I should point out another possible purpose for these call trampolines.
A common problem with ROM and PDP-8 code is that the JMS instruction wants to modify RAM in the instruction area. Moving the target to page zero (with a trampoline there) allows all the rest to be ROM, except for page 0. This simplifies the rest of the hardware, which was probably done here.
The manual states that in case of a faulty RAM there’s the error code E9 followed by the address displayed on the upper line.
E9 is 0371. That is stored at 471 and that code happens at 535 after skips at 421 and 431. Then an infinite loop. There’s no output of that on page 0 except the count (RAM location -1) at 10. So IOTs 6410+6411 must be for the LCD. After that soon an index jump to 1123 for finally writing contents to page 0. At 1151 there are 49 words written with 0, locations 46-126.
[0431] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:3527 IR:5335 JMP @@35 ;Jump Current page @@35
[0535] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:3527 IR:1271 TAD @@71 ;Add operand to AC, Current page @@71
[0536] IRQ,DLY,IE=0,0,0 L/AC:1/0371 MQ:3527 IR:6410 SSRG ;DP8-EAEB: Skip if Ring Flag
[0537] IRQ,DLY,IE=0,0,0 L/AC:1/0371 MQ:3527 IR:1010 TAD 0010 ;Add operand to AC, ZP 0010
[0540] IRQ,DLY,IE=0,0,0 L/AC:1/0403 MQ:3527 IR:6411 SSCA ;DP8-EAEB: Skip if CarrierAGC Flag
[0541] IRQ,DLY,IE=0,0,0 L/AC:1/0403 MQ:3527 IR:5341 JMP @@41 ;Jump Current page @@41
[0541] IRQ,DLY,IE=0,0,0 L/AC:1/0403 MQ:3527 IR:5341 JMP @@41 ;Jump Current page @@41
A faulty ROM (unknown IRQs) results in E8 0004 and other hardware transfer errors in E8 0001 (or 2, 3). E8 is 0370 but that isn’t stored in ROM.
(On my emulator there are 4 different test patterns written (7256, 6534, 5270) and after that 0.)
After 1151 there’s 10 added and 370 written to 40, so E8 instead of 2 blanks followed by 407 and an infinite loop.
[0022] IRQ,DLY,IE=0,0,1 L/AC:1/0000 MQ:0000 IR:5531 JMP I 0131 ;Jump Indexed ZP 0131
[7010] IRQ,DLY,IE=0,0,1 L/AC:1/0000 MQ:0000 IR:1031 TAD 0031 ;Add operand to AC, ZP 0031
[7011] IRQ,DLY,IE=0,0,1 L/AC:1/0600 MQ:0000 IR:3045 DCA 0045 ;Deposit AC to memory then clear AC, ZP 0045
[7012] IRQ,DLY,IE=0,0,1 L/AC:1/0000 MQ:0000 IR:1417 TAD I 0017 ;Add operand to AC, Indexed ZP 0017 [Auto pre-inc]
[7013] IRQ,DLY,IE=0,0,1 L/AC:1/0400 MQ:0000 IR:3143 DCA 0143 ;Deposit AC to memory then clear AC, ZP 0143
[7014] IRQ,DLY,IE=0,0,1 L/AC:1/0000 MQ:0000 IR:1141 TAD 0141 ;Add operand to AC, ZP 0141
[7015] IRQ,DLY,IE=0,0,1 L/AC:1/0010 MQ:0000 IR:1237 TAD @@37 ;Add operand to AC, Current page @@37
[7016] IRQ,DLY,IE=0,0,1 L/AC:1/0370 MQ:0000 IR:3040 DCA 0040 ;Deposit AC to memory then clear AC, ZP 0040
Plausible data written to page 0 obviously confirms this ROM combination.
I now try to find code for the CRC check. With that I can find how the text is read and printed and maybe the key mapping.
Checksum calculation is probably similar like on PDP-8, but my sum has 6 digits (or up to 10) for an imported dedicated code region with 6 digits. A later comparison error would result in E3 xxxx (0363 not in ROM). A CRC check is initiated by F2 (322) and a printout with CRC by F1 (321 at 4707 but I haven’t found out how this is accessed). Maybe again calculated.
I found this code, but I didn’t know 0371 represents ‘E9’ (not even ‘f9’?). I was pretty sure it was attempting to display the pointer from location 0010.
I’m doing ‘br 0407;d ac 0;c’ in my simh.ini in an effort to clear AC after the initialization IOTs. That seems fine, and I get to my breakpoint at 0463. I can see that it has called the page 0 setup routine at 7731, then gone to 00456 to set up and enable interrupts.
The code at 00463 is strange, though. After setting 0072 and 0076 to 2000, it does a JMP I 31, which starts a loop, cycling via indirect JMPs to 0600, 0601, 0602, 0603, 0604, then back to 0600. Maybe the interrupt service can affect these pointers and break us out of the loop?
It definitely does, in at least a couple of cases.
The display is only uppercase. F0=320, F9= 331, E0=360. Blk 0=300. _0=340.
