TRS-80 DOS - VTOS 4.0.2 for the Model I - SYS6/SYS Disassembled

On entry Register Pair HL points at the text after the command word, Register B holds the member code, and Register A holds the request code found at 430EH: request 88H does not store its code there, so 430EH still names the overlay at 4E00H, normally SYS1/SYS. The stack holds 4C4BH, the request handler's return (it puts the BREAK byte back and returns the member's Register A and flags), and below it 402DH, which SYS1/SYS pushed (VTOS READY), or the return address of a program that executed a command line through 4405H. A member that returns ends the command; JP 402DH goes to VTOS READY at once; JP 4409H displays the error message of the code in Register A (bit 6: the text alone; bit 7: return to the caller); JP 4030H aborts. A load error of the member makes the loader enter the member's transfer address with the NZ FLAG and the error code, a case no member tests.

While a member runs, 4E00H-51FFH holds the system overlay last loaded there: SYS1/SYS when the member starts, so members use SYS1/SYS's routines directly (LIB reads its command table); a member's own request for another overlay (an open through 4424H loads SYS2/SYS, a close through 4428H SYS3/SYS) replaces it, and RENAME and ATTRIB then call SYS2/SYS's routines directly.

The file starts with a record of type 05H (the name SYS6), a record of type 1FH holding the copyright notice of Randolph Cook (1980), and 37 member headers of type 08H, one per member code: the code, the transfer address, the record (2 bytes) and the byte of the file where the member's first load block starts. A record of type 0AH ends the headers. Each member then starts with a record of type 04H (end of member) and is made of load blocks of type 01H; member 29 also carries a record of type 07H with the patch name SYS6C2 and the four load blocks of the patch. A record of type 04H and the transfer record (02H, 5200H) end the file. The 29 members hold 14326 loaded bytes in all; every one of them is on a row of this page. Memory a member uses that is not in the file (gaps between its load blocks, control blocks, buffers and work areas above its last byte) is shown as DEFS rows.

Several patches given in the manuals as zaps are already in the bytes, with no patch record: SYS6B (PURGE), SYS6D (DUMP and DIR), SYS6E (DIR), the PROT zaps, the XFER zap and the CHAIN zap of the distributor's manual. Each member's notes below say where.

The 37 member headers in the order of the file. Codes with the same member share its load blocks and enter at different addresses.

The Members and Their Load Blocks

Member 1: AUTO (5200H)

AUTO (member 1, code 11H) stores a command line on the diskette in drive 0 for the boot to execute. It reads the granule allocation table (directory cylinder sector 0, directory data mark) of drive 0 into 4200H, copies 32 bytes from the command line after the word AUTO over the table's AUTO field +E0H-+FFH (42E0H-42FFH), writes the table back with the FAH data mark and reads it back as a check. The text is not parsed at all: AUTO alone stores the 0DH that ends the typed line (no AUTO command), AUTO *line stores the asterisk, which SYS0/SYS's reset takes as the non breakable form. SYS0/SYS's reset copies the field to 4318H and executes it at every boot.

Points to note:

• The 32 bytes are copied whatever their content (520FH): the bytes after the 0DH that ends the typed line (the rest of SYS1/SYS's buffer 4318H-4357H and, for a long line, up to 20H bytes past it) are written to the diskette too; SYS0/SYS's reset executes only up to the 0DH, so this is harmless. A line longer than 31 characters is cut to 32 bytes without a 0DH.
• The drive is always 0 (5200H, 5211H): there is no drive parameter; the manual's syntax "AUTO [*] <command line>" agrees.
• AUTO alone stores 0DH first (an empty line): this is how the AUTO command is removed; the manual does not say so.
• The asterisk is not interpreted by this member: it is stored and SYS0/SYS's reset (4FA8H-4FD3H) tests +E0H for 2AH at every boot.

Member 2: DATE, TIME (5200H)

Member 2 holds DATE (code 15H, entry 5200H) and TIME (code 16H, entry 522DH). DATE mm/dd/yy reads three numbers of exactly two decimal digits separated by slashes, stores them as binary in the clock's date bytes 4044H (year), 4045H (day), 4046H (month) and packs them into 4306H (month OR 50H) and 4307H (day shifted left 3 OR year less 80), the bytes SYS0/SYS's reset decodes after a reset. TIME hh:mm:ss reads three two digit numbers separated by colons into 4043H (hours), 4042H (minutes), 4041H (seconds). Neither checks any range; text after the third number is ignored; any other form shows BAD FORMAT and aborts.

Points to note:

• No range check at all: TIME 99:99:99 and DATE 13/45/99 are taken. A month above 12 makes the next reset show no date (4306H XOR 50H not 1-12); a day of 32 or more rotates its high bits into the year bits of 4307H (RLCA, 521CH-521EH); a year below 80 or above 87 is not refused and its year less 80 is ORed into the day bits with no mask (5217H-521FH), so the year after a reset is wrong (only bits 2-0 count).
• Each number must be exactly two digits (526FH): DATE 1/2/81 or TIME 8:00:00 give BAD FORMAT; the manual's syntax "DATE mm/dd/yy" and "TIME hh:mm:ss" agrees.
• DATE or TIME with no text gives BAD FORMAT: neither command displays the current date or time.
• Text after the third number is not read (5268H): TIME 08:00:00 (JUST A WILD ASSUMPTION), the manual's own example, works because of this.
• TIME does not touch 4306H-4307H; the time is not kept across a reset by this member.

Member 3: ALLOC (5200H)

ALLOC (member 3, code 13H) gives a file disk space that its close never gives back. Syntax as the code reads it: ALLOC filespec (SIZE=n) or (S=n), n in K. The file is opened or created (4420H, 256 byte records, buffer 52D4H); when n is not 0 the member positions to sector 4 x n less 1, writes a sector of E5H bytes there (SYS0/SYS's write asks SYS8/SYS for space when no extent holds that sector), puts the ending record number of the open back into the control block and writes it to the directory record (444EH), so the file's record count stays as it was. In every case it then sets bit 7 of the directory record's +01H (5258H-5260H), which SYS3/SYS's close tests to keep all the granules. The file is not closed.

