I should point out another possible purpose for these call trampolines.
A common problem with ROM and PDP-8 code is that the JMS instruction wants to modify RAM in the instruction area. Moving the target to page zero (with a trampoline there) allows all the rest to be ROM, except for page 0. This simplifies the rest of the hardware, which was probably done here.
The manual states that in case of a faulty RAM there’s the error code E9 followed by the address displayed on the upper line.
E9 is 0371. That is stored at 471 and that code happens at 535 after skips at 421 and 431. Then an infinite loop. There’s no output of that on page 0 except the count (RAM location -1) at 10. So IOTs 6410+6411 must be for the LCD. After that soon an index jump to 1123 for finally writing contents to page 0. At 1151 there are 49 words written with 0, locations 46-126.
[0431] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:3527 IR:5335 JMP @@35 ;Jump Current page @@35
[0535] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:3527 IR:1271 TAD @@71 ;Add operand to AC, Current page @@71
[0536] IRQ,DLY,IE=0,0,0 L/AC:1/0371 MQ:3527 IR:6410 SSRG ;DP8-EAEB: Skip if Ring Flag
[0537] IRQ,DLY,IE=0,0,0 L/AC:1/0371 MQ:3527 IR:1010 TAD 0010 ;Add operand to AC, ZP 0010
[0540] IRQ,DLY,IE=0,0,0 L/AC:1/0403 MQ:3527 IR:6411 SSCA ;DP8-EAEB: Skip if CarrierAGC Flag
[0541] IRQ,DLY,IE=0,0,0 L/AC:1/0403 MQ:3527 IR:5341 JMP @@41 ;Jump Current page @@41
[0541] IRQ,DLY,IE=0,0,0 L/AC:1/0403 MQ:3527 IR:5341 JMP @@41 ;Jump Current page @@41
A faulty ROM (unknown IRQs) results in E8 0004 and other hardware transfer errors in E8 0001 (or 2, 3). E8 is 0370 but that isn’t stored in ROM.
(On my emulator there are 4 different test patterns written (7256, 6534, 5270) and after that 0.)
After 1151 there’s 10 added and 370 written to 40, so E8 instead of 2 blanks followed by 407 and an infinite loop.
[0022] IRQ,DLY,IE=0,0,1 L/AC:1/0000 MQ:0000 IR:5531 JMP I 0131 ;Jump Indexed ZP 0131
[7010] IRQ,DLY,IE=0,0,1 L/AC:1/0000 MQ:0000 IR:1031 TAD 0031 ;Add operand to AC, ZP 0031
[7011] IRQ,DLY,IE=0,0,1 L/AC:1/0600 MQ:0000 IR:3045 DCA 0045 ;Deposit AC to memory then clear AC, ZP 0045
[7012] IRQ,DLY,IE=0,0,1 L/AC:1/0000 MQ:0000 IR:1417 TAD I 0017 ;Add operand to AC, Indexed ZP 0017 [Auto pre-inc]
[7013] IRQ,DLY,IE=0,0,1 L/AC:1/0400 MQ:0000 IR:3143 DCA 0143 ;Deposit AC to memory then clear AC, ZP 0143
[7014] IRQ,DLY,IE=0,0,1 L/AC:1/0000 MQ:0000 IR:1141 TAD 0141 ;Add operand to AC, ZP 0141
[7015] IRQ,DLY,IE=0,0,1 L/AC:1/0010 MQ:0000 IR:1237 TAD @@37 ;Add operand to AC, Current page @@37
[7016] IRQ,DLY,IE=0,0,1 L/AC:1/0370 MQ:0000 IR:3040 DCA 0040 ;Deposit AC to memory then clear AC, ZP 0040
Plausible data written to page 0 obviously confirms this ROM combination.
I now try to find code for the CRC check. With that I can find how the text is read and printed and maybe the key mapping.
Checksum calculation is probably similar like on PDP-8, but my sum has 6 digits (or up to 10) for an imported dedicated code region with 6 digits. A later comparison error would result in E3 xxxx (0363 not in ROM). A CRC check is initiated by F2 (322) and a printout with CRC by F1 (321 at 4707 but I haven’t found out how this is accessed). Maybe again calculated.
I found this code, but I didn’t know 0371 represents ‘E9’ (not even ‘f9’?). I was pretty sure it was attempting to display the pointer from location 0010.
I’m doing ‘br 0407;d ac 0;c’ in my simh.ini in an effort to clear AC after the initialization IOTs. That seems fine, and I get to my breakpoint at 0463. I can see that it has called the page 0 setup routine at 7731, then gone to 00456 to set up and enable interrupts.
The code at 00463 is strange, though. After setting 0072 and 0076 to 2000, it does a JMP I 31, which starts a loop, cycling via indirect JMPs to 0600, 0601, 0602, 0603, 0604, then back to 0600. Maybe the interrupt service can affect these pointers and break us out of the loop?
It definitely does, in at least a couple of cases.
The display is only uppercase. F0=320, F9= 331, E0=360. Blk 0=300. _0=340.
I found an output of 360 0 (E0 0 =Numpad key not allowed) eg when starting from 1044, and E8 004 (ROM error) but also E8 007 and 407 what is not documented. Either the AC contents weren’t yet correct or maybe the right value is BCD as well. I can’t guarantee that these values are LCD codes here at all. But looks likely.
Concerning CRC: I wondered how a 6 digit instruction is stored. It’s 17 bits (1-4-12) and photos of a cart suggest that each bit is written to a different IC. There are 2 pairs of 3 daughter boards with 12 and 4 chips each. I think the single bit is stored on the chips on the base PCB. That represents ELSE and FURTHERMORE both for 1, the 2 left buttons on the panel for a parallel program and also a new rung on a ladder logic.
So a CRC is not that simple and probably done in 3 parts. But to reduce space maybe one shared code with different indexed values.
I’m not sure if I’ll ever find code for that. So I first tried to continue after the RAM check.
I found an assumed far jump at 2241 target to 6400. Starting from that I got a 7356 output (3x_) and 2x16 replacing 14. 7356 is indexed from an index. Indexed at 7775, copied to 10 and then indexed again. I also found 37 instead of 47 written to 46.
[6400] IRQ,DLY,IE=0,1,0 L/AC:0/0000 MQ:0000 IR:1072 TAD 0072 ;Add operand to AC, ZP 0072
[6401] IRQ,DLY,IE=0,1,0 L/AC:0/0000 MQ:0000 IR:0204 AND @@04 ;AND operand with AC, Current page @@04
[6402] IRQ,DLY,IE=0,1,0 L/AC:0/0000 MQ:0000 IR:3072 DCA 0072 ;Deposit AC to memory then clear AC, ZP 0072
[6403] IRQ,DLY,IE=0,1,0 L/AC:0/0000 MQ:0000 IR:4017 JMS 0017 ;Jump to subroutine ZP 0017
[0020] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:1417 TAD I 0017 ;Add operand to AC, Indexed ZP 0017 [Auto pre-inc]
[0021] IRQ,DLY,IE=0,0,0 L/AC:0/7761 MQ:0000 IR:3131 DCA 0131 ;Deposit AC to memory then clear AC, ZP 0131
[0022] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:5531 JMP I 0131 ;Jump Indexed ZP 0131
[7761] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:1375 TAD @@75 ;Add operand to AC, Current page @@75
[7762] IRQ,DLY,IE=0,0,0 L/AC:0/3574 MQ:0000 IR:3010 DCA 0010 ;Deposit AC to memory then clear AC, ZP 0010
[7763] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:1410 TAD I 0010 ;Add operand to AC, Indexed ZP 0010 [Auto pre-inc]
[7764] IRQ,DLY,IE=0,0,0 L/AC:0/0016 MQ:0000 IR:3054 DCA 0054 ;Deposit AC to memory then clear AC, ZP 0054
[7765] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:1054 TAD 0054 ;Add operand to AC, ZP 0054
[7766] IRQ,DLY,IE=0,0,0 L/AC:0/0016 MQ:0000 IR:3055 DCA 0055 ;Deposit AC to memory then clear AC, ZP 0055
[7767] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:1410 TAD I 0010 ;Add operand to AC, Indexed ZP 0010 [Auto pre-inc]
[7770] IRQ,DLY,IE=0,0,0 L/AC:0/7356 MQ:0000 IR:3052 DCA 0052 ;Deposit AC to memory then clear AC, ZP 0052
[7771] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:3060 DCA 0060 ;Deposit AC to memory then clear AC, ZP 0060
[7772] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:3061 DCA 0061 ;Deposit AC to memory then clear AC, ZP 0061
[7773] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:3062 DCA 0062 ;Deposit AC to memory then clear AC, ZP 0062
[7774] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:5020 JMP 0020 ;Jump ZP 0020
[0020] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:1417 TAD I 0017 ;Add operand to AC, Indexed ZP 0017 [Auto pre-inc]
[0021] IRQ,DLY,IE=0,0,0 L/AC:0/1566 MQ:0000 IR:3131 DCA 0131 ;Deposit AC to memory then clear AC, ZP 0131
0040: 4314 7777 7777 7777 0652 0600 0047 0047 -LCD upper. 2x blk, 7777 or 4x0, default
0050: 4314 7777 7356 4000 0016 0016 0014 0014 2xblk on left, 3x_ right for entering a (decimal) value. 16=1x_?
I don’t know why there are 5 600x pointers. 4 locations + symbols of the LCD. 2+3 digits. Or 2x2 or 4+else that could be anything. 4 keys + enter.
I still have a deep confusion about the LCD display, which doesn’t seem to be getting any better. Perhaps the memory error code at 0535 will illustrate my confusion. The code there loads from 0471 the value 0371 (0x0F9), then does an IOT 6410. I’m assuming this loads the AC value into the LCD, then clears AC. The code then loads location 0010, which points to where the error occurred, and does IOT 6411.
Somehow, this creates the text “E9” on one line, and the address from location 0010 is somehow displayed as readable text on another. The 6100 CPU then does “JMP .”, with the interrupts off, so it presumably has no more involvement.
So how the heck are things encoded for IOTs 6410 and 6411? Is IOT 6410 always text, with a character chart somewhere? Is 6411 always a word value to display in numeric form? Or is the address being in the range of 0011-0177 somehow requesting a numeric display? Is the last digit of the IOT being used as a line number, or is that somehow coming from AC too?
It seems in general that there’s far too much going on with the display to be encoded with a 12 bit output value per line.