I found an output of 360 0 (E0 0 =Numpad key not allowed) eg when starting from 1044, and E8 004 (ROM error) but also E8 007 and 407 what is not documented. Either the AC contents weren’t yet correct or maybe the right value is BCD as well. I can’t guarantee that these values are LCD codes here at all. But looks likely.
Concerning CRC: I wondered how a 6 digit instruction is stored. It’s 17 bits (1-4-12) and photos of a cart suggest that each bit is written to a different IC. There are 2 pairs of 3 daughter boards with 12 and 4 chips each. I think the single bit is stored on the chips on the base PCB. That represents ELSE and FURTHERMORE both for 1, the 2 left buttons on the panel for a parallel program and also a new rung on a ladder logic.
So a CRC is not that simple and probably done in 3 parts. But to reduce space maybe one shared code with different indexed values.
I’m not sure if I’ll ever find code for that. So I first tried to continue after the RAM check.
I found an assumed far jump at 2241 target to 6400. Starting from that I got a 7356 output (3x_) and 2x16 replacing 14. 7356 is indexed from an index. Indexed at 7775, copied to 10 and then indexed again. I also found 37 instead of 47 written to 46.
[6400] IRQ,DLY,IE=0,1,0 L/AC:0/0000 MQ:0000 IR:1072 TAD 0072 ;Add operand to AC, ZP 0072
[6401] IRQ,DLY,IE=0,1,0 L/AC:0/0000 MQ:0000 IR:0204 AND @@04 ;AND operand with AC, Current page @@04
[6402] IRQ,DLY,IE=0,1,0 L/AC:0/0000 MQ:0000 IR:3072 DCA 0072 ;Deposit AC to memory then clear AC, ZP 0072
[6403] IRQ,DLY,IE=0,1,0 L/AC:0/0000 MQ:0000 IR:4017 JMS 0017 ;Jump to subroutine ZP 0017
[0020] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:1417 TAD I 0017 ;Add operand to AC, Indexed ZP 0017 [Auto pre-inc]
[0021] IRQ,DLY,IE=0,0,0 L/AC:0/7761 MQ:0000 IR:3131 DCA 0131 ;Deposit AC to memory then clear AC, ZP 0131
[0022] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:5531 JMP I 0131 ;Jump Indexed ZP 0131
[7761] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:1375 TAD @@75 ;Add operand to AC, Current page @@75
[7762] IRQ,DLY,IE=0,0,0 L/AC:0/3574 MQ:0000 IR:3010 DCA 0010 ;Deposit AC to memory then clear AC, ZP 0010
[7763] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:1410 TAD I 0010 ;Add operand to AC, Indexed ZP 0010 [Auto pre-inc]
[7764] IRQ,DLY,IE=0,0,0 L/AC:0/0016 MQ:0000 IR:3054 DCA 0054 ;Deposit AC to memory then clear AC, ZP 0054
[7765] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:1054 TAD 0054 ;Add operand to AC, ZP 0054
[7766] IRQ,DLY,IE=0,0,0 L/AC:0/0016 MQ:0000 IR:3055 DCA 0055 ;Deposit AC to memory then clear AC, ZP 0055
[7767] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:1410 TAD I 0010 ;Add operand to AC, Indexed ZP 0010 [Auto pre-inc]
[7770] IRQ,DLY,IE=0,0,0 L/AC:0/7356 MQ:0000 IR:3052 DCA 0052 ;Deposit AC to memory then clear AC, ZP 0052
[7771] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:3060 DCA 0060 ;Deposit AC to memory then clear AC, ZP 0060
[7772] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:3061 DCA 0061 ;Deposit AC to memory then clear AC, ZP 0061
[7773] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:3062 DCA 0062 ;Deposit AC to memory then clear AC, ZP 0062
[7774] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:5020 JMP 0020 ;Jump ZP 0020
[0020] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:1417 TAD I 0017 ;Add operand to AC, Indexed ZP 0017 [Auto pre-inc]
[0021] IRQ,DLY,IE=0,0,0 L/AC:0/1566 MQ:0000 IR:3131 DCA 0131 ;Deposit AC to memory then clear AC, ZP 0131
0040: 4314 7777 7777 7777 0652 0600 0047 0047 -LCD upper. 2x blk, 7777 or 4x0, default
0050: 4314 7777 7356 4000 0016 0016 0014 0014 2xblk on left, 3x_ right for entering a (decimal) value. 16=1x_?
I don’t know why there are 5 600x pointers. 4 locations + symbols of the LCD. 2+3 digits. Or 2x2 or 4+else that could be anything. 4 keys + enter.
I still have a deep confusion about the LCD display, which doesn’t seem to be getting any better. Perhaps the memory error code at 0535 will illustrate my confusion. The code there loads from 0471 the value 0371 (0x0F9), then does an IOT 6410. I’m assuming this loads the AC value into the LCD, then clears AC. The code then loads location 0010, which points to where the error occurred, and does IOT 6411.
Somehow, this creates the text “E9” on one line, and the address from location 0010 is somehow displayed as readable text on another. The 6100 CPU then does “JMP .”, with the interrupts off, so it presumably has no more involvement.