Points to note:

• The E5H sector is written at sector 4 x n less 1 whatever the file holds: when the file already has that many sectors, one sector of its data is overwritten with E5H bytes. The manual says "The content of a file (if any) will not be altered in any way by this command."
• The size is multiplied by 4 in 16 bits (5228H-522EH): n of 16384 or more loses its top bits. SIZE written without a value is FFFFH (SYS1/SYS's reader): sector FFFBH.
• ALLOC with no size (or SIZE=0) still sets bit 7 of the directory record (5253H): the manual says the file "will simply be created", but the bit that keeps space is set as well.
• The results of 4442H (1CH/1DH past the end, expected), 443FH and 444EH are not tested; a failed write of the ending record number goes unreported.
• The file is opened or created but never closed (the control block is the member's own); the ending record number goes to the directory through 444EH instead.
• An error of the directory read or write at 525BH/5263H leaves the word pushed at 5253H on the stack; the abort exit resets the stack, so it does no harm.
• When the write fails (for example a protected file, error 25H) bit 7 is still set and written before the error is shown (5253H-5265H).

Member 4: KILL (5200H)

KILL (member 4, code 18H) removes a file or a device. Syntax: KILL filespec, or KILL followed by an asterisk and a device name. The member reads the specification into its control block at 5239H (441CH), opens it (4424H, SYS2/SYS) and calls 442CH, request 9CH, carried out by SYS10/SYS's 4E05H: for a file (access level below 2, else error 25H) it gives back the granules, clears the in use bit 4 of the directory record and its hash index byte, then clears the 32 byte control block; for a device it refuses the system devices below 43D8H (error 28H) and a device that is not NIL (27H) and clears the 8 byte device control block. The member itself does nothing else.

Points to note:

• The open at 5209H is given Register Pair HL = the command line after the specification as the file's buffer and Register B = whatever 441CH left as the record length; since nothing is read or written this is harmless.
• No question is asked before the file is removed and nothing is displayed on success.
• The description of request 9CH comes from SYS10/SYS's bytes (4E05H-4E6CH, 4E6DH-4EC8H), whose page is not yet verified; the member's rows say only what was traced there.

Member 5: LIB (5200H)

LIB (member 5, code 19H) displays the names of the commands in SYS1/SYS's command table, which is still in memory at 4E00H when the member runs. It starts at the table's second entry 4EADH and shows each 6 character name (spaces included) after 2 spaces and with 8 spaces after it (space compression codes C2H and C8H through ROM 0033H), four names to a line, each line ended by 0DH, until the entry whose first byte is 00H (4FCDH). The 36 names ALLOC to XFER (BOOT among them) are shown in table order, which is alphabetical: 9 lines. Any text after LIB is ignored; the member takes no parameters and ends at 402DH.

Points to note:

• The first table entry (4EA5H, the hidden command word O! that runs member 1DH) is skipped by starting at 4EADH, so LIB never shows it.
• LIB lists BOOT, which is not a library member (its word is the address 4EA9H, a HALT in SYS1/SYS), and does not list member 1CH, which has no table entry. The manual says only "Display the primary VTOS 4.0 command library."
• LIB reads the table straight out of the SYS1/SYS overlay at 4E00H: every road to a library member (402DH, 4405H) goes through SYS1/SYS's command interpreter, which is the overlay there when the member is called, and LIB issues no request of its own.
• Each line is exactly 64 characters (4 x (2 + 6 + 8)), the full width of the Model I display, followed by 0DH.

Member 6: DEBUG, CLOCK, TRACE, VERIFY (5200H)

Member 6 holds four switches. DEBUG (code 14H, 5200H) [(ON|OFF|EXT)]: on sets 430FH bit 7 (programs start in the monitor) and makes the BREAK vector JP 400FH (4316H := 400FH, 4315H := C3H, under DI); EXT or E first has request 8BH load and run SYS9/SYS, the extended monitor; off clears 430FH bit 7 and stores C9H at 4315H. CLOCK (17H, 5241H) installs SYS0/SYS's clock display task 4DABH in task slot 6 or empties the slot; TRACE (1AH, 5257H) does the same with the trace task 4DDBH in slot 11. VERIFY (1BH, 5267H) sets the address of the JP at 4439H (write a record) to 48DBH (write and read back each sector) or back to 48C0H. Each reads an optional parameter list with SYS1/SYS's 4476H: OFF, NO or N written alone mean off; no list, ON, YES, Y (or anything else accepted) mean on.

Points to note:

• ON, YES and Y have no effect: their value goes to 5297H, which nothing reads. A function is off only when OFF, NO or N is given with a value whose two bytes ORed give FFH (5292H-5294H): the word alone (FFFFH). OFF=NO or OFF=0 (0000H) turns the function on.
• DEBUG tests only the low byte of EXT's value (5210H): EXT=256 does not load the extended monitor. EXT=Y or EXT alone does.
• The extended monitor (request 8BH, SYS9/SYS) is loaded from inside the DI at 520DH; SYS0/SYS's disk driver enables interrupts after each sector (46DAH), so the DI does not last through the load. The vector is still safe: 4316H-4317H are written while 4315H holds C9H (the request handler's).
• 5226H LD A,CDH, 5233H LD A,3EH and 5235H LD HL,EFA3H load values nothing reads before JP 402DH (402DH loads Register A itself). No branch enters these instructions.
• CLOCK (OFF) and TRACE (OFF) leave the last time or program counter on the top line of the screen; nothing erases it.
• VERIFY changes only 4439H: programs that call 443CH always read back, and SYS0/SYS's own directory writes read back regardless. The manual: "The VERIFY command forces ALL disk writes to be performed with read-after-write verification regardless of the actual system call."; the bytes change only the record write entry 4439H.
• VERIFY ends with RET (5275H), the other three with JP 402DH; both reach VTOS READY.
• DEBUG's table runs on into the table of the other three (no end byte at 52C2H), so DEBUG accepts EXT, E and the six flag words, the others only the six.

Member 7: O! (5200H)

Member 7 (code 1DH) is run by the hidden first entry of SYS1/SYS's command table (4EA5H), which only the command word O! matches. It displays a copyright notice stored encoded at 520EH-524BH: a key byte 90H, then each character plus 90H, ended by 00H. Decoded, the notice is "COPYRIGHT (C) 1980 BY RANDOLPH V. COOK, ALL RIGHTS RESERVED" and a carriage return, shown through ROM 0033H. It takes no parameters and returns to VTOS READY. The command is not in the manuals and LIB does not list it.