Or is the 0371 also a pointer, pointing at 0371, which seems to have 4527 4524 4167 0032 0261 0000 stored there?? Which might encode something, but still doesn’t explain the friendly display of the address.
The LCD has 4 locations addressed separately + symbols. There’s no text output except E and F for error and function.
I have a table with the BCD combinations. Numbers are I think just stored in octal, so there’s mainly of interest the combinations with E,F, blank and _ with the rest. 3 bits forming one digit, which are then added.
E left=360, “_” right= 16=376.
11- 11 1 -110
3 - 7- 6
F9 7777
*E8 999
E and F can only be displayed on the left positions, on upper right only an octal word, on lower right 3 decimal values (stored as octal 4 digits).
Error messages differ, some show the address like the faulty RAM cel, others show an encoded wrong key from what key group. Error can show E 0000 or E0 0000. Again, the programming is meant for the PLC which has the same LCD. I can only confirm the error messages on my device. E0-E9. Half of them are about BUS errors in combination with the PLC. The rest about RAM/ROM error and wrong key combination or syntax error. There must be tables of allowed keys and syntax and their error codes.
ASCII text output is reserved or was planned and should not work on this ROM. I assumed the empty page for that but that turned out page 0. There’s already one undocumented instruction for loading text obviously for an external display or an upcoming version. So loading one register with ASCII instead of decimal or memory content.
Some errors are severe like a ROM error, so there’s a loop. Others like a wrong key can be fixed and cleared.
The only character chart is that for a printout, mnemonics stored at 4000-4177.
Thanks! I think I get it this time.
You mention 4 regions. I’m aware of a two digit “bcd” region, a three digit “bcd” region, and an 4 digit octal region. What and where is the fourth region?
AP1. | AP2
AP3. | AP4
Two regions with 2 digits on the left, 2 on the right, top left=location 1.
A1-| A2
88 -8888
88- .888
A3 - A4
I tried also a start from 200. Very similar but overwriting pages 1, 2 and more. 1KWords.
After start from 400 and continue after the RAM check, with some skips reaching 431, skip after 7403 to 7404 there’s 7600 written to 32 where we have the 600x jumps.
Starting from 7600 , over 731, 740 and 670 I have this adding 1 take a 14 from 56, rotate left 4x → 320 +14 from 57=334 +4000 from 53.
320=F 334= F blank. 4000 is probably a squared symbol between location 3+4. So at 40 there’s very likely LCD values.
F is displayed when pressing the F key. So maybe I’ve found a keyboard IOT. Needs more checking. Just found.
(After 731 there’s a full loop starting again at 400.)
0000: 7421 5427 0000 0000 0000 0000 0000 0000
0010: 0020 0000 0000 0000 0000 0000 0000 0554
0020: 0000 3131 5531 0400 1423 2023 5021 7400
0030: 0602 0600 7600 0605 0604 0007 0010 0514
0040: 4314 7777 7761 7777 0652 0600 0047 0047
0050: 4334 7777 6314 4000 0014 0014 0014 0014 (later 4334)
0060: 0000 0000 0000 0000 0000 0000 0000 0000
0070: 0000 0000 2000 0000 0000 0000 0000 0000
[0670] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:0000 IR:1014 TAD 0014 ;Add operand to AC, ZP 0014
[0671] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:0000 IR:7040 CMA ;Complement AC
[0672] IRQ,DLY,IE=0,0,0 L/AC:1/7777 MQ:0000 IR:0145 AND 0145 ;AND operand with AC, ZP 0145
[0673] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:0000 IR:7421 MQL ;Load MQ from AC then clear AC
[0674] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:0000 IR:1145 TAD 0145 ;Add operand to AC, ZP 0145
[0675] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:0000 IR:7040 CMA ;Complement AC
[0676] IRQ,DLY,IE=0,0,0 L/AC:1/7777 MQ:0000 IR:0014 AND 0014 ;AND operand with AC, ZP 0014
[0677] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:0000 IR:7501 MQA ;OR MQ with AC
[0700] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:0000 IR:7001 IAC;Increment AC
[0701] IRQ,DLY,IE=0,0,0 L/AC:1/0001 MQ:0000 IR:6416 SSBE ;DP8-EAEB: Skip on Bus Error
[0702] IRQ,DLY,IE=0,0,0 L/AC:1/0001 MQ:0000 IR:1125 TAD 0125 ;Add operand to AC, ZP 0125
[0703] IRQ,DLY,IE=0,0,0 L/AC:1/0001 MQ:0000 IR:6416 SSBE ;DP8-EAEB: Skip on Bus Error
[0704] IRQ,DLY,IE=0,0,0 L/AC:1/0001 MQ:0000 IR:1056 TAD 0056 ;Add operand to AC, ZP 0056
[0705] IRQ,DLY,IE=0,0,0 L/AC:1/0015 MQ:0000 IR:7106 CLL RTL ;Clear L, Rotate AC & L left twice
[0706] IRQ,DLY,IE=0,0,0 L/AC:0/0064 MQ:0000 IR:7006 RTL ;Rotate AC & L left twice
[0707] IRQ,DLY,IE=0,0,0 L/AC:0/0320 MQ:0000 IR:1057 TAD 0057 ;Add operand to AC, ZP 0057
[0710] IRQ,DLY,IE=0,0,0 L/AC:0/0334 MQ:0000 IR:1053 TAD 0053 ;Add operand to AC, ZP 0053
[0711] IRQ,DLY,IE=0,0,0 L/AC:0/4334 MQ:0000 IR:1060 TAD 0060 ;Add operand to AC, ZP 0060
[0712] IRQ,DLY,IE=0,0,0 L/AC:0/4334 MQ:0000 IR:3050 DCA 0050 ;Deposit AC to memory then clear AC, ZP 0050
[0713] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:1046 TAD 0046 ;Add operand to AC, ZP 0046
[0714] IRQ,DLY,IE=0,0,0 L/AC:0/0047 MQ:0000 IR:3010 DCA 0010 ;Deposit AC to memory then clear AC, ZP 0010
[0715] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:1410 TAD I 0010 ;Add operand to AC, Indexed ZP 0010 [Auto pre-inc]
[0716] IRQ,DLY,IE=0,0,0 L/AC:0/4334 MQ:0000 IR:6410 SSRG ;DP8-EAEB: Skip if Ring Flag
[0717] IRQ,DLY,IE=0,0,0 L/AC:0/4334 MQ:0000 IR:1410 TAD I 0010 ;Add operand to AC, Indexed ZP 0010 [Auto pre-inc]
I found some memory contents around the LCD. There’s a branch >=0 at 7263. When I use -1 that’s the way how 2 blanks are stored at one of the left display locations at 40/50. 3 blanks are 6314. 2 blanks according table 314. The constant 14 at 56 is taken and rotated 8x the other constant at 57 added and the constant 4000 from 53. As numbers+numbers aren’t stored as BCD (but loaded as decimal on location 4), only powers of 10/16 make sense. After 00-09 comes 0+blk. what is 0014. 0_=16. I tried 7765 and got 54/4054 what is 2+blk. All other values < power of 10 result in 4334 (usually F+blk).
[7255] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0652 IR:7305 CLL CLA IAC RAL;Clear L, Set AC to 0001, Rotate AC & L left
[7256] IRQ,DLY,IE=0,0,0 L/AC:0/0002 MQ:0652 IR:6415 SRS1 ;DP8-EAEB: Read Status 1
[7257] IRQ,DLY,IE=0,0,0 L/AC:0/0002 MQ:0652 IR:6001 ION ;KK8-E: Interrupts enabled
[7260] IRQ,DLY,IE=0,0,1 L/AC:0/0002 MQ:0652 IR:1141 TAD 0141 ;Add operand to AC, ZP 0141
[7261] IRQ,DLY,IE=0,0,1 L/AC:0/0012 MQ:0652 IR:7640 SZA CLA ;Skip on AC = 0, Clear AC
[7262] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:0652 IR:7501 MQA ;OR MQ with AC
[7263] IRQ,DLY,IE=0,0,1 L/AC:0/0652 MQ:0652 IR:7710 SPA CLA ;Skip on AC >= 0, Clear AC
[7265] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:0652 IR:3141 DCA 0141 ;Deposit AC to memory then clear AC, ZP 0141
[7266] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:0652 IR:5020 JMP 0020 ;Jump ZP 0020
AC->7777 and skip (default 2xblk):
[7264] IRQ,DLY,IE=0,0,1 L/AC:0/7777 MQ:7600 IR:5444 JMP I 0044 ;Jump Indexed ZP 0044
[0652] IRQ,DLY,IE=0,0,1 L/AC:0/7777 MQ:7600 IR:2043 ISZ 0043 ;Increment operand and skip if zero, ZP 0043
[0653] IRQ,DLY,IE=0,0,1 L/AC:0/7777 MQ:7600 IR:5262 JMP @@62 ;Jump Current page @@62
[0662] IRQ,DLY,IE=0,0,1 L/AC:0/7777 MQ:7600 IR:1014 TAD 0014 ;Add operand to AC, ZP 0014
[0663] IRQ,DLY,IE=0,0,1 L/AC:0/7777 MQ:7600 IR:7421 MQL ;Load MQ from AC then clear AC
[0664] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:7777 IR:7301 CLL CLA IAC;Clear L, Set AC to 0001
[0665] IRQ,DLY,IE=0,0,1 L/AC:0/0001 MQ:7777 IR:0146 AND 0146 ;AND operand with AC, ZP 0146
[0666] IRQ,DLY,IE=0,0,1 L/AC:0/0001 MQ:7777 IR:7640 SZA CLA ;Skip on AC = 0, Clear AC
[0667] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:7777 IR:5277 JMP @@77 ;Jump Current page @@77
[0677] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:7777 IR:7501 MQA ;OR MQ with AC
[0700] IRQ,DLY,IE=0,0,1 L/AC:0/7777 MQ:7777 IR:7001 IAC;Increment AC
[0701] IRQ,DLY,IE=0,0,1 L/AC:1/0000 MQ:7777 IR:6416 SSBE ;DP8-EAEB: Skip on Bus Error
[0702] IRQ,DLY,IE=0,0,1 L/AC:1/0000 MQ:7777 IR:1125 TAD 0125 ;Add operand to AC, ZP 0125
[0703] IRQ,DLY,IE=0,0,1 L/AC:1/0000 MQ:7777 IR:6416 SSBE ;DP8-EAEB: Skip on Bus Error
[0704] IRQ,DLY,IE=0,0,1 L/AC:1/0000 MQ:7777 IR:1056 TAD 0056 ;Add operand to AC, ZP 0056
[0705] IRQ,DLY,IE=0,0,1 L/AC:1/0014 MQ:7777 IR:7106 CLL RTL ;Clear L, Rotate AC & L left twice
[0706] IRQ,DLY,IE=0,0,1 L/AC:0/0060 MQ:7777 IR:7006 RTL ;Rotate AC & L left twice
[0707] IRQ,DLY,IE=0,0,1 L/AC:0/0300 MQ:7777 IR:1057 TAD 0057 ;Add operand to AC, ZP 0057
[0710] IRQ,DLY,IE=0,0,1 L/AC:0/0314 MQ:7777 IR:1053 TAD 0053 ;Add operand to AC, ZP 0053
[0711] IRQ,DLY,IE=0,0,1 L/AC:0/4314 MQ:7777 IR:1060 TAD 0060 ;Add operand to AC, ZP 0060
[0712] IRQ,DLY,IE=0,0,1 L/AC:0/4314 MQ:7777 IR:3050 DCA 0050 ;Deposit AC to memory then clear AC, ZP 0050
I found an output of 360 0005 (E0 5) at 40/41. That is a wrong key from the group of the 7 control keys that’s not allowed after the current key. That is at 7662 after 7656 , 7647 , 7643 , 7611 , 7605 start. The value 5 is previously stored to 142.