So how the heck are things encoded for IOTs 6410 and 6411? Is IOT 6410 always text, with a character chart somewhere? Is 6411 always a word value to display in numeric form? Or is the address being in the range of 0011-0177 somehow requesting a numeric display? Is the last digit of the IOT being used as a line number, or is that somehow coming from AC too?
It seems in general that there’s far too much going on with the display to be encoded with a 12 bit output value per line.
Or is the 0371 also a pointer, pointing at 0371, which seems to have 4527 4524 4167 0032 0261 0000 stored there?? Which might encode something, but still doesn’t explain the friendly display of the address.
The LCD has 4 locations addressed separately + symbols. There’s no text output except E and F for error and function.
I have a table with the BCD combinations. Numbers are I think just stored in octal, so there’s mainly of interest the combinations with E,F, blank and _ with the rest. 3 bits forming one digit, which are then added.
E left=360, “_” right= 16=376.
11- 11 1 -110
3 - 7- 6
F9 7777
*E8 999
E and F can only be displayed on the left positions, on upper right only an octal word, on lower right 3 decimal values (stored as octal 4 digits).
Error messages differ, some show the address like the faulty RAM cel, others show an encoded wrong key from what key group. Error can show E 0000 or E0 0000. Again, the programming is meant for the PLC which has the same LCD. I can only confirm the error messages on my device. E0-E9. Half of them are about BUS errors in combination with the PLC. The rest about RAM/ROM error and wrong key combination or syntax error. There must be tables of allowed keys and syntax and their error codes.
ASCII text output is reserved or was planned and should not work on this ROM. I assumed the empty page for that but that turned out page 0. There’s already one undocumented instruction for loading text obviously for an external display or an upcoming version. So loading one register with ASCII instead of decimal or memory content.
Some errors are severe like a ROM error, so there’s a loop. Others like a wrong key can be fixed and cleared.
The only character chart is that for a printout, mnemonics stored at 4000-4177.
Thanks! I think I get it this time.
You mention 4 regions. I’m aware of a two digit “bcd” region, a three digit “bcd” region, and an 4 digit octal region. What and where is the fourth region?
AP1. | AP2
AP3. | AP4
Two regions with 2 digits on the left, 2 on the right, top left=location 1.
A1-| A2
88 -8888
88- .888
A3 - A4
I tried also a start from 200. Very similar but overwriting pages 1, 2 and more. 1KWords.
After start from 400 and continue after the RAM check, with some skips reaching 431, skip after 7403 to 7404 there’s 7600 written to 32 where we have the 600x jumps.
Starting from 7600 , over 731, 740 and 670 I have this adding 1 take a 14 from 56, rotate left 4x → 320 +14 from 57=334 +4000 from 53.
320=F 334= F blank. 4000 is probably a squared symbol between location 3+4. So at 40 there’s very likely LCD values.
F is displayed when pressing the F key. So maybe I’ve found a keyboard IOT. Needs more checking. Just found.
(After 731 there’s a full loop starting again at 400.)
0000: 7421 5427 0000 0000 0000 0000 0000 0000
0010: 0020 0000 0000 0000 0000 0000 0000 0554
0020: 0000 3131 5531 0400 1423 2023 5021 7400
0030: 0602 0600 7600 0605 0604 0007 0010 0514
0040: 4314 7777 7761 7777 0652 0600 0047 0047
0050: 4334 7777 6314 4000 0014 0014 0014 0014 (later 4334)
0060: 0000 0000 0000 0000 0000 0000 0000 0000
0070: 0000 0000 2000 0000 0000 0000 0000 0000
[0670] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:0000 IR:1014 TAD 0014 ;Add operand to AC, ZP 0014
[0671] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:0000 IR:7040 CMA ;Complement AC
