A major progress and another confirmation that the ROM pair 51 62 (but swapped) is correct.
There are very few constants in the manual. The LCD display location 4 (bottom right, load AP4 (04 0054) with adress 06…) has the operand 7356 means all 3 digits underlines _ _ _ . That is also the 12 bit bit pattern. And 6314 means 3x blanks. I found both together followed by one other word.
At location 5575 I found 0016 7356 0014 6314. 16 means the right of 2 digits is an underline, 14 blank. I have a table with the combinations of the value with the left digit. Locations are data regions according the PAL file. There are also referrences for both.
At 4144 I have 0100 0756 2132, 1000 7356 2135, 2000 7356 2135, 3000 0356 2132, 3400 2356 2132, 0031 0061 2140 and 3 more ending with 2140. Before and after all this 0000. Ending at 4177 what is the end of page 20.
So 7356. 356 is according the table _ _ (BCD encoded) and 756 and 2356 have one bit more, maybe the separation between locations 1+2 upper line or the symbols left to location 3. The display:
EE .7777
*EE 888
1000, 2000 could be a RAM location or the address for the LCD. 2135 could also be the LCD address. Or the wandering digit when entering a number pushing the other ones to the left. The bottom line, so 5x_ is displayed when entering code.
The online emu showing the Sixbit character representations when downloading the automatic disassembly from a bin file and when reloading or for a PAL file the data locations even better than d8tape but both are not perfect, especially for the 6100 CPU. Not r obviously is data.
4147 1000 r | TAD S00000
4150 7356 | CLA CLL CMA RTL RTR
4151 2135 r | ISZ D00135
4152 2000 r | ISZ S00000
4153 7356 | CLA CLL CMA RTL RTR
4154 2135 r | ISZ D00135
5575 0016 r | AND P00016
5576 7356 | CLA CLL CMA RTL RTR
5577 0014 r | AND P00014
|
*5600 | *5600 -new page
5600 6314 | 6314
5601 1104 r | TAD D00104
4000 is the start of the 2nd half of the ROM. Probably the complete page or even much more is data (concerning the LCD). Maybe error codes?
3770 - 7772 0070 1104 7650 5776 5777 3456 3651
--------------------------------------------- Page 20
4000 - 7344 1126 7710 1374 1374 0125 3125 4023
4010 - 6342 1126 3103 1126 1322 3134 1534 3074
4020 - 1126 3054 7301 0074 7650 5231 1341 3055
4030 - 7325 1313 3010 1410 3067 1410 3070 1410
4040 - 3071 3073 3075 5431 7346 1126 7650 5252
4050 - 2103 2126 1103 3054 3055 1126 3104 1126
4060 - 3052 3074 3070 1125 0342 3125 4017 2143
4070 - 1566 2040 1126 1126 1126 1267 3010 3074
4100 - 1410 3104 1104 7006 7006 0035 3055 1410
4110 - 3052 1410 5232 2113 6737 7774 7760 6744
4120 - 7775 7774 2123 7560 7560 7400 7410 4600
4130 - 4760 0000 0001 6753 7776 7760 6744 7775
4140 - 7760 0014 0020 0000 0100 0756 2132 1000
4150 - 7356 2135 2000 7356 2135 3000 0356 2132
4160 - 3400 2356 2132 0031 0061 2140 0032 0062
4170 - 2140 0033 0063 2140 0010 0020 2140 0000
--------------------------------------------- Page 21
The only 2 referrences for 5575 and 5577 (None for 5576). Probably both are inside data sections themselves.
2310 5275 r | JMP L02275
2311 6001 | ION -usually IRQ, but probably data, RAM location for the following word?
2312 5575 r | JMP I P00175 -here ref
2313 1363 r | TAD D02363
…probably still data, following from a regular disassembly including Sixbit
02356 7774 >; | a2356, SPA SNA SZL CLA OSR
02357 0077 @> | a2357, AND M77
02360 0040 @ | a2360, AND M40
02361 1600 N@ | a2361, TAD I M2200
02362 2100 Q@ | a2362, ISZ M100
02363 0060 @/ | a2363, AND M60
02364 0017 @O | a2364, AND M17
02365 0105 AE | a2365, AND M105
02366 4163 !2 | a2366, JMS C163
02367 0040 @ | a2367, AND M40
02370 4017 O | a2370, JMS C17
02371 3561 ]0 | a2371, DCA I M161
02372 1357 K. | a2372, TAD M2357
02373 7744 >$ | a2373, SMA SZA CLA OSR
02374 7155 8- | a2374, CLL CMA IAC 016
02375 2333 S[ | a2375, ISZ M2333
3352 7272 | CLA CML CMA RTR
3353 6474 | 6474 -usually an IOT but obviously all data
3354 6267 | 6267
3355 0011 | D03355, 0011
3356 0012 | D03356, 0012
3357 0200 | D03357, 0200
3360 7764 | D03360, 7764
3361 7731 | D03361, 7731
3362 5502 | D03362, 5502
3363 5473 | D03363, 5473
3364 5463 | D03364, 5463
3365 0036 | D03365, 0036
3366 7756 | D03366, 7756
3367 5574 r | JMP I P00174
3370 7313 | JMS 3313
3371 5436 | D03371, 5436
3372 5577 r | JMP I P00177 -here ref
3373 7267 | JMS 3267
3374 1377 r | TAD D03377
Maybe 70-80% of the ROM is data, mainly bit patterns. And maybe RAM code is created/patched and relocated in a run. Start is probably at 600/601 (vector at 7777). When branching to page 00 (< 0200) with changing contents and unclear 6100 behavior I get lost. I have to search for more code locations and data like error codes. I prevously only searched for 4 digit error codes. But there are also 5 digit ones.