And 777 is written to 34 (the 600x jump targets) and after continue there there’s the output.
Starting from 5622 there are 6 words written to 63-70. All are jump index pointers. 5673 3360 5612 0600 5667 7740. Even a 600.
The two 14 at 56+57 turn to 0. Starting from pointer 5667 results in output E0 4. That is a wrong key, brackets or “OR”.
I have to search for the other key groups. And maybe the syntax error codes. I have 6 groups of keys E0 0 =numpad 0-9. E0 1=either release key (9x), E0 2 instructions 8, E0 3 units 9, E0 4 brackets/OR 4, E0 5 controls 7 keys.
0000: 1157 5427 0000 0000 0000 0000 0000 0000
0010: 6114 0072 0000 0000 0000 0000 0000 5672
0020: 1417 3131 5531 5637 1423 2023 5021 7400
0030: 7332 0600 0601 0603 0604 0007 0010 0037 .7332
0040: 0360 0004 7777 7777 0652 0600 0037 0047 E0 top left, 4
0050: 4314 7777 6314 4000 0014 0014 0000 0000 2x0
0060: 0000 0000 0000 5673 3360 5612 0600 5667
0070: 7740 0000 2340 0000 0000 0000 0000 0000
0100: 0000 0000 0000 0000 0000 0000 0000 0000
0110: 0000 0000 0000 0000 0000 0000 0000 0000
0120: 0000 0000 0000 0000 0000 0000 0000 0000
0130: 0000 7010 0000 0000 0000 0000 0000 0000
0140: 0001 0000 0004 5612 0000 0000 0000 0000 4 our default
0150: 0067 0005 0000 0000 7736 0000 0000 0000
Finally I found how the first table with the 2 digit units and allowed operations is called. I also found a bit more about the LCD.
The first value 0410 for unit 10 is at 2742. The table starts 2 words earlier; 2740 is indexed at 2554. That index is stored to 12. The right byte (unit) is extracted and added to 134. If it’s not 0 the next value unit 11 is called. If none of the contents matched (last is 0) there will be a reset (RAM/ROM check) indexed at 23. But that pointer is confirmed to be changed. 6600 dummy or unit 0.
That must be for a syntax check (as some units aren’t on the keys). Error E1 or E2 followed by an address. Original start and current values of AC etc unknown and I haven’t checked all branches.
(Original start from 2501, AC must be <>0).
[2450] IRQ,DLY,IE=0,0,0 L/AC:1/3527 MQ:3527 IR:7041 CIA ;2s Complement AC
[2451] IRQ,DLY,IE=0,0,0 L/AC:1/4251 MQ:3527 IR:3134 DCA 0134 ;Deposit AC to memory then clear AC, ZP 0134
[2452] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:3527 IR:1354 TAD @@54 ;Add operand to AC, Current page @@54
[2453] IRQ,DLY,IE=0,0,0 L/AC:1/2740 MQ:3527 IR:3012 DCA 0012 ;Deposit AC to memory then clear AC, ZP 0012
[2454] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:3527 IR:1412 TAD I 0012 ;Add operand to AC, Indexed ZP 0012 [Auto pre-inc]
[2455] IRQ,DLY,IE=0,0,0 L/AC:1/6600 MQ:3527 IR:7450 SNA ;Skip on AC <> 0
[2457] IRQ,DLY,IE=0,0,0 L/AC:1/6600 MQ:3527 IR:0350 AND @@50 ;AND operand with AC, Current page @@50
[2460] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:3527 IR:1134 TAD 0134 ;Add operand to AC, ZP 0134
[2461] IRQ,DLY,IE=0,0,0 L/AC:1/4251 MQ:3527 IR:7640 SZA CLA ;Skip on AC = 0, Clear AC
[2462] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:3527 IR:5254 JMP @@54 ;Jump Current page @@54
[2454] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:3527 IR:1412 TAD I 0012 ;Add operand to AC, Indexed ZP 0012 [Auto pre-inc]
[2455] IRQ,DLY,IE=0,0,0 L/AC:1/0410 MQ:3527 IR:7450 SNA ;Skip on AC <> 0
[2457] IRQ,DLY,IE=0,0,0 L/AC:1/0410 MQ:3527 IR:0350 AND @@50 ;AND operand with AC, Current page @@50 - AND 77
[2460] IRQ,DLY,IE=0,0,0 L/AC:1/0010 MQ:3527 IR:1134 TAD 0134 ;Add operand to AC, ZP 0134
[2461] IRQ,DLY,IE=0,0,0 L/AC:1/4261 MQ:3527 IR:7640 SZA CLA ;Skip on AC = 0, Clear AC
[2462] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:3527 IR:5254 JMP @@54 ;Jump Current page @@54
[2454] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:3527 IR:1412 TAD I 0012 ;Add operand to AC, Indexed ZP 0012 [Auto pre-inc]
[2455] IRQ,DLY,IE=0,0,0 L/AC:1/7411 MQ:3527 IR:7450 SNA ;Skip on AC <> 0
same with unit 10 as AC (also stored to 106). Again a reset to 400. So must be branch before.
[2450] IRQ,DLY,IE=0,1,0 L/AC:0/0010 MQ:0000 IR:7041 CIA ;2s Complement AC
..
[2457] IRQ,DLY,IE=0,0,0 L/AC:0/0410 MQ:0000 IR:0350 AND @@50 ;AND operand with AC, Current page @@50
[2460] IRQ,DLY,IE=0,0,0 L/AC:0/0010 MQ:0000 IR:1134 TAD 0134 ;Add operand to AC, ZP 0134
[2461] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:0000 IR:7640 SZA CLA ;Skip on AC = 0, Clear AC
[2463] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:0000 IR:1012 TAD 0012 ;Add operand to AC, ZP 0012
[2464] IRQ,DLY,IE=0,0,0 L/AC:1/2742 MQ:0000 IR:3134 DCA 0134 ;Deposit AC to memory then clear AC, ZP 0134
[2465] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:0000 IR:1534 TAD I 0134 ;Add operand to AC, Indexed ZP 0134
[2466] IRQ,DLY,IE=0,0,0 L/AC:1/0410 MQ:0000 IR:3106 DCA 0106 ;Deposit AC to memory then clear AC, ZP 0106
[2467] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:0000 IR:1103 TAD 0103 ;Add operand to AC, ZP 0103
[2470] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:0000 IR:7160 STL CMA ;Set L, Complement AC
[2471] IRQ,DLY,IE=0,0,0 L/AC:1/7777 MQ:0000 IR:3135 DCA 0135 ;Deposit AC to memory then clear AC, ZP 0135
[2472] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:0000 IR:7010 RAR ;Rotate AC & L right
[2473] IRQ,DLY,IE=0,0,0 L/AC:0/4000 MQ:0000 IR:2135 ISZ 0135 ;Increment operand and skip if zero, ZP 0135
[2475] IRQ,DLY,IE=0,0,0 L/AC:0/4000 MQ:0000 IR:0106 AND 0106 ;AND operand with AC, ZP 0106
[2476] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:7440 SZA ;Skip on AC = 0
[2500] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:7301 CLL CLA IAC;Clear L, Set AC to 0001
[2501] IRQ,DLY,IE=0,0,0 L/AC:0/0001 MQ:0000 IR:3141 DCA 0141 ;Deposit AC to memory then clear AC, ZP 0141
[2502] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:1102 TAD 0102 ;Add operand to AC, ZP 0102
[2503] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:3142 DCA 0142 ;Deposit AC to memory then clear AC, ZP 0142
[2504] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:1107 TAD 0107 ;Add operand to AC, ZP 0107
[2505] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:7640 SZA CLA ;Skip on AC = 0, Clear AC
[2507] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:5423 JMP I 0023 ;Jump Indexed ZP 0023
[0400] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:6007 CAF ;KK8-E: Clear all flags
Printing on LCD line 1 (40) is only at 7016 starting from 1011. Printing line 2 (50) is at 712 starting from 7264 (AC <0). E and F should only displayed on the upper line (top left Ex) and address or error kind on top right.
3x blk is 6314, bit pattern 110011001100, 1xblk=14. 2x blk+ unknown/entered decimal digit is 6300. That is printed to 52 starting from 6737. The right digit is added from 126 what is 0 by default.
That last digit has to be entered before, but at 6714 it’s not the IOT 6342. That is a pointer after 6713.
At 7731 and 1133 (indexed at 131) there’s a routine for updating/deleting the LCD. Index later changes to 5152 and 7275, 7400, 2712.
Start at 6275 skipping to 652 (index at 44) with some 64xx, 643x IOTs result in a branch at 737 (and 733) . If AC=0 then it resets to 400 (RAM check). AC has to be first positive then (keyboard value ?) negative. I don’t know the values for a single key.
THANKS very much indeed for your help! Especially for pointing out the correct ROM order (pairs were correct). I now have a basic understanding of how it works. I think, I now just want to find how a printout works and I think I’m very close (around 4414?). The mnemonics are at 4000 and that only appears 5x and none seems to be the pointer.