[0672] IRQ,DLY,IE=0,0,0 L/AC:1/7777 MQ:0000 IR:0145 AND 0145 ;AND operand with AC, ZP 0145
[0673] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:0000 IR:7421 MQL ;Load MQ from AC then clear AC
[0674] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:0000 IR:1145 TAD 0145 ;Add operand to AC, ZP 0145
[0675] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:0000 IR:7040 CMA ;Complement AC
[0676] IRQ,DLY,IE=0,0,0 L/AC:1/7777 MQ:0000 IR:0014 AND 0014 ;AND operand with AC, ZP 0014
[0677] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:0000 IR:7501 MQA ;OR MQ with AC
[0700] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:0000 IR:7001 IAC;Increment AC
[0701] IRQ,DLY,IE=0,0,0 L/AC:1/0001 MQ:0000 IR:6416 SSBE ;DP8-EAEB: Skip on Bus Error
[0702] IRQ,DLY,IE=0,0,0 L/AC:1/0001 MQ:0000 IR:1125 TAD 0125 ;Add operand to AC, ZP 0125
[0703] IRQ,DLY,IE=0,0,0 L/AC:1/0001 MQ:0000 IR:6416 SSBE ;DP8-EAEB: Skip on Bus Error
[0704] IRQ,DLY,IE=0,0,0 L/AC:1/0001 MQ:0000 IR:1056 TAD 0056 ;Add operand to AC, ZP 0056
[0705] IRQ,DLY,IE=0,0,0 L/AC:1/0015 MQ:0000 IR:7106 CLL RTL ;Clear L, Rotate AC & L left twice
[0706] IRQ,DLY,IE=0,0,0 L/AC:0/0064 MQ:0000 IR:7006 RTL ;Rotate AC & L left twice
[0707] IRQ,DLY,IE=0,0,0 L/AC:0/0320 MQ:0000 IR:1057 TAD 0057 ;Add operand to AC, ZP 0057
[0710] IRQ,DLY,IE=0,0,0 L/AC:0/0334 MQ:0000 IR:1053 TAD 0053 ;Add operand to AC, ZP 0053
[0711] IRQ,DLY,IE=0,0,0 L/AC:0/4334 MQ:0000 IR:1060 TAD 0060 ;Add operand to AC, ZP 0060
[0712] IRQ,DLY,IE=0,0,0 L/AC:0/4334 MQ:0000 IR:3050 DCA 0050 ;Deposit AC to memory then clear AC, ZP 0050
[0713] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:1046 TAD 0046 ;Add operand to AC, ZP 0046
[0714] IRQ,DLY,IE=0,0,0 L/AC:0/0047 MQ:0000 IR:3010 DCA 0010 ;Deposit AC to memory then clear AC, ZP 0010
[0715] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:1410 TAD I 0010 ;Add operand to AC, Indexed ZP 0010 [Auto pre-inc]
[0716] IRQ,DLY,IE=0,0,0 L/AC:0/4334 MQ:0000 IR:6410 SSRG ;DP8-EAEB: Skip if Ring Flag
[0717] IRQ,DLY,IE=0,0,0 L/AC:0/4334 MQ:0000 IR:1410 TAD I 0010 ;Add operand to AC, Indexed ZP 0010 [Auto pre-inc]
I found some memory contents around the LCD. There’s a branch >=0 at 7263. When I use -1 that’s the way how 2 blanks are stored at one of the left display locations at 40/50. 3 blanks are 6314. 2 blanks according table 314. The constant 14 at 56 is taken and rotated 8x the other constant at 57 added and the constant 4000 from 53. As numbers+numbers aren’t stored as BCD (but loaded as decimal on location 4), only powers of 10/16 make sense. After 00-09 comes 0+blk. what is 0014. 0_=16. I tried 7765 and got 54/4054 what is 2+blk. All other values < power of 10 result in 4334 (usually F+blk).
[7255] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0652 IR:7305 CLL CLA IAC RAL;Clear L, Set AC to 0001, Rotate AC & L left
[7256] IRQ,DLY,IE=0,0,0 L/AC:0/0002 MQ:0652 IR:6415 SRS1 ;DP8-EAEB: Read Status 1
[7257] IRQ,DLY,IE=0,0,0 L/AC:0/0002 MQ:0652 IR:6001 ION ;KK8-E: Interrupts enabled
[7260] IRQ,DLY,IE=0,0,1 L/AC:0/0002 MQ:0652 IR:1141 TAD 0141 ;Add operand to AC, ZP 0141
[7261] IRQ,DLY,IE=0,0,1 L/AC:0/0012 MQ:0652 IR:7640 SZA CLA ;Skip on AC = 0, Clear AC
[7262] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:0652 IR:7501 MQA ;OR MQ with AC
[7263] IRQ,DLY,IE=0,0,1 L/AC:0/0652 MQ:0652 IR:7710 SPA CLA ;Skip on AC >= 0, Clear AC
[7265] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:0652 IR:3141 DCA 0141 ;Deposit AC to memory then clear AC, ZP 0141
[7266] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:0652 IR:5020 JMP 0020 ;Jump ZP 0020
AC->7777 and skip (default 2xblk):
[7264] IRQ,DLY,IE=0,0,1 L/AC:0/7777 MQ:7600 IR:5444 JMP I 0044 ;Jump Indexed ZP 0044
[0652] IRQ,DLY,IE=0,0,1 L/AC:0/7777 MQ:7600 IR:2043 ISZ 0043 ;Increment operand and skip if zero, ZP 0043
[0653] IRQ,DLY,IE=0,0,1 L/AC:0/7777 MQ:7600 IR:5262 JMP @@62 ;Jump Current page @@62
