home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
ftp.whtech.com
/
ftp.whtech.com.tar
/
ftp.whtech.com
/
club100
/
ref
/
rcmap0.200
< prev
next >
Wrap
Text File
|
2006-10-19
|
27KB
|
613 lines
----------------------------
| Model 100/200 System Map |
----------------------------
ROM: Part VIII
Copyright 1985
Revision Date: 09/30/85
Compiled and Researched by:
Robert D. Covington
Systems Information Management Consultants
[Not associated with The Covington Group, N. Y., N. Y.]
Revised for Tandy 200 by Chris De Herrera on 9/89
This document may be duplicated and distributed free of
charge to any individuals who desire it. Any duplications of
this document, however, must include all of the information
contained here-in, with no deletions or changes.
The author and distributors of this document make no
expressed or implied warrantees as to the validity of the
information contained here in.
Tandy 100 Memory Map
Location Bank 1 Bank 2
-----------------------------------------
Rom: 32k Basic Option ROM
0 to Telcom
32767 Text
Addrss
Schedl
Ram: User Files (1 Bank of Up to 32k max)
32768 to
65535
Tandy 200 Memory Map
Location Bank 1 Bank 2 Bank 3
-----------------------------------------------------
Rom1: 32k Basic Multiplan Option ROM
0 to Telcom
32767 Text
Addrss
Schedl (Only in RAM Bank1)
List
Rom2: 8k Calculator Calculator Calculator
32768 to Alarm Alarm Alarm
40959
Ram: 24k User files (up to 3 banks)
40960 to
65535
Note: The alarm and Calculator are available even when Multiplan and some
rom's are in use.
Tandy 200 Multiplan Notes: Multiplan requires maxram = himem = 61104 and
clears 4213 bytes from 56891 to 61104. If you have a m/l program that can be
deleted to run Multiplan, the characters MP should be placed at 61102 and
61103.
- File formats -
For M100 & M200:
.BA Files:
2 bytes - Address of next line
2 bytes - Line number
Up to 255 characters ending with a null
EOF is 3 consecutive nulls
.DO Files:
Text ended with a EOF character 1AH
.CO Files:
2 bytes - Address to load to
2 bytes - Number of bytes to load (-start 6)
2 bytes - Transfer address
- File Descriptor Block (Address Given by VARPTR(#file)) Format -
Byte:
0 - File status (0-not open, 1-open for input, 2 open for
output or append)
2 & 3 - Address of file directory entry
4 - File device (248-RAM, 249-MoDeM, 250-LinePrinTer,
251-WAND, 252-COM, 253-CASsette, 254-CRT, 255-LCD)
6 - Offset from buffer start (see bytes 9) for start of next
record
7 & 8 - Relative position of next 256 byte block from
beginning of file
9 - Start of 256 byte buffer for data transfer
- Math Routine Summary -
For M100:
-------------------------------------------------------------
Function Single Precision Double Precision Integer
-------------------------------------------------------------
+ 37F4H 2B78H 3704H
- 37FDH 2B69H 36F8H
* 3803H 2CFFH 3725H
/ 380EH 2DC7H 0F0DH
^ 3D7FH 3D8EH 3DF7H
Compare 3498H 34FAH 34C2H
-------------------------------------------------------------
- Floating Point Accumulator Format -
For M100:
---------------------------------------------------------------
FAC1 | FAC2 | DP | SP | Integer | SP
Address | Address | Format | Format | Format | Register
---------------------------------------------------------------
FC18H | FC69H | S & E | S & E | - | C
FC19H | FC6AH | BCD M | BCD M | - | B
FC1AH | FC6BH | BCD # | BCD # | LSB | E
FC1BH | FC6CH | BCD # | BCD L | MSB | D
FC1CH | FC6DH | BCD # | - | - | -
FC1DH | FC6EH | BCD # | - | - | -
FC1EH | FC6FH | BCD # | - | - | -
FC1FH | FC70H | BCD L | - | - | -
---------------------------------------------------------------
LSB = Least significant byte of intger
MSB = Most significant byte of integer. Bit 7 contains the sign
of the integer
BCD L = Least significant BCD byte
BCD H = Most significant BCD byte
BCD # = Middle BCD bytes. Each digit of the number is represented
by one of the values in the two nibbles in each byte
S & E = Sign and exponent of each number. Bit 7 contains the sign
of the floating point number. Bit 6 must be set. Bits 0-5
determine where the decimal point is to be inserted. For
example, if this byte contained a 65, the sign would be
positive and the decimal point would be placed between the
first and second digits (#.###....)