I noticed that new code is written (or copied) to page 0. So that is very hard to find. Instruction 7330 (CLA CLL CML RAR) producing 4000 to AC. A DCA writing that, like to 170 and 77. I once found code branching into that text page. Code is probably not wrong but the pointer on page 0 is still empty, so there must be other code before.
I found some subroutines updating the LCD at ~7750-7774. Probably when entering 3 digits on location 4 and pushing contents to the left removing blanks or_. One remaining pair is stored at 60. Trying 7356=3x_.
(6300= blk+blk+entered digit. 6000=blk+2digits, 356=2x_ right, 756=similar, with separator?)
[6734] IRQ,DLY,IE=0,0,0 L/AC:0/7356 MQ:0000 IR:1261 TAD @@61 ;Add operand to AC, Current page @@61
[6735] IRQ,DLY,IE=0,0,0 L/AC:0/7756 MQ:0000 IR:1310 TAD @@10 ;Add operand to AC, Current page @@10
[6736] IRQ,DLY,IE=0,0,0 L/AC:1/0756 MQ:0000 IR:3060 DCA 0060 ;Deposit AC to memory then clear AC, ZP 0060
[6737] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:0000 IR:1052 TAD 0052 ;Add operand to AC, ZP 0052
[6740] IRQ,DLY,IE=0,0,0 L/AC:1/6300 MQ:0000 IR:7002 BSW ;Byte Swap AC
[6741] IRQ,DLY,IE=0,0,0 L/AC:1/0063 MQ:0000 IR:7012 RTR ;Rotate AC & L right twice
[6742] IRQ,DLY,IE=0,0,0 L/AC:1/6014 MQ:0000 IR:0375 AND @@75 ;AND operand with AC, Current page @@75
[6743] IRQ,DLY,IE=0,0,0 L/AC:1/0014 MQ:0000 IR:3055 DCA 0055 ;Deposit AC to memory then clear AC, ZP 0055
[6744] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:0000 IR:1052 TAD 0052 ;Add operand to AC, ZP 0052
[6745] IRQ,DLY,IE=0,0,0 L/AC:1/6300 MQ:0000 IR:0307 AND @@07 ;AND operand with AC, Current page @@07
[6746] IRQ,DLY,IE=0,0,0 L/AC:1/0300 MQ:0000 IR:7106 CLL RTL ;Clear L, Rotate AC & L left twice
[6747] IRQ,DLY,IE=0,0,0 L/AC:0/1400 MQ:0000 IR:7006 RTL ;Rotate AC & L left twice
[6750] IRQ,DLY,IE=0,0,0 L/AC:0/6000 MQ:0000 IR:1126 TAD 0126 ;Add operand to AC, ZP 0126
[6751] IRQ,DLY,IE=0,0,0 L/AC:0/6000 MQ:0000 IR:3052 DCA 0052 ;Deposit AC to memory then clear AC, ZP 0052
0040: 4314 7777 7777 7777 0652 0600 0047 0047 .LCD
0050: 4314 7777 6000 4000 0014 0014 0014 0014
0060: 0756 0000 0000 0000 0000 0000 0000 0000 .new 60
Starting from 3571 where are values for the LCD, I found 5 pointers (from 5361) written to page 0 173-177. A bit later there’s the call of table 1 (2407/2450) indexed at the pointer 131. Some words are code.
0000: 1157 5427 0000 0000 0000 0000 0000 0000
0010: 5373 0167 2741 0000 0000 0000 0164 6237
0020: 1417 3131 5531 6012 1423 2023 5021 7400
0030: 7332 0600 0601 0603 0604 0007 0010 0037 .new 7332
0040: 4314 7777 7777 7777 0652 0600 0047 0047 LCD contents
0050: 4314 0000 6314 0000 0014 0014 0014 0014 "
0060: 0000 0000 0000 0000 0000 0000 0000 0000
0070: 0000 0000 0000 0000 0000 0000 0000 4000
0100: 0000 0000 0000 0000 0000 0000 6600 0000
0110: 0000 0010 0000 7776 0000 7765 0000 0000
0120: 0000 0000 0000 0000 0007 0000 0000 0000
0130: 0000 7600 0000 0000 2735 4000 0000 0000 2735 near table 1
0140: 0000 0000 0004 0000 0000 0000 0000 0000
0150: 0076 0000 0000 0000 7736 0000 0000 0000
0160: 0000 0000 0000 0000 0000 0000 0000 4000
0170: 0000 0000 0000 5574 4313 5436 5577 4267 .new code
Starting from 4313, the second pointer, it adds 60 and JMP to 176 where’s a JMP indexed at 177. And 175 is overwritten with the return stack 4315. There’s a jump indexed at 172 what is still 0. That might be correct as 0 is a pointer but 170 and maybe 171, 172 is written a bit later.
[4313] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:4477 IR:1363 TAD @@63 ;Add operand to AC, Current page @@63
[4314] IRQ,DLY,IE=0,0,0 L/AC:1/0060 MQ:4477 IR:4175 JMS 0175 ;Jump to subroutine ZP 0175
[0176] IRQ,DLY,IE=0,0,0 L/AC:1/0060 MQ:4477 IR:5577 JMP I 0177 ;Jump Indexed ZP 0177
[4267] IRQ,DLY,IE=0,0,0 L/AC:1/0060 MQ:4477 IR:1361 TAD @@61 ;Add operand to AC, Current page @@61
[4270] IRQ,DLY,IE=0,0,0 L/AC:1/1660 MQ:4477 IR:7104 CLL RAL ;Clear L, Rotate AC & L left
[4271] IRQ,DLY,IE=0,0,0 L/AC:0/3540 MQ:4477 IR:7421 MQL ;Load MQ from AC then clear AC
[4272] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:3540 IR:1115 TAD 0115 ;Add operand to AC, ZP 0115
[4273] IRQ,DLY,IE=0,0,0 L/AC:0/7765 MQ:3540 IR:3135 DCA 0135 ;Deposit AC to memory then clear AC, ZP 0135
[4274] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:3540 IR:6002 IOF ;KK8-E: Interrupts disabled
[4275] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:3540 IR:1116 TAD 0116 ;Add operand to AC, ZP 0116
[4276] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:3540 IR:3134 DCA 0134 ;Deposit AC to memory then clear AC, ZP 0134
[4277] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:3540 IR:2134 ISZ 0134 ;Increment operand and skip if zero, ZP 0134
[4300] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:3540 IR:5277 JMP @@77 ;Jump Current page @@77
[4277] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:3540 IR:2134 ISZ 0134 ;Increment operand and skip if zero, ZP 0134
[4300] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:3540 IR:5277 JMP @@77 ;Jump Current page @@77
..skip
[4301] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:3540 IR:7501 MQA ;OR MQ with AC
[4302] IRQ,DLY,IE=0,0,0 L/AC:0/3540 MQ:3540 IR:7110 CLL RAR ;Clear L, Rotate AC & L right
[4303] IRQ,DLY,IE=0,0,0 L/AC:0/1660 MQ:3540 IR:7421 MQL ;Load MQ from AC then clear AC
[4304] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:1660 IR:7010 RAR ;Rotate AC & L right
[4305] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:1660 IR:1362 TAD @@62 ;Add operand to AC, Current page @@62
[4306] IRQ,DLY,IE=0,0,0 L/AC:0/2100 MQ:1660 IR:6415 SRS1 ;DP8-EAEB: Read Status 1
[4307] IRQ,DLY,IE=0,0,0 L/AC:0/2100 MQ:1660 IR:2135 ISZ 0135 ;Increment operand and skip if zero, ZP 0135
[4310] IRQ,DLY,IE=0,0,0 L/AC:0/2100 MQ:1660 IR:5275 JMP @@75 ;Jump Current page @@75
[4275] IRQ,DLY,IE=0,0,0 L/AC:0/2100 MQ:1660 IR:1116 TAD 0116 ;Add operand to AC, ZP 0116
[4276] IRQ,DLY,IE=0,0,0 L/AC:0/2100 MQ:1660 IR:3134 DCA 0134 ;Deposit AC to memory then clear AC, ZP 0134
[4277] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:1660 IR:2134 ISZ 0134 ;Increment operand and skip if zero, ZP 0134
[4300] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:1660 IR:5277 JMP @@77 ;Jump Current page @@77
[4277] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:1660 IR:2134 ISZ 0134 ;Increment operand and skip if zero, ZP 0134
..
[4311] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:1660 IR:6001 ION ;KK8-E: Interrupts enabled
[4312] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:1660 IR:5575 JMP I 0175 ;Jump Indexed ZP 0175
[4315] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:1660 IR:5572 JMP I 0172 ;Jump Indexed ZP 0172
[0000] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:1660 IR:1157 TAD 0157 ;Add operand to AC, ZP 0157
[0001] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:1660 IR:5427 JMP I 0027 ;Jump Indexed ZP 0027
[7400] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:1660 IR:3152 DCA 0152 ;Deposit AC to memory then clear AC, ZP 0152
[7401] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:1660 IR:6402 SSRO ;DP8-EAEB: Skip If Receive Word Count Overflow
You are welcome. I am glad I was able to help. I had intended to do more, but it looks like my other projects are ramping up and I’m going to be swamped (not unusual) for a while.
Vince
A big progress. I think I’m one step ahead from a breakthrough. Much lesser data segments than assumed and clever coding.
I found how the error codes are calculated and displayed, how the baud setting works (table, involving key input) and I did a full loop of simulated input of 2 instructions/keys with a (new) error output.
Error codes are simply based on E0 (360) and incremented by jumping to 542-545. Jumping to top 542 adding all 4=E4. 4 is also stored to 142 and later added. I found all the codes and branches. Errors E5-E7 are PLC errors and probably handled by that. Code is at 7014. Maybe same code for F instead of E. 37 turns from 47 to 37 in case of an error, probably for blinking.
359 00535 1271 L00535, TAD D00471 /371= E9
360 00536 6410 6410
361 00537 1010 TAD P00010
362 00540 6411 6411 /display address to A2?
363 00541 5341 L00541, JMP L00541 /infinite loop RAM error E9.
364 00542 7001 L00542, IAC /+1 , in total +4 =E4
365 00543 7001 L00543, IAC /E3
366 00544 7001 L00544, IAC /E2
367 00545 7001 L00545, IAC /E1
368 00546 3142 DCA P00142 /sum of increments
369 00547 1036 TAD P00036 /default 10 360+10=370=F0 ?