[0662] IRQ,DLY,IE=0,0,1 L/AC:0/7777 MQ:7600 IR:1014 TAD 0014 ;Add operand to AC, ZP 0014
[0663] IRQ,DLY,IE=0,0,1 L/AC:0/7777 MQ:7600 IR:7421 MQL ;Load MQ from AC then clear AC
[0664] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:7777 IR:7301 CLL CLA IAC;Clear L, Set AC to 0001
[0665] IRQ,DLY,IE=0,0,1 L/AC:0/0001 MQ:7777 IR:0146 AND 0146 ;AND operand with AC, ZP 0146
[0666] IRQ,DLY,IE=0,0,1 L/AC:0/0001 MQ:7777 IR:7640 SZA CLA ;Skip on AC = 0, Clear AC
[0667] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:7777 IR:5277 JMP @@77 ;Jump Current page @@77
[0677] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:7777 IR:7501 MQA ;OR MQ with AC
[0700] IRQ,DLY,IE=0,0,1 L/AC:0/7777 MQ:7777 IR:7001 IAC;Increment AC
[0701] IRQ,DLY,IE=0,0,1 L/AC:1/0000 MQ:7777 IR:6416 SSBE ;DP8-EAEB: Skip on Bus Error
[0702] IRQ,DLY,IE=0,0,1 L/AC:1/0000 MQ:7777 IR:1125 TAD 0125 ;Add operand to AC, ZP 0125
[0703] IRQ,DLY,IE=0,0,1 L/AC:1/0000 MQ:7777 IR:6416 SSBE ;DP8-EAEB: Skip on Bus Error
[0704] IRQ,DLY,IE=0,0,1 L/AC:1/0000 MQ:7777 IR:1056 TAD 0056 ;Add operand to AC, ZP 0056
[0705] IRQ,DLY,IE=0,0,1 L/AC:1/0014 MQ:7777 IR:7106 CLL RTL ;Clear L, Rotate AC & L left twice
[0706] IRQ,DLY,IE=0,0,1 L/AC:0/0060 MQ:7777 IR:7006 RTL ;Rotate AC & L left twice
[0707] IRQ,DLY,IE=0,0,1 L/AC:0/0300 MQ:7777 IR:1057 TAD 0057 ;Add operand to AC, ZP 0057
[0710] IRQ,DLY,IE=0,0,1 L/AC:0/0314 MQ:7777 IR:1053 TAD 0053 ;Add operand to AC, ZP 0053
[0711] IRQ,DLY,IE=0,0,1 L/AC:0/4314 MQ:7777 IR:1060 TAD 0060 ;Add operand to AC, ZP 0060
[0712] IRQ,DLY,IE=0,0,1 L/AC:0/4314 MQ:7777 IR:3050 DCA 0050 ;Deposit AC to memory then clear AC, ZP 0050
I found an output of 360 0005 (E0 5) at 40/41. That is a wrong key from the group of the 7 control keys that’s not allowed after the current key. That is at 7662 after 7656 , 7647 , 7643 , 7611 , 7605 start. The value 5 is previously stored to 142.
And 777 is written to 34 (the 600x jump targets) and after continue there there’s the output.
Starting from 5622 there are 6 words written to 63-70. All are jump index pointers. 5673 3360 5612 0600 5667 7740. Even a 600.
The two 14 at 56+57 turn to 0. Starting from pointer 5667 results in output E0 4. That is a wrong key, brackets or “OR”.
I have to search for the other key groups. And maybe the syntax error codes. I have 6 groups of keys E0 0 =numpad 0-9. E0 1=either release key (9x), E0 2 instructions 8, E0 3 units 9, E0 4 brackets/OR 4, E0 5 controls 7 keys.
0000: 1157 5427 0000 0000 0000 0000 0000 0000
0010: 6114 0072 0000 0000 0000 0000 0000 5672
0020: 1417 3131 5531 5637 1423 2023 5021 7400
0030: 7332 0600 0601 0603 0604 0007 0010 0037 .7332
0040: 0360 0004 7777 7777 0652 0600 0037 0047 E0 top left, 4
0050: 4314 7777 6314 4000 0014 0014 0000 0000 2x0
0060: 0000 0000 0000 5673 3360 5612 0600 5667
0070: 7740 0000 2340 0000 0000 0000 0000 0000
0100: 0000 0000 0000 0000 0000 0000 0000 0000
0110: 0000 0000 0000 0000 0000 0000 0000 0000
0120: 0000 0000 0000 0000 0000 0000 0000 0000
0130: 0000 7010 0000 0000 0000 0000 0000 0000
0140: 0001 0000 0004 5612 0000 0000 0000 0000 4 our default
0150: 0067 0005 0000 0000 7736 0000 0000 0000
Finally I found how the first table with the 2 digit units and allowed operations is called. I also found a bit more about the LCD.
The first value 0410 for unit 10 is at 2742. The table starts 2 words earlier; 2740 is indexed at 2554. That index is stored to 12. The right byte (unit) is extracted and added to 134. If it’s not 0 the next value unit 11 is called. If none of the contents matched (last is 0) there will be a reset (RAM/ROM check) indexed at 23. But that pointer is confirmed to be changed. 6600 dummy or unit 0.
That must be for a syntax check (as some units aren’t on the keys). Error E1 or E2 followed by an address. Original start and current values of AC etc unknown and I haven’t checked all branches.
(Original start from 2501, AC must be <>0).