- Basic Token Values -
For M100 and M200:
---------------------------------------------
| Basic | Token | Basic | Token |
| Command | Value | Command | Value |
---------------------------------------------
ABS E1 LET 87
ASC F9 LINE 92
ATN ED LIST A5
BEEP B1 LLIST A7
CALL B9 LOAD 9B
CDBL F4 LOG E8
CINT F2 LPOS E4
CLEAR A7 LPRINT A0
CLOAD A8 MAX B7
CLOAD? A8 MENU BA
CLOADM A8 MERGE 9C
CLOSE 9A MOTOR B6
CLS B0 NAME BC
COM AD NEW BF
CONT A4 NEXT 82
COS EA ON 97
CSAVE A9 OPEN 99
CSAVEM A9 OUT 96
CSNG F3 PEEK EE
CSRLIN CA POKE A2
DATA 83 POS E5
DATE AB POWER B8
DAY AC PRESET B5
DEF A1 PRINT A3
DIM 85 PSET B4
DSKI C8 READ 86
DSKO 98 REM 8E
EDIT 93 RESTORE 8B
END 80 RESUME 95
EOF EF RND E7
ERROR 94 RUN 89
EXP E9 SAVE 9E
FILES 9D SAVEM 9E
FIX F5 SCREEN BE
FOR 81 SGN DF
FRE E2 SIN EB
GOSUB 8C SOUND B2
GOTO 88 SPACE FB
HIMEM CC SQR E6
IF 8A STOP 8F
INKEY$ C9 STR F7
INP E3 STRING C6
INPUT 84 TAB( C0
INPUT# 84 TAN EC
INT E0 TIME AA
IPL BB USING C2
KEY AF VAL F8
KILL BD VARPTR C3
LCOPY B3 WIDTH 90
LEN F6
- Option ROM Important Addresses -
For M100 & M200:
40H = 54H
41H = 43H - Required for ROM to be detected on BOOT
42H - 47H - Name of file associated with ROM program
For M100:
Code at 7E24H-7E43H executed on BOOT to handle option ROM.
Code at 0365H loaded at F605H on BOOT to detect option ROM.
- Hardware Port Map -
For M100:
A0H - Modem control port
Output:
Bit:
0 - Modem telephone relay (1-Modem connected to phone
line)
1 - Modem enable (1-Modem chip enabled)
For M100/200:
B0H - 8155 PIO Command/Status Register
Output:
Bit:
0 - Direction of Port A (0-input, 1-output)
1 - Direction of Port B (0-input, 1-output)
2 & 3 - Port C definition (00 - All input, 11 - All output,
01 - Alt 3, 10 - Alt 4 (see Intel technical sheets
for more information))
4 - Enable Port A interrupt (1 - enable)
5 - Enable Port B interrupt (1 - enable)
6 & 7 - Timer mode (00 - No effect on counter, 01 - Stop
counter immediately, 10 - Stop counter after TC, 11
- Start counter)
Input:
Bit:
0 - Port A interrupt request
1 - Port A buffer full/empty (input/output)
2 - Port A interrupt enabled
3 - Port B interrupt request
4 - Port B buffer full/empty (input/output)
5 - Port B interrupt enabled
6 - Timer interrupt (status of TC pin)
7 - Not used
B1H - 8155 PIO Port A
Output:
8 bit data port for printer output, keyboard column strobe,
and LCD
In addition, the first 5 bits of this port is used to
control the 1990 real time clock chip. The configuration of
these five bits are:
Bit:
0 - C0
1 - C1
2 - C2
3 - Clock
4 - Serial data into clock chip
B2H - 8155 PIO Port B.
Output:
Bit:
0 - Column 9 select line for keyboard. This line is
also used for the CS-28 line of the LCD.