370 00550 3141 DCA L00141
371 00551 3151 DCA P00151
372 00552 3076 DCA P00076
373 00553 4017 JMS P00017 /fetch next address to JMP
I previously found a table of 5 pointers (+0-4) , code is just earlier. The first one (2450) also reading the unit table with their allowed operations.
1322 02420 7002 L02420, BSW /byteswap
1323 02421 0234 AND D02434 /AND 17, take digit 2 of left byte
1324 02422 1226 TAD D02426 /table start
1325 02423 3134 DCA P00134 /room for pointer on page 0
1326 02424 1104 TAD D00104 /adding increment
1327 02425 5534 JMP I P00134 /final JMP
1328 02426 2427 D02426, 2427
1329 02427 5250 JMP L02450 /pointer 1 if AC=0. Read table of units
1330 02430 5315 JMP L02515 /AC1
1331 02431 5325 JMP L02525 /AC2 -tried 0251
1332 02432 5335 JMP L02535 /AC3
1333 02433 5310 JMP L02510 /AC4
1334 02434 0017 D02434, 0017
I explained some time ago how the table of units is read. To test another pointer than the first, I took unit 51 what is LCD location 1. The only allowed operation is LOAD (load LCD with reg/val) what is instruction 4. Multiple instructions are BCD encoded. Here it’s 02. With unit 0251. Only the 2nd digit is taken, added to 0 and the 3rd pointer is used. On the unit check, the unit is stored to 106. Here it’s 300, unknown why. Other pointers have 100 or 7400.
[2420] IRQ,DLY,IE=0,1,0 L/AC:0/0251 MQ:0000 IR:7002 BSW ;Byte Swap AC
[2421] IRQ,DLY,IE=0,1,0 L/AC:0/5102 MQ:0000 IR:0234 AND @@34 ;AND operand with AC, Current page @@34
[2422] IRQ,DLY,IE=0,1,0 L/AC:0/0002 MQ:0000 IR:1226 TAD @@26 ;Add operand to AC, Current page @@26
[2423] IRQ,DLY,IE=0,1,0 L/AC:0/2431 MQ:0000 IR:3134 DCA 0134 ;Deposit AC to memory then clear AC, ZP 0134
[2424] IRQ,DLY,IE=0,1,0 L/AC:0/0000 MQ:0000 IR:1104 TAD 0104 ;Add operand to AC, ZP 0104
[2425] IRQ,DLY,IE=0,1,0 L/AC:0/0000 MQ:0000 IR:5534 JMP I 0134 ;Jump Indexed ZP 0134
[2431] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:5325 JMP @@25 ;Jump Current page @@25
[2525] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:0235 AND @@35 ;AND operand with AC, Current page @@35
[2526] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:7640 SZA CLA ;Skip on AC = 0, Clear AC
[2530] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:1351 TAD @@51 ;Add operand to AC, Current page @@51
[2531] IRQ,DLY,IE=0,0,0 L/AC:0/0300 MQ:0000 IR:5266 JMP @@66 ;Jump Current page @@66
[2466] IRQ,DLY,IE=0,0,0 L/AC:0/0300 MQ:0000 IR:3106 DCA 0106 ;Deposit AC to memory then clear AC, ZP 0106
I had to do 5 manual skips to prevent a restart. None had an IOT. I ended up here. Reading 8 words starting with 7744. These aren’t written to RAM, just checked. Every 3rd word is checked and I think this is the baud table.
[2710] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:3527 IR:5320 JMP @@20 ;Jump Current page @@20
[2720] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:3527 IR:4017 JMS 0017 ;Jump to subroutine ZP 0017
[0020] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:3527 IR:1417 TAD I 0017 ;Add operand to AC, Indexed ZP 0017 [Auto pre-inc]
[0021] IRQ,DLY,IE=0,0,0 L/AC:1/6534 MQ:3527 IR:3131 DCA 0131 ;Deposit AC to memory then clear AC, ZP 0131
[0022] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:3527 IR:5531 JMP I 0131 ;Jump Indexed ZP 0131
[6534] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:3527 IR:1417 TAD I 0017 ;Add operand to AC, Indexed ZP 0017 [Auto pre-inc]
[6535] IRQ,DLY,IE=0,0,0 L/AC:1/6545 MQ:3527 IR:3010 DCA 0010 ;Deposit AC to memory then clear AC, ZP 0010
[6536] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:3527 IR:2010 ISZ 0010 ;Increment operand and skip if zero, ZP 0010
[6537] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:3527 IR:1104 TAD 0104 ;Add operand to AC, ZP 0104
[6540] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:3527 IR:0410 AND I 0010 ;AND operand with AC, Indexed ZP 0010 [Auto pre-inc]
[6541] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:3527 IR:1410 TAD I 0010 ;Add operand to AC, Indexed ZP 0010 [Auto pre-inc]
[6542] IRQ,DLY,IE=0,0,0 L/AC:1/7744 MQ:3527 IR:7640 SZA CLA ;Skip on AC = 0, Clear AC
[6543] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:3527 IR:5336 JMP @@36 ;Jump Current page @@36
[6536] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:3527 IR:2010 ISZ 0010 ;Increment operand and skip if zero, ZP 0010
[6537] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:3527 IR:1104 TAD 0104 ;Add operand to AC, ZP 0104
[6540] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:3527 IR:0410 AND I 0010 ;AND operand with AC, Indexed ZP 0010 [Auto pre-inc]
[6541] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:3527 IR:1410 TAD I 0010 ;Add operand to AC, Indexed ZP 0010 [Auto pre-inc]
[6542] IRQ,DLY,IE=0,0,0 L/AC:1/7750 MQ:3527 IR:7640 SZA CLA ;Skip on AC = 0, Clear AC
7744 0010 7770 -110 baud TTY? (start at 6550)
7750 0004 7777 -300
7740 0200 7777 -600
7701 1000 7700 -1200
7700 0040 7700 -110 baud audio?
7600 0100 7000
5000 0020 7700
7400 0400 0000 -1200 bauds ?
0000 (on new page) 9th word to end reading table
I’ve chosen to branch with 5000. Then the LCD is refreshed. After some few skips, I ended up at 100 (and 115) what are still empty.
One branch earlier I reached again 2407, 2410 and 2420 where I started from.
Now I also have all the needed values on page 0 and know where it really starts. It runs then the unit check. I once entered 10 at a skip and soon the LCD values are 0362 0000 (E2) what is a syntax error for unallowed value or instruction. After that an infinite 60x loop indexed at 30-34 and 45. Values aren’t changed yet and/or waiting for a key. I sometimes had 7332 at 30 branching there.
[0022] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:0000 IR:5531 JMP I 0131 ;Jump Indexed ZP 0131
[2407] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:0000 IR:1103 TAD 0103 ;Add operand to AC, ZP 0103
[2410] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:0000 IR:1342 TAD @@42 ;Add operand to AC, Current page @@42
[2411] IRQ,DLY,IE=0,0,1 L/AC:0/7772 MQ:0000 IR:7700 SMA CLA ;Skip on AC < 0, Clear AC
[2413] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:0000 IR:1104 TAD 0104 ;Add operand to AC, ZP 0104
[2414] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:0000 IR:7510 SPA ;Skip on AC >= 0
[2416] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:0000 IR:7130 STL RAR ;Set L, Rotate AC & L right
[2417] IRQ,DLY,IE=0,0,1 L/AC:0/4000 MQ:0000 IR:7012 RTR ;Rotate AC & L right twice
[2420] IRQ,DLY,IE=0,0,1 L/AC:0/1000 MQ:0000 IR:7002 BSW ;Byte Swap AC
[2421] IRQ,DLY,IE=0,0,1 L/AC:0/0010 MQ:0000 IR:0234 AND @@34 ;AND operand with AC, Current page @@34
[2422] IRQ,DLY,IE=0,0,1 L/AC:0/0010 MQ:0000 IR:1226 TAD @@26 ;Add operand to AC, Current page @@26
[2423] IRQ,DLY,IE=0,0,1 L/AC:0/2437 MQ:0000 IR:3134 DCA 0134 ;Deposit AC to memory then clear AC, ZP 0134
[2424] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:0000 IR:1104 TAD 0104 ;Add operand to AC, ZP 0104
[2425] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:0000 IR:5534 JMP I 0134 ;Jump Indexed ZP 0134
[2437] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:0000 IR:5220 JMP @@20 ;Jump Current page @@20
[2420] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:0000 IR:7002 BSW ;Byte Swap AC
[2421] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:0000 IR:0234 AND @@34 ;AND operand with AC, Current page @@34
[2422] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:0000 IR:1226 TAD @@26 ;Add operand to AC, Current page @@26
[2423] IRQ,DLY,IE=0,0,1 L/AC:0/2427 MQ:0000 IR:3134 DCA 0134 ;Deposit AC to memory then clear AC, ZP 0134
[2424] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:0000 IR:1104 TAD 0104 ;Add operand to AC, ZP 0104
[2425] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:0000 IR:5534 JMP I 0134 ;Jump Indexed ZP 0134
[2427] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:0000 IR:5250 JMP @@50 ;Jump Current page @@50
[2450] IRQ,DLY,IE=0,0,1 L/AC:0/0000 MQ:0000 IR:7041 CIA ;2s Complement AC
Finally I found some code for a printout (reading the mnemonics table) and a pointer list, code and IOTs for the 7 control keys (write, read, delete, copy, sim ,test, control) or at least parts of their (error ?) handling.
Like the previous pointer list of the units there’s a list of pointers here with 7 values (0-6). If AC (only last digit here) is 7 (else) it continues after that, so I thought that there are 8 values. But when continue there will be 360 (E0) 5 written to the LCD (40/41). And that is a wrong key error having a control key what is not allowed after a previous key. 7 is also the only amount of that keyboard section. Some IOTs involved mainly 6425,6427, 6437.
Surprisingly, 2 pointers are exactly the same, one (SIM) jumping to the top, DCA 137 (0) and also continues at 7540. Similar for most others. 1 or 2 words are written to page 0. Like 132+133 for copy. Probably for source+target.
Most of interest is here write for a printout, but that has the most operands and needs start and end address. One later pointer indexed at 0 might be wrong when continue, so that’s why I end up at 100 like before.