Points to note:

• The notice is stored encoded (each byte the character plus 90H), so it does not show as text in the file; the copyright notice in the 1FH record at the start of SYS6/SYS is a separate text.
• The word O! is the only way to reach the member: no manual names it (no "O!" in any of the four manual texts), and LIB starts its list after the table's first entry.

Member 8: MEMORY (5200H)

MEMORY (member 8, code 1EH) shows or lowers the top of memory, the word at 4049H-404AH. Syntax as the code reads it: MEMORY, or MEMORY (HIGH=addr) or (H=addr), the value decimal or X'hex'. Without a value (or with HIGH=0) it writes the word as four hex digits into its message and displays HIGH = X'nnnn' (through 447BH, so also to the job log). With a value it requires 5200H < value <= the present top of memory and stores it at 4049H; otherwise RANGE ERROR. A bad parameter list gives PARAMETER ERROR.

Points to note:

• The new value may equal the present top of memory (521BH-521DH: only a value above it is refused); the manual says "The new HIGH$, if specified, must be lower than the one already in use by the system." Its own example MEMORY (HIGH=X'FFFF') works only because of this, on a machine whose top of memory is FFFFH.
• The lowest value accepted is 5201H (520FH-5215H).
• HIGH=0 (or HIGH=X'0000') displays the top of memory like MEMORY alone; HIGH written alone is FFFFH and is accepted only when the top of memory is FFFFH (no change).
• There is no way to raise the top of memory with this command; the manual agrees.

Member 9: SYSGEN (requested by SYSTEM) (5200H)

Member 9 has no command word: SYSTEM (member 13) requests it (LD B,1CH / LD A,88H / RST 28H at its 5622H-5626H) when its SYSGEN parameter word (the operand at 561AH of LD HL,0001H at 5619H, filled by SYS1/SYS's 510FH) has two bytes that ORed together do not give 01H (0001H, the file's value, means not given), and passes that word in Register Pair HL. With HL = 0000H (SYSGEN=OFF or SYSGEN=N) it opens CONFIG/SYS.CCC:0, kills it (442CH, SYS10/SYS) and stores C9H in byte +01H of the system information sector (drive 0, cylinder 0, sector 2), so the boot loads nothing; it shows USER CONFIGURATION DELETED, or NO USER CONFIGURATION FOUND when the open fails. With any other HL (SYSGEN, SYSGEN=Y/ON: FFFFH; also any number or text) it opens or creates CONFIG/SYS.CCC:0 on drive 0 and writes a load module: header 05H "CONFIG", a block that shows CONFIGURING (between three asterisks and a space on each side) at 3F93H, a block that puts C9H (RET) at 4012H, the 13 areas of the table at 542FH (4047H-404AH, 404BH-405CH, 4015H-402CH, 4300H-4302H, 430FH, 4310H-4311H, 4315H-4317H, 43B8H-43FFH, 4BC0H-4BC2H, 439CH-439EH, 4700H-474FH, 4439H-443BH, 4500H-4517H), all memory from (4049H)+1 up to the physical end of memory, then 4012H's current 3 bytes, 19 spaces at 3F93H and a transfer record to 0000H. It then stores 00H in byte +01H of the system information sector and shows USER CONFIGURATION BUILT. While a CHAIN file runs (430FH bit 5) it shows SYSGEN INVALID DURING PROGRAM CHAINING and aborts.

Points to note:

• Who requests code 1CH: only SYSTEM (member 13, its 5619H-5626H): LD HL,0001H (operand 561AH = the SYSGEN word of SYSTEM's parameter table entry "SYSGEN" at its 5701H) / LD A,H / OR L / DEC A / JP Z,402DH / LD B,1CH / LD A,88H / RST 28H. No other file on the diskette has 06 1C before 3E 88 / EF.
• SYSTEM does not compare the SYSGEN word with 0001H (the value it holds when SYSGEN is not given): it ORs the two bytes and skips member 9 when the result is 01H (561CH-561FH), so SYSGEN=1, SYSGEN=256 (0100H) and SYSGEN=257 (0101H) all do nothing; any other value, any number or a text (SYSGEN="X": the text's address) builds CONFIG/SYS like SYSGEN. Only 0000H (SYSGEN=OFF, =N, =NO, or SYSGEN=0) deletes it.
• The CONFIG.SYS file on the diskette (396 bytes) has exactly this layout: 05H 06H CONFIG, 01H 21 3F93H CONFIGURING text, 01H 3 4012H C9H, the 13 table areas in table order, 01H 32 FFE2H (30 bytes FFE2H-FFFFH: 4049H was FFE1H), 01H 5 4012H C3 18 45, 01H 21 3F93H spaces, 02H 02H 00 00.
• The control block text CONFIG/SYS.CCC:0 at 5392H-53A1H has no 03H or 0DH after it; the next byte, 53A2H, is not loaded by the member (it is whatever the memory held), and SYS2/SYS's split (its 5050H) looks at the byte after the drive digit for "!". If 53A2H held 21H the file would be opened with 08H stored at SYS2/SYS's 4FE2H, bit 3 of the control block's +01H (the ending record number written to the directory at each write that moves it, SYS0/SYS 49DFH). SYS0/SYS's own copy at 4338H ends with 03H.
• The password of CONFIG/SYS is CCC (both passwords of the created record are the code of CCC).
• SYSGEN=OFF reports NO USER CONFIGURATION FOUND for any failure of the open (also a read error), and then leaves the configuration flag as it is: a flag of 00H with no CONFIG/SYS stays 00H.
• SYSGEN=OFF opens CONFIG/SYS with Register Pair HL = 0000H (the SYSGEN word) as the buffer and Register B = 1CH (the member code) as record length; the kill follows at once and reads or writes no record, so this is harmless.
• A byte write error (53B6H) or a close error goes to 4409H/4030H with CONFIG/SYS left open and partly written, and the configuration flag unchanged; with the flag already 00H the next boot loads the partial file.
• The memory saved above the top of memory is its contents at the time of the SYSGEN (drivers, filters, SYS9/SYS's copy, but also any data there), up to the physical end found by the complement test from FFFFH down in 1K steps.
• The transfer record gives 0000H; SYS0/SYS loads CONFIG/SYS with 4430H, which does not run it.
• The 1 byte block C9H at 4012H makes an interrupt during the load a bare RET (the Z80 then leaves interrupts off until the next EI) so the vectors 404DH-405CH and task slots 4500H-4517H can be replaced; the final block restores 4012H from its value at SYSGEN time.
• The manual (SYSTEM, SYSGEN=<flag>) says the configuration is written to the SYSTEM disk in drive 0 and that SYSGEN=OFF eliminates it: the bytes agree (drive 0 in the file specification and in Register C = 00H of the sector read/write). The manual does not mention the refusal during CHAIN.