1 - CS 29 line of LCD
2 - Beep toggle (1-Data from bit 5, 0-Data from 8155
timer)
3 - Serial toggle (1-Modem, 0-RS232)
4 - Software on/off switch for computer
5 - Data to beeper if bit 2 set. Set if bit 2 low.
6 - DTR (not) line for RS232
7 - RTS (not) line for RS232
B3H - 8155 PIO Port C
Input:
Bits:
0 - Serial data input from clock chip
1 - Busy (not) signal from printer
2 - Busy signal from printer
3 - Data from BCR
4 - CTS (not) line from RS232
5 - DSR (not) line from RS232
6-7 - Not avaiable on 8155
B4H - 8155 Timer register. LSB of timer counter
B5H - 8155 Timer register. MSB of timer counter
B8H - Same as port B0H
B9H - Same as port B1H
BAH - Same as port B2H
BBH - Same as port B3H
BCH - Same as port B4H
BDH - Same as port B5H
C0H - Bidirectional data bus for UART (6402) (C0H-CFH same)
D0H - Status control register for UART, modem, and phone (6402)
(D0H-DFH same)
Output:
Bits:
0 - Stop Bits (1-1.5, 0-2)
1 - Parity (1-even, 0-odd)
2 - Parity Enable (1-no parity, 0-parity enabled)
3 - Data length (00-5 bits, 10-6 bits, 01-7 bits, 11-8
bits)
4 - Data length (see bit 3)
Input:
Bits:
0 - Data on telephone line (used to detect carrier)
1 - Overrun error from UART
2 - Framing error from UART
3 - Parity error from UART
4 - Transmit buffer empty from UART
5 - Ring line on modem connector
6 - Not used
7 - Low Power signal from power supply (LPS not)
E0H - Keyboard input and misc. device select (E0H-EFH same)
Output:
Bits:
0 - ROM select (0-Standard ROM, 1-Option ROM)
1 - STROBE (not) signal to printer
2 - STROBE for Clock chip (1990)
3 - Remote plug control signal
Input:
8 bit data row from keyboard strobe
F0H - LCD display data bus (F0H-FFH same)
- How LCD unit works on the Tandy 200 -
It has 16 controllable registers.
These are accessed through IO ports.
To change them, do this:
OUT 255,r:OUT 254,x
r stands for register # and x stands for a numeric value 0-255
The register to be accessed is sent to port 255 and all numerical values are
transferred through port 254. If x should be greater than 255, the LSB(least
significant byte) is assigned to r, then MSB(most significant byte) is
assigned to r+1. There is only one readable register which is r13, through
which graphics data is read. It has the format:
OUT 255,13:B = INP(254):B = INP(254):'first INP() is ignored by LCD
Explanation of each register:
r0 - enable or disable screen. Any value less than 63 indicates screen off,
value 63 indicates screen on.
r1 - determine how many pixels wide is each character.
0,1 = 6 bits
2 = 7 bits
3 = 8 bits
r2 - vary the format of graphics data. Each byte of graphics data are
displayed one after another, 40 bytes in one line. By changing this
register, the order in which they are displayed can be changed.
18 = double height
38 = normal display
58 = half height
any other = strange display
r3 - darkness of the pixels. Any other values other than 63 distorts the
screen. To not see the distortion, screen can be disabled with r0,
then darkness can be varied.
63 = normal
<63 = lighter
>63 = darker
These are unknown:
r4 - ?
r5 - ?
r6 - ?
r7 - ?
r8,r9 - where the first byte of the screen display is. This register points
to the first byte displayed on the screen. Address can range from 0
to 8191. LSB of value is sent to r8, MSB to r9. See SCROLL.200 in
DL4 for demonstration using this.
r10,r11 - Points to the address of a byte which is to be written to or read
from in the display field. Address range is 0 to 8191. LSB to
r10, MSB to r11.
r12 - Write mode. After this register has been accessed, the value placed
at port 254 is written to LCD. The byte is written to the address
pointed by r10 and r11. The address pointer is automatically
incremented by one after a write, so if the next byte is to be written
is right next to it, address need not be defined again.
r13 - Read mode. After this register has been acessed, the byte of graphics
data that the r10 and r11 points to is placed at port 254. After it
is read, the address is incremented by one, and points to the next
byte. The data that is read right after the address is redefined by
r10 and r11 has to be ignored(a delay of 3 NOP instructions has to
follow it if done in machine language), and the real data is fetched
by second read. After that the rest of data can be read in successive
order without delays or null inputs.