L7465,
DCA D0137 / @@7465=3137 (when control key SIM)
JMP L7540 / @@7466=5340 no additional DEP -+0 write
JMP L7511 / @@7467=5311 -DEP 121, 102 AC=1 read
JMP L7540 / @@7470=5340 AC=2 delete
JMP L7545 / @@7471=5345 -dep 132,133 AC=3 copy
JMP L7465 / @@7472=5265 JMP above DCA+1st. AC=4 SIM
JMP L7534 / @@7473=5334 -dep 150 AC=5 test. 150 last byte eg 62. 156=7773
JMP L7516 / @@7474=5316 -DEP 16 AC=6 control
else error E0 0005
The read function just has these additional lines writing 2 words and then continues like the write function. Copy is similar but writing to 132+133 (Delete doesn’t write a word, the others need a PLC attached).
[7511] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:6426 SCSD ;DP8-EAEB: Clear Sync Detect
[7512] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:3121 DCA 0121 ;Deposit AC to memory then clear AC, ZP 0121
[7513] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:6427 SRTA ;DP8-EAEB: Read Transfer Address Register
[7514] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:3102 DCA 0102 ;Deposit AC to memory then clear AC, ZP 0102
[7515] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:5340 JMP @@40 ;Jump Current page @@40 ->7540
Another list with 4/5 pointers is at 3606 involving IOTs and writing to 137+136. That is for checking and reading from the mnemonic table for a printout. Earlier, there is a check for WENN, DANN, SONST (if then else). I first found a pointer to 4152. The units <100, I had in table 1. The list checking for units 01xx-04xx. These are for registers and external hardware eg power unit and temperate sensor. The check for 5 units 1000-7777 has not a list but separate code after it.
C3606, 3607 / DCA I C3607
JMP L3642 / @3607=5242 if AC=0, 0000 ? NUW unconditionally
JMP L3656 / @@3610=5256 if AC was 1 SAZ 01xx Satzzeiger, set pointer
JMP L3657 / @@3611=5257 if AC was 2 ZER 02xx PLC register
JMP L3615 / @@3612=5215 if AC was 3 only here 137=57 NGE 03xx power unit
TAD C3640 / else @@3613=1240 4150 (if AC was 4 SNR 04xx ext. memory units
JMP L3660
end of mnemonics table with special Sixbit encoding 02=A, 04=B
…
12 02 64 EAZ 1xxx at 4140
32 12 44 MER 2xxx
64 02 30 ZAL 30xx at 4144
54 36 56 VOW 34xx
46 34 44 SNR 040x at 4150
56 12 34 34 00 00 (53th WENN at 4152
10 02 34 34 00 00 DANN 4155
46 36 34 46 50 00 SONS T 4160
25 25 25 00 *** 4163
70 00 \
70 00 \
31 23 73 40 11 02 31 02 40 23 45 32 31 42 code at 4167
Reading WE (5612) from WENN, pointer at 4152. Separating W. Doing 2 checks. Adding 40/60/1600. After a skip it reads the stars. The code is before and after the table. I haven’t found more than 1 word read. The correct start and AC values are often unknown. I think the printout takes many lines of code (incl. CRC check). Not sure if I will ever find more like the key mapping.
[3435] IRQ,DLY,IE=0,1,0 L/AC:0/0000 MQ:0000 IR:2112 ISZ 0112 ;Increment operand and skip if zero, ZP 0112
[3436] IRQ,DLY,IE=0,1,0 L/AC:0/0000 MQ:0000 IR:1241 TAD @@41 ;Add operand to AC, Current page @@41
[3437] IRQ,DLY,IE=0,1,0 L/AC:0/4152 MQ:0000 IR:3137 DCA 0137 ;Deposit AC to memory then clear AC, ZP 0137 - start WENN
[3440] IRQ,DLY,IE=0,1,0 L/AC:0/0000 MQ:0000 IR:4017 JMS 0017 ;Jump to subroutine ZP 0017
[0020] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:1417 TAD I 0017 ;Add operand to AC, Indexed ZP 0017 [Auto pre-inc]
[0021] IRQ,DLY,IE=0,0,0 L/AC:0/4246 MQ:0000 IR:3131 DCA 0131 ;Deposit AC to memory then clear AC, ZP 0131
[0022] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:5531 JMP I 0131 ;Jump Indexed ZP 0131
[4246] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:7344 CLL CLA CMA RAL;Clear L, Set AC to 7777, rotate AC & L left
[4247] IRQ,DLY,IE=0,0,0 L/AC:1/7776 MQ:0000 IR:3136 DCA 0136 ;Deposit AC to memory then clear AC, ZP 0136
[4250] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:0000 IR:1537 TAD I 0137 ;Add operand to AC, Indexed ZP 0137
[4251] IRQ,DLY,IE=0,0,0 L/AC:1/5612 MQ:0000 IR:7002 BSW ;Byte Swap AC -56=W, 12=E
[4252] IRQ,DLY,IE=0,0,0 L/AC:1/1256 MQ:0000 IR:0357 AND @@57 ;AND operand with AC, Current page @@57
[4253] IRQ,DLY,IE=0,0,0 L/AC:1/0056 MQ:0000 IR:7450 SNA ;Skip on AC <> 0 -W
[4255] IRQ,DLY,IE=0,0,0 L/AC:1/0056 MQ:0000 IR:7110 CLL RAR ;Clear L, Rotate AC & L right
[4256] IRQ,DLY,IE=0,0,0 L/AC:0/0027 MQ:0000 IR:7420 SNL ;Skip on L <> 0
[4257] IRQ,DLY,IE=0,0,0 L/AC:0/0027 MQ:0000 IR:1367 TAD @@67 ;Add operand to AC, Current page @@67
[4260] IRQ,DLY,IE=0,0,0 L/AC:0/0067 MQ:0000 IR:1360 TAD @@60 ;Add operand to AC, Current page @@60
[4261] IRQ,DLY,IE=0,0,0 L/AC:0/0127 MQ:0000 IR:4175 JMS 0175 ;Jump to subroutine ZP 0175
[0176] IRQ,DLY,IE=0,0,0 L/AC:0/0127 MQ:0000 IR:5577 JMP I 0177 ;Jump Indexed ZP 0177
[4267] IRQ,DLY,IE=0,0,0 L/AC:0/0127 MQ:0000 IR:1361 TAD @@61 ;Add operand to AC, Current page @@61
[4270] IRQ,DLY,IE=0,0,0 L/AC:0/1727 MQ:0000 IR:7104 CLL RAL ;Clear L, Rotate AC & L left
[4271] IRQ,DLY,IE=0,0,0 L/AC:0/3656 MQ:0000 IR:7421 MQL ;Load MQ from AC then clear AC
[4272] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:3656 IR:1115 TAD 0115 ;Add operand to AC, ZP 0115
[4273] IRQ,DLY,IE=0,0,0 L/AC:0/7765 MQ:3656 IR:3135 DCA 0135 ;Deposit AC to memory then clear AC, ZP 0135
[4274] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:3656 IR:6002 IOF ;KK8-E: Interrupts disabled
[4275] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:3656 IR:1116 TAD 0116 ;Add operand to AC, ZP 0116
[4276] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:3656 IR:3134 DCA 0134 ;Deposit AC to memory then clear AC, ZP 0134
[4277] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:3656 IR:2134 ISZ 0134 ;Increment operand and skip if zero, ZP 0134
[4300] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:3656 IR:5277 JMP @@77 ;Jump Current page @@77
[4301] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:3656 IR:7501 MQA ;OR MQ with AC
[4302] IRQ,DLY,IE=0,0,0 L/AC:0/3656 MQ:3656 IR:7110 CLL RAR ;Clear L, Rotate AC & L right
[4303] IRQ,DLY,IE=0,0,0 L/AC:0/1727 MQ:3656 IR:7421 MQL ;Load MQ from AC then clear AC
[4304] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:1727 IR:7010 RAR ;Rotate AC & L right
[4305] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:1727 IR:1362 TAD @@62 ;Add operand to AC, Current page @@62
[4306] IRQ,DLY,IE=0,0,0 L/AC:0/2100 MQ:1727 IR:6415 SRS1 ;DP8-EAEB: Read Status 1
[4307] IRQ,DLY,IE=0,0,0 L/AC:0/2100 MQ:1727 IR:2135 ISZ 0135 ;Increment operand and skip if zero, ZP 0135
[4310] IRQ,DLY,IE=0,0,0 L/AC:0/2100 MQ:1727 IR:5275 JMP @@75 ;Jump Current page @@75
[4275] IRQ,DLY,IE=0,0,0 L/AC:0/2100 MQ:1727 IR:1116 TAD 0116 ;Add operand to AC, ZP 0116
I think, I found the main logic for the keys/functions. Another, different coding style and hard to find as calculated, indexed and relocated at runtime. The start address 3067 was not marked as label.
Next to the previous list of pointers (what are indeed lists of JMP instructions, in BASIC: ON X GOTO), I now found several lists of real pointers spread over the ROM.
I noticed that several words are written to RAM (page 0) directly after the LCD values. Lists have different length (often 7 words) and different targets, usually to 64. First I thought that these might be instructions but they’re pointers. The next PC is stored at 131. The start of the table (7155+1) is calculated and stored to 10. Usually, the targets lead at the end to another pointer list, sometimes the same like at 4370. On this code, a “0” is written to LCD digit 2 (to 55 and 52, default is 14=blank). Elsewhere I found 15 and 2x_+blk+9. Everything without skipping.
07156 0063 /write to target 63+1
07157 7771 /-7, write 7 words
07160 3114 /1st pointer
07161 3020
07162 4370
07163 3133
07164 7773
07165 7760
07166 6200 /7th word
Here’s a list of all lists. On left ADR, source+1, destination+1, amount 2s compl., amount dec, the pointers. The amount of lists matches exactly the device’s 13 functions. A printout is initiated by F+1+word of options (printout style, device and baud settings) + start ADR + end ADR + enter key. The end ADR is rounded to 377 or 777. The digit 3 for the printout style must be <4 and 0 for a disassembly output with mnemonics.
This is the most plausible order. Maybe this can be called “microcode”. Most pointers then also write to the LCD.