Member 10: DIR (5200H)

DIR lists the files of one drive or of every drive 0-7 that is ready. The code parses DIR [name][/ext][:d] [(A,I,P,S)]: up to 8 characters of a name and, after a slash, up to 3 of an extension become an 11 byte pattern at 56F6H in which every untyped place is a space that matches anything (so the listing shows the files whose name and extension start with what was typed); a colon and one character name the drive; the list in parentheses is read by SYS1/SYS's parameter reader (4476H) against the table at 562FH: A adds an allocation line to each file, I includes invisible files, S includes system files, P prints the whole listing as well as displaying it. For each drive it tests the drive with 44B8H (SYS2/SYS), shows a heading with the drive number, the diskette name and date from the allocation table (sector 0 of the directory cylinder, read into 4200H), reads the hash index (sector 1) into 5800H and walks it sector by sector, reading each directory sector into 4200H. Each file takes a 20 column field (name/ext, then S, I, P and a plus sign for system, invisible, password protected and updated), three to a line; with A the field is followed by the access level's name, EOF= the number of records, SIZ= the space in K to a tenth and the date DD-MMM-YY. SHIFT and @ hold the listing at the end of a line and BREAK aborts it (not while a DO file runs).

Points to note:

• EOF= is wrong for many files with a record length of 129-255: the division at 55DDH shifts the remainder with RLA (55F1H) and compares it with CP C, so a remainder of 128 or more loses its bit 7. Example: a file of 4 full sectors with record length 200 ((4 x 256 + 199) / 200 = 6) is shown with EOF=0. The manual's patch SYS6D ("Fixes a bug in the DIR command which will sometimes cause the EOF record number to be computed incorrectly for files with LRL < 256", zaps D08,2B and D0A,68) is in these bytes (5200H-5212H, 5435H-5442H); it does not touch the division.
• The end of the command depends on the drives: with a named drive, or when drive 7 was listed, DIR jumps to 402DH (VTOS READY); only when no drive was named and drive 7 is not ready does it RET to 4C4BH. A program that runs "DIR :0" through 4405H therefore never gets control back.
• 5314H (the sector in 4200H) is not reset when the next drive starts, although 44B8H and 528AH have put the allocation table into 4200H. It does no harm on diskettes made by FORMAT/CMD only because each drive's first record (entry 00H, BOOT/SYS) is in sector code 0 while the previous drive's last read was sector code 1 or more (DIR/SYS's record, entry 01H); a drive whose used records are all in sector code 0 would make the next drive read its first records out of the allocation table.
• 553CH (the sector in 5900H) starts at 00H, so with A the first extension record that lies in sector code 0 (directory sector 2) and is not in the sector held in 4200H is taken from 5900H before anything was read there; it is also not reset between drives, so an extension record of a later drive in the same sector code as the last one read is taken from the previous drive's sector. The manual's SYS6E patch ("Prevents false Directory read error during DIR (A)", zaps D0B,64=00 00, D0B,71, D0B,77) is in the bytes (552DH-552EH NOP NOP, the offsets at 553AH and 5540H).
• The drive character after the colon is not checked (5256H): any character is taken, less 30H; the drive code table routines use its bits 2-0, so ":8" lists drive 0 under the heading DRIVE 8, and a character below 30H gives a number of 80H or more (2FH gives FFH, which 52E7H takes as no drive named).
• Characters after the eighth of a name (or the third of an extension) end the parsing: Register A holds the extra character, 525CH backs onto it and SYS1/SYS's 510FH, finding no opening parenthesis there, returns Z without reading the list, so the options typed after a too long name are dropped without an error. The same happens after a period (a password), which is also not used.
• A system file is listed with S even when it is invisible too (5339H skips the I test).
• The P flag is tested two ways: 556CH prints texts when the low byte of its word is not 00H, 5577H prints characters only when it is FFH; P=n with another value prints the headings and allocation lines but not the names.
• An access level 3 file shows four 7EH characters as its level name (5650H table); a file with an update password but level 0 and no access password shows no P and ALL, as does any file without an update password whatever its level (53B7H-53D0H).
• The allocation table read error at 528DH goes to 4409H with the read's own error code in Register A, not GAT READ ERROR (14H); the hash index and directory errors are given their own codes (16H, 11H).
• A record with a date byte (+02H) that is not 00H but a month (+01H bits 3-0) of 0 or 13-15 takes its month name from past the table (54D8H-54DFH): 56F6H and up (the pattern) for 13-15, 57D0H for 0. The year is always shown as 8 and bits 2-0 (80-87).
• The manual gives DIR [name][/ext][:d] ([A][I][P][S]); the code matches it. The parameter values are any SYS1/SYS value: A=N or A=0 turns A off again.

Member 11: FREE (5200H)

FREE (member 11, code 22H) shows one line for each of the drives 0-7 that is there and ready: "DRIVE d - name date FILES=free/total, SPACE=free/total K". The only parameter is P (table 5389H, read with SYS1/SYS 510FH through 4476H): P alone (FFFFH) also prints every line on the printer through 446AH; any P whose low byte is not 00H sends a space and a carriage return to the printer first (ROM 003BH). For each drive it tests the drive with 44B8H (SYS2/SYS 5147H), reads the granule allocation table into 4200H (name D0H-D7H, date D8H-DFH, free granules counted as 0 bits of the first 35 + (CCH) bytes), and reads the hash index into 4200H to count the free directory records. The geometry comes from the drive code table: sectors of a granule and granules of a cylinder (+08H), two sides (+04H bit 5, doubles the sectors of a cylinder), last cylinder (+06H). Records = (sectors of a cylinder - 2) x 8, 256 when there are 30 record sectors or more; space in K = (sectors + 2) / 4.