[2450] IRQ,DLY,IE=0,0,0 L/AC:1/3527 MQ:3527 IR:7041 CIA ;2s Complement AC
[2451] IRQ,DLY,IE=0,0,0 L/AC:1/4251 MQ:3527 IR:3134 DCA 0134 ;Deposit AC to memory then clear AC, ZP 0134
[2452] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:3527 IR:1354 TAD @@54 ;Add operand to AC, Current page @@54
[2453] IRQ,DLY,IE=0,0,0 L/AC:1/2740 MQ:3527 IR:3012 DCA 0012 ;Deposit AC to memory then clear AC, ZP 0012
[2454] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:3527 IR:1412 TAD I 0012 ;Add operand to AC, Indexed ZP 0012 [Auto pre-inc]
[2455] IRQ,DLY,IE=0,0,0 L/AC:1/6600 MQ:3527 IR:7450 SNA ;Skip on AC <> 0
[2457] IRQ,DLY,IE=0,0,0 L/AC:1/6600 MQ:3527 IR:0350 AND @@50 ;AND operand with AC, Current page @@50
[2460] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:3527 IR:1134 TAD 0134 ;Add operand to AC, ZP 0134
[2461] IRQ,DLY,IE=0,0,0 L/AC:1/4251 MQ:3527 IR:7640 SZA CLA ;Skip on AC = 0, Clear AC
[2462] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:3527 IR:5254 JMP @@54 ;Jump Current page @@54
[2454] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:3527 IR:1412 TAD I 0012 ;Add operand to AC, Indexed ZP 0012 [Auto pre-inc]
[2455] IRQ,DLY,IE=0,0,0 L/AC:1/0410 MQ:3527 IR:7450 SNA ;Skip on AC <> 0
[2457] IRQ,DLY,IE=0,0,0 L/AC:1/0410 MQ:3527 IR:0350 AND @@50 ;AND operand with AC, Current page @@50 - AND 77
[2460] IRQ,DLY,IE=0,0,0 L/AC:1/0010 MQ:3527 IR:1134 TAD 0134 ;Add operand to AC, ZP 0134
[2461] IRQ,DLY,IE=0,0,0 L/AC:1/4261 MQ:3527 IR:7640 SZA CLA ;Skip on AC = 0, Clear AC
[2462] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:3527 IR:5254 JMP @@54 ;Jump Current page @@54
[2454] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:3527 IR:1412 TAD I 0012 ;Add operand to AC, Indexed ZP 0012 [Auto pre-inc]
[2455] IRQ,DLY,IE=0,0,0 L/AC:1/7411 MQ:3527 IR:7450 SNA ;Skip on AC <> 0
same with unit 10 as AC (also stored to 106). Again a reset to 400. So must be branch before.
[2450] IRQ,DLY,IE=0,1,0 L/AC:0/0010 MQ:0000 IR:7041 CIA ;2s Complement AC
..
[2457] IRQ,DLY,IE=0,0,0 L/AC:0/0410 MQ:0000 IR:0350 AND @@50 ;AND operand with AC, Current page @@50
[2460] IRQ,DLY,IE=0,0,0 L/AC:0/0010 MQ:0000 IR:1134 TAD 0134 ;Add operand to AC, ZP 0134
[2461] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:0000 IR:7640 SZA CLA ;Skip on AC = 0, Clear AC
[2463] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:0000 IR:1012 TAD 0012 ;Add operand to AC, ZP 0012
[2464] IRQ,DLY,IE=0,0,0 L/AC:1/2742 MQ:0000 IR:3134 DCA 0134 ;Deposit AC to memory then clear AC, ZP 0134
[2465] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:0000 IR:1534 TAD I 0134 ;Add operand to AC, Indexed ZP 0134
[2466] IRQ,DLY,IE=0,0,0 L/AC:1/0410 MQ:0000 IR:3106 DCA 0106 ;Deposit AC to memory then clear AC, ZP 0106
[2467] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:0000 IR:1103 TAD 0103 ;Add operand to AC, ZP 0103
[2470] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:0000 IR:7160 STL CMA ;Set L, Complement AC
[2471] IRQ,DLY,IE=0,0,0 L/AC:1/7777 MQ:0000 IR:3135 DCA 0135 ;Deposit AC to memory then clear AC, ZP 0135
[2472] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:0000 IR:7010 RAR ;Rotate AC & L right
[2473] IRQ,DLY,IE=0,0,0 L/AC:0/4000 MQ:0000 IR:2135 ISZ 0135 ;Increment operand and skip if zero, ZP 0135
[2475] IRQ,DLY,IE=0,0,0 L/AC:0/4000 MQ:0000 IR:0106 AND 0106 ;AND operand with AC, ZP 0106
[2476] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:7440 SZA ;Skip on AC = 0
[2500] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:7301 CLL CLA IAC;Clear L, Set AC to 0001
[2501] IRQ,DLY,IE=0,0,0 L/AC:0/0001 MQ:0000 IR:3141 DCA 0141 ;Deposit AC to memory then clear AC, ZP 0141
[2502] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:1102 TAD 0102 ;Add operand to AC, ZP 0102
[2503] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:3142 DCA 0142 ;Deposit AC to memory then clear AC, ZP 0142
[2504] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:1107 TAD 0107 ;Add operand to AC, ZP 0107
[2505] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:7640 SZA CLA ;Skip on AC = 0, Clear AC
[2507] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:5423 JMP I 0023 ;Jump Indexed ZP 0023
[0400] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:6007 CAF ;KK8-E: Clear all flags
Printing on LCD line 1 (40) is only at 7016 starting from 1011. Printing line 2 (50) is at 712 starting from 7264 (AC <0). E and F should only displayed on the upper line (top left Ex) and address or error kind on top right.