I found 4 pointer list usually used in the other lists, all writing to 44 up to 48 words so even overwriting some of the LCD values and into page 1. But maybe one value is wrong. These are obviously instructions. 2x taken from 200, 2x from 250. (scroll to right for the functions)
62:
6103: 5423 62 7770 8- 5673 3360 5612 0600 5667 7740 0000 2340 copy without F (or F0
7143: 6370 62 7767 9- 5126 5010 5010 0600 6712 7773 7760 6740 7600. F0 import (or F1 or F1-5
63:
0766: 5754 63 7771 7- 3114 3020 3020 7773 0604 0000 6200 F1 print/export
7132: 5271 63 7771 7- 2246 2224 1431 6712 7772 7760 6370 F1-4 search
7156: 7600 63 7771 7- 3114 3020 4370 3133 7773 7760 6200 F1-5 1st found, search 2
7566: 7466 63 7771 7- 6411 6524 6524 0000 7774 7760 7600 F2
64:
0565: 0400 64 7767 9- 1113 1071 2371 7773 7760 3200 0000 0 0 F3? (F1-5?
1743: 2000 64 7772 6- 1644 1611 1350 7776 7760 2200 F4-0 control
4573: 4553 64 7772 6- 3050 3036 6764 7773 7750 2200 F4-1 control
6115: 2340 64 7772 6- 5543 5525 1343 7776 7760 3200 F4-2 control
65:
1171: 7717 65 7774 4- 6524 6712 7773 7760 F7? +ADR New start PLC
1557: 0600 65 7773 5- 1547 1602 7071 0000 2400 F5 0 ADR Syntaxcheck on
1734: 1611 65 7773 5- 1672 1632 0020 1660 2000 F5 1 ADR Syntaxcheck OFF
43:
1553: 0247 43 7731 39 words
1676: 0177 43 7750 24
2302: 0247 43 7720 48
6531: 0177 43 7732 38
[3067] IRQ,DLY,IE=0,1,0 L/AC:0/0000 MQ:0000 IR:1123 TAD 0123 ;Add operand to AC, ZP 0123
[3070] IRQ,DLY,IE=0,1,0 L/AC:0/0000 MQ:0000 IR:7700 SMA CLA ;Skip on AC < 0, Clear AC
[3071] IRQ,DLY,IE=0,1,0 L/AC:0/0000 MQ:0000 IR:5277 JMP @@77 ;Jump Current page @@77
[3077] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:4017 JMS 0017 ;Jump to subroutine ZP 0017
[0020] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:1417 TAD I 0017 ;Add operand to AC, Indexed ZP 0017 [Auto pre-inc]
[0021] IRQ,DLY,IE=0,0,0 L/AC:0/6663 MQ:0000 IR:3131 DCA 0131 ;Deposit AC to memory then clear AC, ZP 0131
[0022] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:5531 JMP I 0131 ;Jump Indexed ZP 0131
[6663] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:1133 TAD 0133 ;Add operand to AC, ZP 0133
[6664] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:7106 CLL RTL ;Clear L, Rotate AC & L left twice
[6665] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:7006 RTL ;Rotate AC & L left twice
[6666] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:0035 AND 0035 ;AND operand with AC, ZP 0035
[6667] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:3055 DCA 0055 ;Deposit AC to memory then clear AC, ZP 0055 digit 2=0
[6670] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:1133 TAD 0133 ;Add operand to AC, ZP 0133
[6671] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:7002 BSW ;Byte Swap AC
[6672] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:7112 CLL RTR ;Clear L, Rotate AC & L right twice
[6673] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:7012 RTR ;Rotate AC & L right twice
[6674] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:7010 RAR ;Rotate AC & L right
[6675] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:0311 AND @@11 ;AND operand with AC, Current page @@11
[6676] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:7421 MQL ;Load MQ from AC then clear AC
[6677] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:1133 TAD 0133 ;Add operand to AC, ZP 0133
[6700] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:0035 AND 0035 ;AND operand with AC, ZP 0035
[6701] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:7501 MQA ;OR MQ with AC
[6702] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:3052 DCA 0052 ;Deposit AC to memory then clear AC, ZP 0052
[6703] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:5020 JMP 0020 ;Jump ZP 0020
[0020] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:1417 TAD I 0017 ;Add operand to AC, Indexed ZP 0017 [Auto pre-inc]
[0021] IRQ,DLY,IE=0,0,0 L/AC:0/7744 MQ:0000 IR:3131 DCA 0131 ;Deposit AC to memory then clear AC, ZP 0131
[0022] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:5531 JMP I 0131 ;Jump Indexed ZP 0131
[7744] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:1417 TAD I 0017 ;Add operand to AC, Indexed ZP 0017 [Auto pre-inc]
[7745] IRQ,DLY,IE=0,0,0 L/AC:0/7155 MQ:0000 IR:3010 DCA 0010 ;Deposit AC to memory then clear AC, ZP 0010
[7746] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:1410 TAD I 0010 ;Add operand to AC, Indexed ZP 0010 [Auto pre-inc]
[7747] IRQ,DLY,IE=0,0,0 L/AC:0/0063 MQ:0000 IR:3011 DCA 0011 ;Deposit AC to memory then clear AC, ZP 0011
[7750] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:1410 TAD I 0010 ;Add operand to AC, Indexed ZP 0010 [Auto pre-inc]
[7751] IRQ,DLY,IE=0,0,0 L/AC:0/7771 MQ:0000 IR:5336 JMP @@36 ;Jump Current page @@36
[7736] IRQ,DLY,IE=0,0,0 L/AC:0/7771 MQ:0000 IR:3013 DCA 0013 ;Deposit AC to memory then clear AC, ZP 0013
[7737] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:1410 TAD I 0010 ;Add operand to AC, Indexed ZP 0010 [Auto pre-inc]
[7740] IRQ,DLY,IE=0,0,0 L/AC:0/3114 MQ:0000 IR:3411 DCA I 0011 ;Deposit AC to memory then clear AC, Indexed ZP 0011 [Auto pre-inc]
test pointer 3 results in writing again the same pointers. Reset? No branches no IOTs here.
[4370] IRQ,DLY,IE=0,1,0 L/AC:0/0000 MQ:0000 IR:4017 JMS 0017 ;Jump to subroutine ZP 0017
[0020] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:1417 TAD I 0017 ;Add operand to AC, Indexed ZP 0017 [Auto pre-inc]
[0021] IRQ,DLY,IE=0,0,0 L/AC:0/1357 MQ:0000 IR:3131 DCA 0131 ;Deposit AC to memory then clear AC, ZP 0131
[0022] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:5531 JMP I 0131 ;Jump Indexed ZP 0131
[1357] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:1102 TAD 0102 ;Add operand to AC, ZP 0102
[1360] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:3051 DCA 0051 ;Deposit AC to memory then clear AC, ZP 0051
[1361] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:3053 DCA 0053 ;Deposit AC to memory then clear AC, ZP 0053
[1362] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:5020 JMP 0020 ;Jump ZP 0020
[0020] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:1417 TAD I 0017 ;Add operand to AC, Indexed ZP 0017 [Auto pre-inc]
[0021] IRQ,DLY,IE=0,0,0 L/AC:0/7744 MQ:0000 IR:3131 DCA 0131 ;Deposit AC to memory then clear AC, ZP 0131
[0022] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:5531 JMP I 0131 ;Jump Indexed ZP 0131
[7744] IRQ,DLY,IE=0,0,0 L/AC:0/0000 MQ:0000 IR:1417 TAD I 0017 ;Add operand to AC, Indexed ZP 0017 [Auto pre-inc]
[7745] IRQ,DLY,IE=0,0,0 L/AC:0/7155 MQ:0000 IR:3010 DCA 0010 ;Deposit AC to memory then clear AC, ZP 0010 src 7156 again 7 words to 63+1
I’m currently stuck. I checked all pointers but not all branches. 377 for round up I only have 2x. Once at 3107. Code is here, there’s also a pointer target at 3050. I sometimes have resets to 400 but maybe there’s just one operand still wrong due to wrong entry or missing IOT.
C3042, 7761 / CLA MQA SCA MQL
ISZ D3133 / @@3043=2333
DCA D0045 / @@3044=3045 600 pointer
TAD C3001 / @@3045=1201 14=blk
DCA L0054 / @@3046=3054 digit 1
JMP I C0031 / long jump to L7000 @@3047=5431 ------end code fetch PC jump target, 7000 from empty NOP wrong
TAD D0120 / @@3050=1120 3050 pointer entry
CLL CMA IAC / @@3051=7141
TAD D0133 / @@3052=1133
SZL CLA / @@3053=7630
JMP L3061 / @@3054=5261
TAD D0120 / @@3055=1120
AND C3037 / @@3056=0237 7400
TAD C3107 / @@3057=1307 377 round
DCA D0133 / @@3060=3133
L3061,
TAD D0133 / @@3061=1133
DCA D0122 / @@3062=3122
CLA CLL IAC / @@3063=7303 AC=100
AND AI4 / AUTO INDEX REGISTER @@3064=0014
SNA CLA / @@3065=7650
C3066, 5306 / JMP L3106
D3067, 1123 / TAD L0123 code
SMA CLA / @@3070=7700
JMP L3077 / @@3071=5277
TAD L0123 / @@3072=1123
AND C3152 / @@3073=0352 AND 70
TAD C3172 / @@3074=1372 7730
SZA CLA / @@3075=7640
JMP L3106 / @@3076=5306
I think, I found the keyboard values for the Festo operation keys.
First, concerning far jumps, nested jumps and subroutines via the auto index registers.
There are JMS instructions 4017 and 4023 used. After the start and RAM check, there are some default values written (from 474) to page 0 starting from 17-47. So at 17 is the continue address after the writing.
On a 4023 instruction there’s the next word taken as next target PC. On a 4017 instruction the target is the 2nd word. The other word in between is unrelated. The 4017 can take some parameters like more pointers, return stack, source for tables or other values.
2 samples, first one using a parameter for writing a list to page 0. The infinite loop at 600, indexed at 30 is still strange. Maybe there’s a discrete circuit of the keys for interrupt and write to memory? Or some IOT had changed the pointers before. (Scroll windows to right and down for full views)
addr word label (wrong) instr. - real instruction
1636 03106 4017 L03106, JMS P00017
1637 03107 0377 D03107, 0377 unrelated value (used earlier at 3057)
1638 03110 6663 6663 far JMP 6663
1639 03111 7744 SZA SMA CLA OSR JMP2 7744 after above
1640 03112 0765 AND I P03165 765+1 SRC (63,7771) write to 63+1 7 words (2s compl), words follow there
1641 03113 0600 AND I P03000 JMP3 after writing, 600 is a loop, waiting for key?
1642 03114 7303 CLA CLL BSW IAC code. 3114 is the first value written above at 64
Second using parameters for next pointers, pointers when skip (crawling back) and pointers depending on the AC. 5 values, needs more investigation. I don’t have a group with 5 keys, maybe a function combination F-1-5 or bits of an instruction? Or part of an error (wrong key). There’s more code than assumed but most of these words after 4017 are pointers.