Format is: OUT 255,13:B = INP(254):B = INP(254):'B=byte
r14 - Position of the bit to be set to 0. Manipulates only a single bit of
a byte on the screen. Other bits are unaffected. Range 0-7
r15 - Does same thing r14 does, except that it sets a bit to 1
How a character is displayed:
A single character consists of 8 bytes stacked on top of each other.
01234567
00100000 0
01010000 1 Eight
10001000 2 rows
10001000 3 of
11111000 4 bytes
10001000 5 form
10001000 6 a
10001000 7 character.
The letter formed is "A". To draw it on the screen, each byte, starting from
the first byte in row 0, is sent to LCD one byte per line. Since a line
consists of 40 bytes, the address of the next byte has to be incremented by
40. So if the first byte is in address 0, 2nd byte is in address 40, 3rd in
80, and so on. The next character to be drawn has to relocate its address on
the screen so that its first byte is right next to the first byte of the
previous character, else the character would be displayed right underneath the
previous one, not side by side.
Internal organization:
The total number of bytes in the LCD graphics field is 8192. The total
number that can be displayed at one time is 5120. r8 and r9 are used to
determine which 5120 portion of 8192 bytes are displayed.
All bytes are displayed one after another, line by line, each line
consisting of 40 bytes. There are 204.8 lines all together, and 128 lines
displayed on the screen.
- 8085 RIM and SIM Bit Maps -
SIM Bit 0: RST 5.5 mask (set mask) RIM Bit 0: RST 5.5 mask
1: RST 6.5 mask (set mask) 1: RST 6.5 mask
2: RST 7.5 mask (set mask) 2: RST 7.5 mask
3: Mask set enable 3: Int. enable
4: Reset RST 7.5 flip/flop 4: RST 5.5 pending
5: Not used 5: RST 6.5 pending
6: SOD change enable 6: RST 7.5 pending
7: SOD pin output 7: SOD pin input
Note: SOD pin is used for cassette I/O on Model 100
- Model 100/200 Special Control Characters -
------------------------------------------------------------------------------
| M100 | M200 |
Control Code | Print | Routine | Print | Routine |
Sequence | Address | Address | Address | Address | Description
------------------------------------------------------------------------------
Beep (7) 4229H 7662H 4F45H 8FABH Beep
Tab (9) - 4480H - Tab cursor
LF (10) 4225H 4494H Move down one line
Home (11) 422DH 44A8H 4F49H Home cursor
CLS (12) 4231H 4548H 4F4DH Clear screen
CR (13) - 44AAH - Move cursor to beginning
of next line
ESC A - 4469H - Move cursor up one line
ESC B - 446EH - Move cursor down one
line
ESC C - 4453H - Move cursor to the right
ESC D - 445CH - Move cursor to the left
ESC E - 4548H - Clear screen
ESC H - 44A8H - Home cursor
ESC J - 454EH - Erase from the cursor to
the bottom of the screen
ESC K 425DH 4537H 4F7CH Erase from the cursor to
the end of the line
ESC L 4258H 44EAH 4F77H Insert blank line at
current line
ESC M 4253H 44C4H 4F72H Delete current line
ESC P 4249H 44AFH 4F68H Turn cursor on
ESC Q 424EH 44BAH 4F6DH Turn cursor off
ESC T 4235H 4439H 4F54H Protect line 8
ESC U 423AH 4437H 4F59H Unprotect line 8
ESC V 423FH 443FH 4F5EH Stop automatic scrolling
ESC W 4244H 4440H 4F63H Resume automatic
scrolling
ESC X 4262H 444AH
ESC Y 427CH 43AFH 4F9BH Set cursor position.