3x blk is 6314, bit pattern 110011001100, 1xblk=14. 2x blk+ unknown/entered decimal digit is 6300. That is printed to 52 starting from 6737. The right digit is added from 126 what is 0 by default.
That last digit has to be entered before, but at 6714 it’s not the IOT 6342. That is a pointer after 6713.
At 7731 and 1133 (indexed at 131) there’s a routine for updating/deleting the LCD. Index later changes to 5152 and 7275, 7400, 2712.
Start at 6275 skipping to 652 (index at 44) with some 64xx, 643x IOTs result in a branch at 737 (and 733) . If AC=0 then it resets to 400 (RAM check). AC has to be first positive then (keyboard value ?) negative. I don’t know the values for a single key.
THANKS very much indeed for your help! Especially for pointing out the correct ROM order (pairs were correct). I now have a basic understanding of how it works. I think, I now just want to find how a printout works and I think I’m very close (around 4414?). The mnemonics are at 4000 and that only appears 5x and none seems to be the pointer.
I noticed that new code is written (or copied) to page 0. So that is very hard to find. Instruction 7330 (CLA CLL CML RAR) producing 4000 to AC. A DCA writing that, like to 170 and 77. I once found code branching into that text page. Code is probably not wrong but the pointer on page 0 is still empty, so there must be other code before.
I found some subroutines updating the LCD at ~7750-7774. Probably when entering 3 digits on location 4 and pushing contents to the left removing blanks or_. One remaining pair is stored at 60. Trying 7356=3x_.
(6300= blk+blk+entered digit. 6000=blk+2digits, 356=2x_ right, 756=similar, with separator?)
[6734] IRQ,DLY,IE=0,0,0 L/AC:0/7356 MQ:0000 IR:1261 TAD @@61 ;Add operand to AC, Current page @@61
[6735] IRQ,DLY,IE=0,0,0 L/AC:0/7756 MQ:0000 IR:1310 TAD @@10 ;Add operand to AC, Current page @@10
[6736] IRQ,DLY,IE=0,0,0 L/AC:1/0756 MQ:0000 IR:3060 DCA 0060 ;Deposit AC to memory then clear AC, ZP 0060
[6737] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:0000 IR:1052 TAD 0052 ;Add operand to AC, ZP 0052
[6740] IRQ,DLY,IE=0,0,0 L/AC:1/6300 MQ:0000 IR:7002 BSW ;Byte Swap AC
[6741] IRQ,DLY,IE=0,0,0 L/AC:1/0063 MQ:0000 IR:7012 RTR ;Rotate AC & L right twice
[6742] IRQ,DLY,IE=0,0,0 L/AC:1/6014 MQ:0000 IR:0375 AND @@75 ;AND operand with AC, Current page @@75
[6743] IRQ,DLY,IE=0,0,0 L/AC:1/0014 MQ:0000 IR:3055 DCA 0055 ;Deposit AC to memory then clear AC, ZP 0055
[6744] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:0000 IR:1052 TAD 0052 ;Add operand to AC, ZP 0052
[6745] IRQ,DLY,IE=0,0,0 L/AC:1/6300 MQ:0000 IR:0307 AND @@07 ;AND operand with AC, Current page @@07
[6746] IRQ,DLY,IE=0,0,0 L/AC:1/0300 MQ:0000 IR:7106 CLL RTL ;Clear L, Rotate AC & L left twice
[6747] IRQ,DLY,IE=0,0,0 L/AC:0/1400 MQ:0000 IR:7006 RTL ;Rotate AC & L left twice
[6750] IRQ,DLY,IE=0,0,0 L/AC:0/6000 MQ:0000 IR:1126 TAD 0126 ;Add operand to AC, ZP 0126
[6751] IRQ,DLY,IE=0,0,0 L/AC:0/6000 MQ:0000 IR:3052 DCA 0052 ;Deposit AC to memory then clear AC, ZP 0052
0040: 4314 7777 7777 7777 0652 0600 0047 0047 .LCD
0050: 4314 7777 6000 4000 0014 0014 0014 0014
0060: 0756 0000 0000 0000 0000 0000 0000 0000 .new 60
Starting from 3571 where are values for the LCD, I found 5 pointers (from 5361) written to page 0 173-177. A bit later there’s the call of table 1 (2407/2450) indexed at the pointer 131. Some words are code.
0000: 1157 5427 0000 0000 0000 0000 0000 0000
0010: 5373 0167 2741 0000 0000 0000 0164 6237
0020: 1417 3131 5531 6012 1423 2023 5021 7400
0030: 7332 0600 0601 0603 0604 0007 0010 0037 .new 7332
0040: 4314 7777 7777 7777 0652 0600 0047 0047 LCD contents
0050: 4314 0000 6314 0000 0014 0014 0014 0014 "
0060: 0000 0000 0000 0000 0000 0000 0000 0000
0070: 0000 0000 0000 0000 0000 0000 0000 4000
0100: 0000 0000 0000 0000 0000 0000 6600 0000
0110: 0000 0010 0000 7776 0000 7765 0000 0000
0120: 0000 0000 0000 0000 0007 0000 0000 0000
0130: 0000 7600 0000 0000 2735 4000 0000 0000 2735 near table 1
0140: 0000 0000 0004 0000 0000 0000 0000 0000
0150: 0076 0000 0000 0000 7736 0000 0000 0000
0160: 0000 0000 0000 0000 0000 0000 0000 4000
0170: 0000 0000 0000 5574 4313 5436 5577 4267 .new code
Starting from 4313, the second pointer, it adds 60 and JMP to 176 where’s a JMP indexed at 177. And 175 is overwritten with the return stack 4315. There’s a jump indexed at 172 what is still 0. That might be correct as 0 is a pointer but 170 and maybe 171, 172 is written a bit later.