1696 03200 4017 D03200, 4017
1697 03201 0070 D03201, 0070 other value
1698 03202 7176 CLL CML CMA RTL RTR. far JMP 7176
1699 03203 5001 P03203, D05001 value for MQ
1700 03204 4716 JMS I P03316 JMP 4716 if skip to 7216
1701 03205 7116 CLL RTL RTR JMP2
1702 03206 3200 DCA D03200 value pointer for 45
1703 03207 6135 6135 JMP if skip to 7076
1704 03210 2556 ISZ I P00156 JMP if skip to 6140, AC<0, 7777->2555
1705 03211 3564 DCA I P00164 value pointer for 44 if skip to 4731, L=1, IOT
1706 03212 3561 DCA I P00161 value for dep 110
1707 03213 4603 JMS I P03203 JMP2 4603
1708 03214 3561 DCA I P00161 JMP if skip to 4311
1709 03215 4225 JMS 3225 value for MQ if skip to 7267
1710 03216 3565 DCA I P00165 JMP if skip to 7220, 7335 or rather 7264?
1711 03217 4223 JMS 3223 JMP if skip to 7265
1712 03220 3770 DCA I P03370 JMP if skip to 7251
1713 03221 3567 DCA I P00167 JMP if skip to 7244
1714 03222 3557 L03222, DCA I P00157 JMP if skip to 7237, AC<0
1715 03223 4240 JMS 3240 JMP2 AC<>0, after 7216 AC=1
1716 03224 4234 JMS 3234 JMP2 " AC=2
1717 03225 4236 JMS 3236 JMP2 " AC=3
1718 03226 2556 ISZ I P00156 JMP2 " AC=4
1719 03227 3230 DCA D03230 JMP2 " AC=5 (6 not allowed) ----------end parameters
1720 03230 1113 D03230, 1113 code TAD 113 (pointer above if AC=5)
1721 03231 3121 DCA P00121 code . deposit 7776 to 121
1722 03232 3112 DCA D00112 dep 0
1723 03233 3113 DCA D00113 0
1724 03234 1123 TAD P00123 0
1725 03235 0201 AND D03201 AND 70
1726 03236 7450 SNA
1727 03237 5644 JMP I P03244 JMP 3375
1728 03240 1266 TAD D03266 7740
1729 03241 7700 SMA CLA
1730 03242 5644 JMP I P03244 code end JMP 3375
1731 03243 4017 D03243, 4017 next far JMP (7176) note same as above but value 5000 instead of 5001. I think for AC 0/1 each.
I found 2 more lines, writing to RAM, starting with 62+1 (here 66+1), my assumed function key table. I also have aligned it to right to match the same addresses. Unlike the others, which copy data using source, target and amount of words, the code of these 2 write single words as there are just 3. The first ones are pointers, the rest are TAD values. I found function F-9 not listed on my function summary. That’s for executing direct commands on the attached PLC. These also use the least additional operands (0) and I think writing “11” (dec 9) to the LCD. Maybe both are for F-9. There’s also F8 (for bit reversal), but that is just displayed and not for input.
65: 66 67 70 71 72 73 75
1171: 7717 65 7774 4- F7 ? 6524 6712 7773 7760 F7? +ADR Reset PLC code 6441+6477. 6443=327=F7. or F3
1557: 0600 65 7773 5- F9 ? 1547 1602 7071 0000 2400 F5 0 ADR Syntaxcheck on or F9
1734: 1611 65 7773 5- 1672 1632 0020 1660 2000 F5 1 ADR Syntaxcheck OFF . code 1611. else? (1660=table.
66: new
2113: 2011 66 7775 3- F9 F5-0? 6737 7774 7760 (66 is not in/as tab) F5-0, 52=6305=5 but not dep, 600 . AC=0 code wr 2011
2116: 2030 66 7775 3- F9 F5-1? 6744 7775 7774 0000 0 (66 is not in/as tab) 6744:digit2=5. LCD=11 (dec 9?) AC<>0
Keyboard values:
I found 8 4017 instructions that are close each other. The target is calculated at 24 depending on the AC. Going backwards and counting the distance, I found the AC values needed reaching that. I assume these are keyboard values maybe for keys 0-7 or more likely the 8 Festo operations (panel keys, left 9 keys except “OR”, that is a fixed special opcode belonging to the group with brackets) .
(0, 6, 13, 15, 26, 42, 44, 46). Checking for 0/1, delete, set, load, with contents of, with address, as decimal. I now have the far JMPs and their targets. Most have IOT inputs. Not sure about their values. The start is at 3020.
I now have checked the full code in detail and commented it. Much is still unknown. Often the exact (calculated) AC values are unknown. I can only be sure if it’s 0, and that’s usually an error. Most error codes are also calculated so also they don’t give more clues.
I also found out how the next word with 2 more letters is printed. The pointer of the next mnemonics is stored at 137. I have to manual skip to 4301 and then 4311. I still have to search where the CRC is calculated and how a line is exactly build. 6415 is probably the IOT for the printer. I also found some ASCII conversions. Only need for some few control and special characters. Some new facts on my first thread. The PLC is FPC 606.
Some good detective work there!
Finally!
I found the code of all segments for a printout.
I explained earlier how the mnemonics are read from the table at 4000-4177 with a pointer for that. The special encoding is byteswapped, the 1st letter is extracted (AND 77), converted to ASCII (in octal) and printed one by one letter. The value is not stored to RAM, just the pointer.
As said I have to manually skip 2x for an IOT to 4301 and after some words to 4311.
I tried emulator WINEIGHT with adding device 41 but there’s no output, probably as the IOT 6415 is for reading.
The first instruction always starts with .WENN (IF). The dot is not encoded like the mnemonics but as ASCII, again in octal (2Eh=56o). There is no button for WENN. There is for ;WENN (furthermore if…). The Festo code then starts with a 1. The PDP-8 code adds 15 if AC=1 to the value 56 (dot) to have 73 (semicolon).
The bit 1 is stored in RAM at 105. The next digits entered are probably stored in 132+133, 103+104, 75?. So that will be a clue for the keyboard IOT.
Print .WENN or ;WENN
1849 03427 0015 D03427, 0015 /value to be added to have a ";"
1850 03430 1105 TAD D00105 /bit of key furthermore stored
1851 03431 7640 SZA CLA /if AC=0 no adding, just a "." and skip
1852 03432 1227 TAD D03427 /15 added for ;
1853 03433 1345 TAD D03545 /+56 for . or 73 for ;
1854 03434 4175 JMS P00175 /JMS 176->4267 print above character
1855 03435 2112 ISZ D00112 /return after skip to 4301+4311
1856 03436 1241 TAD D03441 /4152 pointer to WE of WENN=5612, W=56 special sixbit
1857 03437 3137 L03437, DCA P00137 /store the pointer to RAM 137
1858 03440 4017 JMS P00017 /JMS 4246 print 2 characters
1859 03441 4152 D03441, 4152 /pointer to mnemonic WENN
1860 03442 4246 JMS L03446 /far JMP
A printout starts with /D or /L, latter one with mnemonics. Same style with 2 options
2479 04603 1123 TAD P00123 /code entry 4603 see code 2 below
2480 04604 0212 AND D04612 /AND70
2481 04605 7650 SNA CLA
2482 04606 1214 TAD D04614 /10 +(114= "L" list with MNE AC=0
2483 04607 1213 TAD D04613 /104 ASCII "D" list Druckbild without MNE
2484 04610 4175 JMS P00175
2485 04611 5020 JMP P00020
2486 04612 0070 D04612, 0070 /AND value
2487 04613 0104 D04613, 0104 /ASCII D
2488 04614 0010 D04614, 0010 /value to be added to 104, 114=L
Here the full code for a printout. I first made a mistake, I think I used early at a skip AC<0 instead of 0
1696 03200 4017 D03200, 4017
1697 03201 0070 D03201, 0070 / unrelated value
1698 03202 7176 /far JMP 7176
1699 03203 5001 P03203, D05001 /value for MQ
1700 03204 4716 /JMP 4716 if skip to 7216
1701 03205 7116 /JMP2 /AC=0 skip to 7076
1702 03206 3200 /value for 45. pointer. restart?
1703 03207 6135 /JMP if skip tp 7076
1704 03210 2556 /JMP2 print CR+LF, 2x skip 4301+4311
1705 03211 3564 /JMP3 print "/"
1706 03212 3561 /value for 110 (?)
1707 03213 4603 /JMP2 print /D or /L (entry see code 1)
1708 03214 3561 /JMP if skip to 4301+4311
1709 03215 4225 /JMP2 print "0"
1710 03216 3565 /JMP3 print "-"
1711 03217 4223 /JMP4 print "0"
1712 03220 3770 /JMP5 print space 40
1713 03221 3567 /JMP6 print "S"
1714 03222 3557 L03222, /JMP7 print":"
1715 03223 4240 /JMP8 print 0
1716 03224 4234 /JMP9 print 0
1717 03225 4236 /JMP10 print 0 (followed by CRC)
1718 03226 2556 /print CR+LF
1719 03227 3230 DCA D03230/ return 3230=next address
1720 03230 1113 D03230, 1113 /code TAD 113
result (example)
/L 00000 - 00003 S: 0000176022 (checksum, calculation not found yet)
000000: 011001 .WENN ESB EAS 1
000001: 031010 DANN SET EAS 10
The start address 3200 is probably the pointer at 72 (2x) in one of my lists/tables. Keys F3 and F4-2 are then wrong and should be both F1.
64: 65 66 67 70 71 72 73 74 75
0565: 0400 64 7767 9- 1113 1071 2371 7773 7760 3200 0000 0 0 F3? (F1-5? F3=del cartr light . -5 /3200 print F1 /d and or /l
1743: 2000 64 7772 6- 1644 1611 1350 7776 7760 2200 F4-0 control -2
4573: 4553 64 7772 6- 3050 3036 6764 7773 7750 2200 F4-1 control 1-bit -5
6115: 2340 64 7772 6- 5543 5525 1343 7776 7760 3200 F4-2 control -2 print F1
Most mysteries have been solved. Including RAM, EPROM, keyboard and memory mapping and some CPU and device internal special features and the mystery about the wrong test pattern.
In case someone finding this (like via Google) or in case Vince is interested, the thread continues here