Coordinate for cursor
(row and column) follow
ESC Y sequence
ESC j - 4548H - Clear screen
ESC l - 4535H - Erase current line
ESC p - 4431H - Start inverse video mode
ESC q - 4432H - Cancel inverse video
mode
- Model 100 Keyboard Matrix -
------------------------------------------------
7 | L K I ? * -> Ent f8 Brk
Row 6 | M J U > & <- Prt f7
In 5 | N H Y < ^ Up Lbl f6 Cap
4 | B G T " % Dwn Pst f5 Num
0E0H- 3 | V F R : $ + Esc f4 Cde
0EFH 2 | C D E ] # - Tab f3 Gph
(224- 1 | X S W P @ ) Del f2 Ctl
239) 0 | Z A Q O ! ( Spc f1 Sft
------------------------------------------------
bit 0 1 2 3 4 5 6 7 0
[----------- 0B1H or 0B9H -----------] [0B2H]
[----------- 177 or 185 ------------] [178 ]
Column Strobe
Note: This table is incorrectly documented in Radio Shack's
"Model 100 Technical Reference Manual" (26-3810)
References & History
This documented was created with well over 200 hours of
sweating over a Model 100 ROM disassembly. I started my first
research on the Model 100 ROM about 2 hours after purchasing it
(Note: I had one of the first 100's off the production line. I
believe I purchased my 100 in June of 1983). After I figured
out how to use TELCOM, I downloaded a BASIC Z-80 disassembler
that friend of mine (Mike Livorsi) wrote from my Model 3. After
making a few changes to the disassembler, I was able to get it
to work on the Model 100. Then, I tested my Model 100's
parallel printer port by printing a disassembly of the Model
100's ROM on my old LP8 (note:the disassembly requires a 3 inch
note book to fit in). A day later, I came back to my Model 100
and found what every machine language addict loves; a complete
dissasembly of the ROM.
At this point, I had a big problem; where to start. At the
time, the only documentation for the 100 was the Instruction
Manual. "Hacker reliefs" like schematics, memory maps,
debuggers, etc. could only be found in the dreams of the infant
portable hackers.
What did I end up doing? Well, I decided to write a little
BASIC program to search for specific bytes in ROM. This program
was used initially for finding the text string "Ok" in ROM.
Once I found out where the message was in ROM, I then searched
for any ML instructions that referenced the message. Then, on a
warm July night in St. Louis, I found what I was looking for; a
16 bit register load that referenced the message "Ok" followed
by a CALL instruction. This was the key I needed to open the
door to the Model 100's ROM. With my experience from the Model
1/3/Coco ROMs, I knew that the load/CALL sequence I found was
used to print a text string on the screen. From this little
information, I was able to interrogate the subroutine called and
find out how the display operated. In addition, since "Ok" is
only printed at BASIC ready, I was able to trace out the
keyboard input routines and eventually, the entire BASIC
interpreter.
About 200 or so hours later, I documented most of the Model
100's ROM. At this time, I knew enough about my Model 100 to
write just about any machine langauge program that I needed.
When I started writing ML programs for the 100, I found one
problem with my ROM documentation; it was too hard to find a
particular ROM address. What I needed was an organized
collection of all my notes, "chicken scratches", etc.
From this came the memory map you hold in your hand right
now. In this memory map, I basically included the information
that I use the most when ML programming. I did not include a
lot of information on how the ROM handles certain task, but I
did include information that can be used by external stand alone
ML programs.
In creating this document, I had a little help along the
way with figuring out a few things. Below is a list of sources
I used to help me determine or verify what certain things in the
Model 100 did:
Model 100 User Manual, Radio Shack
Model 100 Service Manual (26-3801), Radio Shack
Microsystem Components Handbook, Volume 1, Intel (1984)
MOS Microprocessors and Peripherals, Advanced Micro Devices
(1983)
Microsoft BASIC Decoded & other Mysteries for the TRS-80, by
James Lee Farvour, IJG (December 1982)
"Inside the 100", by David P. Sumner, 80 Micro (December 1983)
The following sources were used to cross reference the M100 and M200:
Model 100 ROM Functions (700-2245), Radio Shack
Tandy 200 Technical Reference Manual, (26-3861), Radio Shack
Cross 1 & 2, Robert Benson, Club 100
LCDIO.200, James Yi (Tandy 200 LCD Registers)
Portable 100, Custom 200, multiple issues, Paul Globman
EQUATE.HEX, Phil Wheeler
<EOF>
