B
    words waiting	1, 2 or 3	last request, last two, or all three

    The number of request positions used on a line is the number of words Paula
    wants moved. The queue packs toward the output stage: one pending word uses only the last
    position, two words use the last two, and three use all three. Queue occupancy predicts
    the requests, and every request predicts its bus grant. DMAL carries no address field. Agnus
    identifies the requested transfer from the bit’s position in the frame, then grants the corresponding
    bus slot four color clocks later.

12. STEP12

    Agnus grants the request and the word crosses the chip bus

    Agnus owns the memory bus and the address generator. On the granted cycle the register address bus carries
    raw code $04, decoded here as register offset $008, while Paula drives its
    word onto the shared data bus. Agnus writes the word to the pointer address and advances that pointer
    by two bytes.

    The three disk slots sit together near the start of each scan line. A word that finishes after the
    last slot waits for the next line, while a word already waiting can leave immediately. The queue
    absorbs that variable delay while preserving the word value and order.

13. STEP13

    One captured word connects flux to RAM

    word #112 · six flux transitions · one bus word · one RAM address

    Let’s use word 112 as a concrete example because it lets us check every stage just described
    against the same piece of captured data. Word numbering counts from zero at the first delivered
    word, so word 112 lands 224 bytes past the programmed destination of $006B14, at
    $006BF4. Its six flux transitions become one 16 bit word, Paula
    places that word on the bus, and Agnus writes it to that known RAM address. Word 112 also contains
    the beginning of the first sector sync, so we can follow the same bits into the alignment work
    in Step 16.

    
    

    The first $4489 sync mark is split across words 112 and 113. The second
    spans words 113 and 114.

    1

    0

    1

    0

    1

    0

    0

    1

    0

    0

    0

    1

    0

    0

    1

    0

    0

    0

    1

    0

    0

    1

    0

    1

    0

    0

    0

    1

    0

    0

    1

    0

    0

    0

    1

    0

    0

    1

    0

    1

    0

    1

    0

    1

    0

    1

    0

    0

    word #112  $A912  → $006BF4

    word #113  $2512  → $006BF6

    word #114  $2554  → $006BF8

    
    

14. STEP14

    The same chain repeats across the entire read

    first read · 7,357 words

    The request, grant, bus, and memory sequence repeats for every word. Agnus advances from the
    programmed destination in consecutive two byte steps. The CPU leaves every disk register untouched,
    confirming that Paula and Agnus carry the transfer forward without software feeding them each word.

    
    
    
    

15. STEP15

    The counter runs out and the interrupt fires

    Paula counts down from the programmed length. When the count expires, the transfer sequencer stops
    accepting new words, drains the queue, and then raises the block complete interrupt.

    
    

    end of transfercaptured order

    1	disk word	$AAAA	the final queued word crosses
    2	IPL → 1		block complete reaches the CPU
    3	INTREQR $01E	$0042	the handler sees the disk bit; bit 6 is an unrelated pending blitter request
    4	INTREQ $09C	$0002	the handler acknowledges it
    5	DSKLEN $024	$4000	software stops the engine

    The final word crosses before the interrupt appears. The observed
    order confirms that queue drainage controls completion after the count expires.

    one word shortcaptured count: 7,358 asked, 7,357 delivered

    The length register programmed 7,358 words. This session put 7,357 on the bus. On the same page
    as the double write rule, the manual warns: “the last word in a disk read DMA
    operation may not come in, that is, one less word may be read than you asked for.” The capture
    shows exactly that.

    The continuity evidence places the missing word at the end. All 7,357 delivered words lock to the flux
    at one fixed offset and a constant 16 cell stride. Their destination addresses form one continuous
    range from the programmed pointer. After the final word, Paula stops requesting and every disk slot
    remains idle while the length register still holds its armed value.

16. STEP16

    The blitter aligns the sectors and rejoins their data bits

    Chip RAM now contains the raw MFM cells received by Paula. Two transformations remain. The sync pair
    begins at cell offset 6 within a DMA word, so every sector field crosses the word boundaries in memory. Within
    each sector, the Amiga sector format stores the odd bits of every original 32 bit value in one half and
    the even bits in another. MFM clock cells occupy every other position in both halves. The captured blits
    perform the alignment first and the odd and even merge later.

    the first blit after the readcaptured register writes

    1	BLTCON0 $040	$05CC	enable B and D; copy B through the logic function
    2	BLTCON1 $042	$A000	shift B right by 10 bits across successive words
    3	source B	$006BF0	begin with two words of lead in before the straddled sync
    4	destination D	$006B0E	write the realigned stream to an earlier buffer
    5	BLTSIZE $058	$15A0	86 rows of 32 words; this pass aligns 2,752 of the captured words

    The shifter treats successive source words as one continuous stream. Each output word receives the
    final ten bits of the previous source word followed by the first six bits of the current word. Step 13
    found the first sync after six earlier cells in source word $A912. Its remaining ten bits and
    the first six bits of $2512 therefore become one aligned $4489. The complementary
    shift follows directly from the captured phase: six cells precede the sync, leaving ten sync bits in that
    word for the shifter to carry into the high end of the aligned output.