Points to note:

• The manual gives FREE with no parameters ("This command is used to obtain a summary of the amount of unallocated (free) disk space and empty directory entries available on all mounted disks."); the code takes the parameter P: P alone prints each line too (the low byte FFH is tested, 5314H).
• P=n with a low byte other than 00H and FFH sends a space and a carriage return to the printer (5212H-521FH) but prints no drive line; P=n with low byte FFH (e.g. P=255) prints like P alone; P=256 does nothing at all.
• The free granules are all the 0 bits of the first 35 + (42CCH) allocation bytes (52A6H-52B7H): bits of granules a cylinder does not have count as free unless the table holds them as 1 (this diskette's table has FCH/FFH, so the count is right there).
• The 16 hash index bytes of the system files' records (entry codes 00H-07H, 20H-27H) are always counted as taken (52EAH), whatever the directory size; the free count is the records ordinary files can take.
• 30 or 31 record sectors (32 or 33 sectors a cylinder) give 256 records (5260H-5262H) instead of 240 or 248, and the free count is too high by the same amount. With FORMAT/CMD's formats (+08H 24H, 45H, 27H, 49H: 10, 18, 16, 30 sectors a cylinder on one side) this happens for 8 inch single density with two sides (32 sectors a cylinder: 256 shown, 240 records); the others give 64, 128, 112, 224 and, two sided, 144, 256, 256 rightly.
• Two sides double the sectors of a cylinder (5252H-5258H) for both the records and the total space.
• The total space counts every cylinder (cylinder 0 and the directory cylinder included); both K values are rounded to the nearest K ((sectors + 2) / 4).
• The drive test 44B8H already reads the allocation table into 4200H; FREE reads it again (5376H). A drive whose test fails (no table, not ready, or its allocation table cannot be read by 44B8H) is passed over silently; only a failure of FREE's own reads ends the command with an error, and then the drives after it are not shown.
• The entry flags are not tested: a load error (NZ on entry) is not noticed.

Member 12: CHAIN (5200H)

CHAIN compiles a file of commands (default extension JCL) into SYSTEM/JCL and then hands that file to SYS7/SYS (request 99H), which feeds its lines to the system as command lines; an exclamation mark at the start of a command line runs CHAIN too (SYS1/SYS 4E65H-4E6BH). Syntax as the code parses it: CHAIN [$ | = | an asterisk] filespec [(name[=value],...)] [;], where the option character may be followed by one space. In the compile each line is read into 5919H; a line starting with the capital letters PAUSE becomes //PAUSE, every #NAME# is replaced by the symbol's value (## gives one pound sign), and lines starting with two slashes are checked for the compile keywords IF, ELSE, END (expressions of symbols joined by period = AND, comma = OR, minus = NOT), SET, RESET, ASSIGN, INCLUDE and QUIT; other lines, and //. compile comments which are displayed only, go to SYSTEM/JCL unless a false //IF block drops them. The dollar sign compiles only, the equals sign opens the named file directly as the file of commands with no compile and no parameters, the asterisk is meant to run SYSTEM/JCL again but only works when the control block 4358H still holds its specification as text. Parameters are symbols with an optional value of up to 32 characters, stored in a table at 5C00H (41 bytes an entry); a semicolon after the list asks for another line after a question mark.

Points to note:

• CHAIN with an asterisk is broken: 52D7H-52DDH copy SYSTEM/JCL with LDIR to Register Pair DE, which is never loaded and holds 8091H (SYS1/SYS's table word for CHAIN, 4E67H; the request handler keeps DE). 32 bytes go to 8091H-80B0H (user memory on a machine with more than 16K) and the control block 4358H is opened as it stands. That works only after CHAIN with a dollar sign or a //QUIT (the close puts SYSTEM/JCL:d back as text); after an execution phase SYS7/SYS has stored 00H at 4358H (its 4EA8H-4EA9H) and the open fails with ILLEGAL FILE NAME. Manual, for the asterisk option: "means to rerun the last CHAIN".
• The NOT operator does not work: 54DFH calls 54E9H with Register Pair HL still at the minus sign, so the name read is empty, 54E9H returns NZ and the factor is always true (54E7H); the symbol after the minus sign and the rest of the expression are not read. //IF -X is true whatever X is. 54E4H-54E6H (the false result) are never reached.
• A false factor followed by a period ends the term with Register A = the period (54D3H), and 5481H accepts only a comma or 0DH after a false term: //IF A.B with A undefined aborts with INVALID JCL FORMAT, PROCESSING ABORTED! instead of being false. With A defined the expression is evaluated correctly.
• A true term ends the expression at once (5484H): whatever follows it on the line, errors included, is not read.
• The compile comment (a line starting //.) is displayed with 4467H and not written to the job log (5406H-5426H). Manual: "//. compile comment -- placed in JOBLOG" (the typed manual spells the job log JODLOG).
• An 8 character symbol name is also compared at a ninth position (5660H with B = 08H): the byte 56FAH, the length of the last value read (not in the file, so undefined before the first value), against the entry's value length. Such a name is found only when these are equal or the entry's length is 20H, so defined 8 character symbols are often not found, and MULTIPLY DEFINED PARAMETER! may be missed.
• A value is only its first field of letters and digits (at most 32) plus the values of its substitutions: after any other character (a period, a slash, a colon) 55C0H is called again with Register B = 00H and stores nothing, so the letters and digits of later fields and the characters between fields are dropped: GAME=MY.FILE gives MY, and MY.#X# gives MY followed by the value of X (55A4H-55BAH still carry out a substitution after the period). Small letters are made capital.
• A pound sign error in a parameter value on the command line (CHAIN X (A=#B) : 536FH from 55BAH, the name not ended by a pound sign) goes to 53A9H, which displays the arrow and the line buffer 5919H before any line of the JCL file has been read into it: the bytes shown are whatever memory holds there up to a 0DH or 03H, then INVALID JCL FORMAT, PROCESSING ABORTED!. SYSTEM/JCL, opened or created at 524AH, is left open.
• After a substitution at the end of a parameter value Register Pair HL is left at the next character (55BDH), not past it: a closing parenthesis right after the closing pound sign (CHAIN X (A=#B#)) is read again by 5251H and gives PARAMETER ERROR. A comma or space there is harmless.
• The value length is tested only after it has been stored (5595H): substitutions can write past 571AH over the texts at 571BH before the error, which is then shown as the DOS message of the code (length OR 40H) through 4409H, not as a CHAIN message.
• CHAIN = with no file name: 52CCH sends the character that stopped 441CH (for example 0DH) to 56A9H as an error code, so the message is that of error 0DH (DATA RECORD NOT FOUND DURING WRITE) rather than FILE SPEC REQUIRED!. The same CHAIN with no option gives FILE SPEC REQUIRED! (521FH).
• With the equals sign the parameters are not read at all and the file goes to SYS7/SYS untouched (no substitutions, no //IF, no //INCLUDE, no PAUSE conversion). Manual: "= means to skip the compile phase (execute directly). Be careful! If you skip the compile phase, some JCL features will be ignored".
• The JCL file reader (53E8H) takes a byte 00H as the end of the file, drops a last line that has no carriage return, and has no length limit for the 64 byte line buffer 5919H.
• No depth tests: //INCLUDE nesting deeper than ten levels overwrites the condition stack pointer 58F4H; more than 31 open //IF blocks run over 5916H and the line buffer; the symbol table grows from 5C00H without a limit. A block still open at the end of the file is not reported. Included files are never closed (they are only read).
• A failed //INCLUDE open (5562H) reports INVALID JCL FORMAT, PROCESSING ABORTED!, not the DOS error. A //RESET symbol keeps its table entry (only the first character of its name becomes a space); a later SET or ASSIGN of the same name adds a new entry.
• PAUSE conversion (5320H-5366H) needs the capital letters PAUSE at the very start of the line and tests nothing after the E: PAUSED becomes //PAUSED. The keywords after two slashes are made capital by 55C0H, so //if works; a space between the slashes and the keyword makes the line an execution phase line. Manual: "Any 'PAUSE' commands found in a JCL file which are not proceeded by slashes ... will automatically be translated to '//PAUSE' during the compile phase".
• //QUIT displays and logs its own line, closes SYSTEM/JCL with the lines written so far and leaves by the normal exit 402DH (not the abort exit). A later CHAIN with an asterisk would run that partial file.
• The message at 573AH holds seven bytes 01H between CANT CREATE SYSTEM and /JCL FILE!. The distributor's manual lists "Fixes an error message in the CHAIN command D14,3B=01 01 01 01 01 01": record 14H byte 3BH of SYS6/SYS is file offset 143BH, which loads at 574CH, so this file carries that patch (it writes six of the seven 01H bytes, 574CH-5751H).
• 5530H JP NZ,53A9H is never taken: 5582H always returns the Z FLAG (or leaves through 56A9H).
• The member never tests the NZ FLAG with which the loader enters a member after a load error.
• The BREAK test and the message MANUAL CHAINING ABORT of the manual are not in this member: the execution phase (SYS7/SYS) handles BREAK; CHAIN itself only takes BREAK at the question mark of a continuation line (5276H, PARAMETER ERROR).

Member 13: SYSTEM (5200H)

SYSTEM (params) reads its parameter list with SYS1/SYS's 510FH (CALL 4476H, table at 5679H, 18 names: FAST, SLOW, BASIC2, BREAK, BLINK, LARGE, SMALL, TYPE, LOWER, JKL, GRAPHI, ALIVE, DRIVE, ENABLE, DISABL, STEP, DELAY, SYSGEN), each value going into the operand of the LD BC/LD HL that tests that option, and then works through them in a fixed order. SLOW/FAST set or clear 430FH bit 3 and output 00H/01H to port FEH; BASIC2 does the ROM's power up copy (06D2H to 4000H, 4036H-405CH cleared) and jumps to the ROM's 0075H; BREAK=N stores C8H (RET Z) at 4C2DH and sets 430FH bit 4, BREAK/BREAK=Y stores 00H and clears it, and both then end the command. BLINK[=n] (with SMALL) installs a blinking cursor task in slot 5, TYPE a type-ahead keyboard driver plus task (slot 10, 256 byte buffer) plus a key decoder without delays hooked at 4BC1H, LOWER a display driver that stores 20H-7FH unchanged, JKL (with GRAPHIC) a screen print task (slot 4) that arms SYS0/SYS's CALL at 4536H, ALIVE a task (slot 3) that toggles the corner character 3C3FH; each copies its code below the top of memory (4049H, lowered). DRIVE=d with DISABLE/ENABLE/STEP=n/DELAY=flag changes that drive's code table (+00H C9H/C3H, +03H bits 1-0, bit 2). SYSGEN[=flag] passes its value in Register Pair HL to member 9 (code 1CH) with LD B,1CH / LD A,88H / RST 28H.

Points to note:

• Address check of the verified map: in this member 521BH/5228H (430FH bit 3) and 525BH/5268H (4C2DH) are right. The others are in other members, which all load at 5200H: SYSGEN's 52BBH (00H to 4201H) and 5349H (C9H) are member 9's; 526AH-5272H (4439H to 48DBH, VERIFY) is member 6's; 53EBH-53F0H and 5380H (4300H hook JP) are member 14's (SPOOL); 5372H-537AH and 538FH-5397H (GAT CEH-DFH compare) are member 28's (XFER). In member 13, 52BBH is LD (HL),D of the BLINK install, 5349H is inside LD (53E6H),HL and 53EBH is RET Z of the type-ahead task.
• BREAK ends the command: BREAK, BREAK=Y and BREAK=N all finish with RET (5261H, 526EH), so BLINK, SMALL, TYPE, LOWER, JKL, GRAPHIC, ALIVE, DRIVE, DISABLE, ENABLE, STEP, DELAY and SYSGEN given in the same list are not done. "SYSTEM (BREAK=N,SYSGEN)" does not SYSGEN. The manual does not say so.
• JKL skips ALIVE: after installing the screen print, 5521H jumps to 55B4H (DRIVE), so ALIVE in the same list is not done.
• LARGE does nothing: its table entry (56A1H) points at 52C5H, in the bytes 52C5H-52CBH the file does not load; nothing reads them. The large cursor (8FH) is simply the default. Manual: "LARGE --- sets up a large blinking cursor."
• SLOW wins over FAST: SLOW is tested first and a given SLOW jumps past the FAST test (520EH). The user manual's typed text has "SI.ON" for SLOW; the bytes have SLOW.
• BASIC2 (not BASIC) is the name, as the Addendum says ("It should read: SYSTEM(BASIC2)"); it copies the ROM's 06D2H table to 4000H, clears 4036H-405CH and jumps to ROM 0075H, leaving VTOS. The options the code takes after BASIC2 (BREAK through SYSGEN) are not done, whatever their place in the list; SLOW or FAST, tested before it, are.
• No double-install checks: every BLINK, TYPE, LOWER, JKL, ALIVE lowers the top of memory again and copies again; BLINK=N and TYPE=N only remove the task (4413H) and leave the memory reserved. TYPE=N also leaves the copied driver in 4016H, 439CH = 21H and the delay-free decoder at 4BC1H, so keys are read without the ROM's debounce delays and with an empty buffer. LOWER and JKL have no OFF form at all (LOWER=N and JKL=N are just not given).
• Writes that change nothing: TYPE's 5377H-5383H store 4018H-401AH into (IX+03H)-(IX+05H) with IX = 4015H, i.e. into themselves; LOWER's 54ADH-54B9H do the same with 4020H-4022H (IX = 401DH). The first store of the cursor task (52D4H, 4022H into +04H) is overwritten at 52E2H before use; LD A,00H at 53B6H is never used.
• Cursor task after a scroll: 52F6H-52F9H subtract 40H from Register C only; when the low byte of the cursor address is below 40H the place tested is three lines lower (no borrow into Register B), so the block can be left on the screen after a scroll at those positions.
• Type-ahead clear key: the task tests key code C0H (53EEH), which is CLEAR with @ (SYS0/SYS 4BD0H-4BD9H ORs 80H into a key typed with CLEAR); with SHIFT the code of @ is 60H, so CLEAR SHIFT @ gives E0H, which is buffered like any key. Manual: "a special 'clear type-ahead' feature will be performed if a <clear><shift>@ is entered." The clear leaves one entry key 00H with flags 40H (Z set). Buffer holds 127 keys (2 bytes each, key + flags); while it is not empty, repeated keys are dropped (53F8H-5407H), as the manual says.
• Command level test (5627H): only TYPE, LOWER, JKL and ALIVE call it; BLINK also lowers the top of memory without the test. It tests only that 402DH starts with C3H (BASIC/CMD writes C3H there at its 66A9H).
• How JKL arms SYS0/SYS's 4536H: the task (copy of 5526H, slot 4, every eighth tick) acts only when 3802H reads exactly 1CH (J, K, L, no other key of row 1) and 4537H-4538H hold 0000H. It then writes 4537H-4538H := the address of the copied print routine (copy of 553EH = the new top of memory + 1 + 1AH, put into its LD HL by 550EH) at 5535H, and 4536H := CCH at 553AH, so C4 00 00 (CALL NZ,0000H) becomes CC lo hi (CALL Z,print). In SYS0/SYS's interrupt routine the Z FLAG at 4536H is always set (AND 04H at 4532H, BREAK up; BREAK down jumps from 4534H to 4554H past it), so the CALL Z is taken in the same interrupt, right after the dispatcher returns through 454CH/452BH to 452FH; with BREAK down, at the first later interrupt with BREAK up. The print routine first writes 4536H := C4H (5540H, CALL NZ again, never taken), keeps 4537H-4538H nonzero during the print so the task does not re-arm, and at the end (556AH-556EH, after DI) writes 4537H-4538H := 0000H and RETurns to 4539H (POP AF, POP HL, EI, RET). After a print 4536H-4538H are C4 00 00 again, as in the file.
• Screen print runs inside SYS0/SYS's interrupt routine (CALL Z at 4536H with interrupts off; only AF and HL saved there; 5543H-5544H save BC and DE). With the PR device served by the ROM's driver 058DH, a printer that is not ready holds the CPU in the ROM's wait loop 05B5H-05B8H inside the interrupt routine, with no BREAK test there; the BREAK test at 5548H is made only between characters. The manual says foreground tasks "will continue processing" during the print; the bytes show the print is called from the interrupt routine, so no task can run until it returns unless a driver on the printer path turns interrupts on (556DH disables them again before returning). This also corrects the SYS0/SYS page's note at 4536H ("nothing on the diskette changes it"): SYSTEM (JKL) changes 4536H-4538H.
• ENABLE only stores C3H at +00H of the drive code table; for drives 4-7 (C9H + 9 x 00H in SYS0/SYS's tables) this makes JP 0000H, so ENABLE on such a drive makes a drive access jump to 0000H. DISABLE is tested before ENABLE; with both, only DISABLE is done.
• DRIVE=N gives 0000H, so it picks drive 0; DRIVE alone (FFFFH) is the same as no DRIVE. STEP and DELAY without DRIVE are ignored silently. STEP=n with n of 256 or more uses the low byte. STEP and DELAY refuse a rigid disk (+03H bit 3) with PARAMETER ERROR.
• DELAY sets the bit 2 = 1 (shorter wait) for DELAY=N and clears it for any other given value, matching the manual (default ON = 1 second, OFF = .5 second).
• LOWER driver is the ROM's display driver 0458H-0470H without 0471H-047CH (the folding of 40H-5FH to 00H-1FH and 60H-7FH to 20H-3FH): characters 20H-7FH are stored unchanged.
• The delay-free key decoder (5426H-547EH) is the ROM's 03FEH-0457H without the 0500H debounce delay and re-read (011CH-0126H) and without the 0DACH delay (044CH-044FH). Its RET at 547EH is not reached through RST 28H (requests below 80H return straight to the decoder's caller).
• SYSGEN passes Register Pair HL = its value to member 9 (code 1CH): member 9 has no command word and is requested only from here (5622H-5626H). SYSGEN=N, SYSGEN=OFF and any number reach member 9 too; only "not given" (0001H, also SYSGEN=1) ends at 402DH.
• The user manual lists LARGE, LOWER, GRAPHIC, DRIVE, DISABLE, ENABLE, STEP, DELAY, SYSGEN; ALIVE is only in the Addendum ("A NEW COMMAND NOT IN BOOK!!!! - - - SYSTEM (ALIVE)"). The VTOS 4.0.2 manual (Quality Software Distributors) says "You have to re-boot to get rid of it" (the Addendum's text stops at "More on this later..."); this agrees with the bytes: ALIVE has no OFF form.
• STEP: the user manual gives "0=3/6, 1=6/12, 2=10/20, 3=20/40 msecs for 5"/8" drives"; the verified map (SYS6/SYS's own drive display table) gives 6, 12, 20, 40 ms for 5 inch drives. The code only stores n into bits 1-0 of the drive code table's +03H.
• BREAK, BLINK, TYPE and DELAY test the two bytes ORed: a number whose bytes OR to 01H (for example BREAK=1, BLINK=1, TYPE=1, DELAY=1) is the same as not given, and BREAK with a number other than one ORing to 00H or FFH is also ignored.