[4313] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:4477 IR:1363 TAD @@63 ;Add operand to AC, Current page @@63
[4314] IRQ,DLY,IE=0,0,0 L/AC:1/0060 MQ:4477 IR:4175 JMS 0175 ;Jump to subroutine ZP 0175
[0176] IRQ,DLY,IE=0,0,0 L/AC:1/0060 MQ:4477 IR:5577 JMP I 0177 ;Jump Indexed ZP 0177
[4267] IRQ,DLY,IE=0,0,0 L/AC:1/0060 MQ:4477 IR:1361 TAD @@61 ;Add operand to AC, Current page @@61
[4270] IRQ,DLY,IE=0,0,0 L/AC:1/1660 MQ:4477 IR:7104 CLL RAL ;Clear L, Rotate AC & L left
[4271] IRQ,DLY,IE=0,0,0 L/AC:0/3540 MQ:4477 IR:7421 MQL ;Load MQ from AC then clear AC
[4272] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:3540 IR:1115 TAD 0115 ;Add operand to AC, ZP 0115
[4273] IRQ,DLY,IE=0,0,0 L/AC:0/7765 MQ:3540 IR:3135 DCA 0135 ;Deposit AC to memory then clear AC, ZP 0135
[4274] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:3540 IR:6002 IOF ;KK8-E: Interrupts disabled
[4275] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:3540 IR:1116 TAD 0116 ;Add operand to AC, ZP 0116
[4276] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:3540 IR:3134 DCA 0134 ;Deposit AC to memory then clear AC, ZP 0134
[4277] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:3540 IR:2134 ISZ 0134 ;Increment operand and skip if zero, ZP 0134
[4300] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:3540 IR:5277 JMP @@77 ;Jump Current page @@77
[4277] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:3540 IR:2134 ISZ 0134 ;Increment operand and skip if zero, ZP 0134
[4300] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:3540 IR:5277 JMP @@77 ;Jump Current page @@77
..skip
[4301] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:3540 IR:7501 MQA ;OR MQ with AC
[4302] IRQ,DLY,IE=0,0,0 L/AC:0/3540 MQ:3540 IR:7110 CLL RAR ;Clear L, Rotate AC & L right
[4303] IRQ,DLY,IE=0,0,0 L/AC:0/1660 MQ:3540 IR:7421 MQL ;Load MQ from AC then clear AC
[4304] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:1660 IR:7010 RAR ;Rotate AC & L right
[4305] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:1660 IR:1362 TAD @@62 ;Add operand to AC, Current page @@62
[4306] IRQ,DLY,IE=0,0,0 L/AC:0/2100 MQ:1660 IR:6415 SRS1 ;DP8-EAEB: Read Status 1
[4307] IRQ,DLY,IE=0,0,0 L/AC:0/2100 MQ:1660 IR:2135 ISZ 0135 ;Increment operand and skip if zero, ZP 0135
[4310] IRQ,DLY,IE=0,0,0 L/AC:0/2100 MQ:1660 IR:5275 JMP @@75 ;Jump Current page @@75
[4275] IRQ,DLY,IE=0,0,0 L/AC:0/2100 MQ:1660 IR:1116 TAD 0116 ;Add operand to AC, ZP 0116
[4276] IRQ,DLY,IE=0,0,0 L/AC:0/2100 MQ:1660 IR:3134 DCA 0134 ;Deposit AC to memory then clear AC, ZP 0134
[4277] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:1660 IR:2134 ISZ 0134 ;Increment operand and skip if zero, ZP 0134
[4300] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:1660 IR:5277 JMP @@77 ;Jump Current page @@77
[4277] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:1660 IR:2134 ISZ 0134 ;Increment operand and skip if zero, ZP 0134
..
[4311] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:1660 IR:6001 ION ;KK8-E: Interrupts enabled
[4312] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:1660 IR:5575 JMP I 0175 ;Jump Indexed ZP 0175
[4315] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:1660 IR:5572 JMP I 0172 ;Jump Indexed ZP 0172
[0000] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:1660 IR:1157 TAD 0157 ;Add operand to AC, ZP 0157
[0001] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:1660 IR:5427 JMP I 0027 ;Jump Indexed ZP 0027
[7400] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:1660 IR:3152 DCA 0152 ;Deposit AC to memory then clear AC, ZP 0152
[7401] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:1660 IR:6402 SSRO ;DP8-EAEB: Skip If Receive Word Count Overflow
You are welcome. I am glad I was able to help. I had intended to do more, but it looks like my other projects are ramping up and I’m going to be swamped (not unusual) for a while.
Vince