    
    

    The second operation reverses the Amiga sector layout. Each original 32 bit value was separated into
    an odd half and an even half before MFM encoding. The mask $55555555, binary
    0101..., retains the data cell from each clock and data pair. The same mask applies to both
    halves. $AAAAAAAA selects the clock cell positions, so it does not contribute to the decoded
    value. Shifting the masked odd half left by one returns those bits to the odd positions. Combining that
    result with the masked even half reconstructs the original value.

    the later odd and even mergecaptured register writes

    1	BLTCDAT $070	$5555	supply the repeating data cell mask
    2	source A / B	$00828F / $00848F	read backward from two halves exactly $200 bytes apart; the software writes odd byte addresses, and the pointer registers have no bit 0, so the blitter reads the last word of each half
    3	BLTCON0 $040	$1DD8	shift A by one and select alternating bits from A and B
    4	BLTCON1 $042	$0002	descending mode makes the A shift move left
    5	BLTSIZE $058	$0808	produce 256 words, or one 512 byte decoded block

    The $D8 logic function uses the alternating C mask as a
    selector: positions where C is zero come from shifted A, and positions where C is one come from B.
    A is the odd half and B is the even half. This performs the mask, shift, and combine across the block.
    This recorded pass decodes track 80, sector 0. The lower panel uses odd and even values from that same
    block. Their result, $0B Aut, is the eleven character length and beginning of the volume
    name AutoInstall.

    The first transformation predicts the aligned sync pair, and the second predicts the decoded bytes.
    Both predictions match the captured blitter setup. The resulting checksums and filesystem structures in
    the next step test the complete reconstruction.

17. STEP17

    The whole chain, from flux to filesystem

    We can now put the complete path together. Figure 7 follows one example from flux transitions entering
    Paula, through its raw DMA words and Agnus, to the alignment and decoding explained in Step 16. The
    result is a recognizable name inside a valid filesystem block reconstructed from the captured signals.

    
    
    
    
    
    

    13 captured sector headers from track 80decoded validation: 11 unique, then 6 and 7 repeat

    sector	block	kind	name	size or result
    6	886	directory	System
    7	887	file header block	Insurance.info	622 bytes
    8	888	OFS data block (file contents)	block 1 of Insurance.info	488 bytes
    9	889	OFS data block (file contents)	block 2 of Insurance.info	134 bytes
    10	890	directory	l
    0	880	root	AutoInstall	the volume itself
    1	881	free space map	which blocks are in use
    2	882	file header block	DF-Prep	55,740 bytes
    3	883	file header block	.info	47 bytes
    4	884	OFS data block (file contents)	.info	47 bytes
    5	885	directory	c
    6	886	directory	System	second revolution
    7	887	file header block	Insurance.info	the transfer ends inside this repeated block

    All thirteen header checksums are valid, as are twelve of the thirteen data
    checksums. The word count from step 15 runs out inside the final sector, so its data arrives
    incomplete. The volume is called
    AutoInstall. Track 80 holds its root block, free space map, three directories, three file
    header blocks, and three OFS data blocks containing file contents.

    An incorrect phase, lost cell, changed word, or faulty
    odd and even merge would break these checksums or structures. Their agreement validates the
    electrical reconstruction end to end.

    complete file: .infoall 47 bytes of the file contents, recovered from sector 4

    0000	F3 4C 00 12 00 00 16 22 00 00 02 8C 00 00 00 BD	.L…..”……..
    0010	49 6E 73 75 72 61 6E 63 65 0A 53 68 65 6C 6C 0A	Insurance.Shell.
    0020	53 79 73 74 65 6D 0A 44 46 2D 50 72 65 70 0A	System.DF-Prep.

    Now scroll back to the photograph at the top of this post. c, System,
    l, DF-Prep, and Insurance.info appear in both the recovered
    filesystem structures and the Shell listing. Those structures came from DMA words observed on the
    captured chip bus.

18. STEP18

    The same interface starts a second read

    Before the Shell finishes printing the listing, the capture also records the setup sequence at the
    beginning of the next track read.

    the second readcaptured repeat setup

    1	DSKPTH / DSKPTL	$0000 / $6B14	reload the same buffer
    2	DSKLEN $024	$9CBE	first length write
    3	DSKLEN $024	$9CBE	second write arms the read
    4	captured sync pair	cell offset 4	a different word phase from the new arming instant

    The new arming instant places the captured sync pair at cell offset 4 rather than cell offset 6.
    The capture ends partway through this second transfer, so this is a phase check from one pair.