Member 14: SPOOL (5200H)

SPOOL followed by an asterisk and a device name dd, an optional file specification and an optional list (MEM=m,DISK=d) puts an output queue in front of the device dd: the device's driver word (+01H-+02H of its device control block, after following any route) is pointed at a resident copy of 54D3H-5629H that the command moves to the top of memory, and the old driver is called from there. Characters go into MEM x 4 memory pages of 256 bytes (MEM 1 to 32, default 1; M is accepted for MEM) just below the old top of memory; a task in slot 9, run 40 times a second, prints up to two characters each time through the old driver while the device is ready. When all memory pages are full, a full page is written to a record of the spool file, DISK K long (default 4, 0 for no file, below 4096; D is accepted for DISK), and read back into a page when its turn comes; that disk work is done only in the foreground (from the driver entry and from the keyboard hook 4300H, never in the task). The file is the filespec given, or dd/SPL (from the text "XX/SPL" at 54ABH), or dd/SPL:n when only ":n" is given; it gets the extension SPL when it has none, is opened or created with 256 byte records, written out to DISK x 4 records and its directory record gets bit 7 of +01H (no space given back on a close). The top of memory (4049H) is lowered below the resident code, its 2CH byte queue block (the file's control block and six pointers) and the page table (4 bytes an entry).

Points to note:

• The default MEM=1 gives one memory page, which is both the head (being printed) and the tail (being filled); the entry before the tail (queue block +2AH, 5654H) is still 0000H at the first full page, so the first disk entry is linked from 0000H-0001H (5559H-5561H, a write into the ROM that changes nothing) and no entry of the queue links to it: 55BCH never reads it back and its record stays in use. After that the single page is freed and taken again (55E4H-55E7H, 551DH-5539H), and a later disk entry can be linked after the head, so that 55BCH reads a record into the page that is also the write page (5609H-560CH). With MEM=1 the disk overflow cannot work at all; with MEM of 2 or more it still loses pages (next finding).
• The entry before the tail (+2AH) is not updated when 55BCH takes a disk entry out of the queue (5612H-5622H): the head then links straight to that entry's successor, the tail. When the removed disk entry was the one before the tail (the normal case: every disk entry goes in just before the tail, 5555H-5565H), +2AH keeps pointing at the freed entry. If the next full page finds no free memory page (before a memory page is taken, which sets +2AH again at 552CH-552FH), the disk entry it takes is linked from the stale pointer (5559H-5561H) and never from the queue: when it is that same freed entry its link becomes itself (5555H then 555FH); when it is another one, the freed entry gets a link to it and is marked in use outside the queue. Either way the page written to the record (556EH) is never printed and the records stay in use. Example with MEM=2: head E1, tail E2, full pages go to D1 then D2 (E1, D1, D2, E2); after D1 and D2 are read back, +2AH is still D2 (free); the next overflow takes D1, links D2 to D1 and D1 to E2, and the queue E1, E2 skips both.
• On the path that takes a new memory page (5519H-553CH) interrupts stay disabled after the DI at 54E7H: the driver returns to the caller with interrupts off.
• The device's old driver is always called with Index Register IX = 4025H, the PR device control block (557EH, 55A4H), and the status request (Register C = 00H) of the ROM's printer driver: right for the device PR, wrong for any other device spooled. The new driver answers a status request (character 00H) with the Z FLAG at once (54D5H): the spooled device always looks ready.
• The type of the device control block is not checked (5266H-527BH): any device found by name, an input device or a NIL one included, gets its driver word replaced.
• The task slot is always 9 (53E0H): a second SPOOL replaces the first one's task, whose pages are then printed only from its driver entry (54EDH, 550FH); the keyboard hooks chain (55B9H-55BBH).
• Errors of the resident disk I/O (554AH, 5571H, 5601H, 560FH) go to 4409H without bit 7, so the message is followed by the abort exit 4030H, from inside a driver call or the keyboard driver: the running program is ended.
• The record number of a disk entry is masked with AND 0FH (5541H, 55F8H): DISK values of 1025 and up give record numbers of 1000H and up (DISK=1024 ends at record 0FFFH), which are folded onto lower records. DISK below 4096 is the only test (5297H-529AH), and nothing checks that the table and pages fit in memory.
• The spool file is opened or created (528EH) before DISK's value is checked (5297H-529AH), so DISK of 4096 or more leaves a created file behind with PARAMETER ERROR.
• The first byte of 402DH is compared with C3H (5208H-520DH): SPOOL is refused with CAN'T -- ONLY VALID AT VTOS COMMAND LEVEL when a program has put a JP there (BASIC/CMD does at its 66A9H).
• The 53C5H LD BC,0000H / ADD HL,BC adds nothing: the driver entry is at offset 0 of the resident code. 5200H-5207H (eight 00H) are not used.
• The manual (VTOS v4.0 (1979)): "SPOOL <devspec> [prep] <filespec>" and "they default to 1K of MEMory and approximately 5K of DISK, depending upon the disk type". The bytes: defaults 0001H and 0004H (52C8H, 5294H); DISK=4 gives 16 records of 256 bytes, so the "approximately 5K" can only come from the granules the file takes on the disk. The short forms M and D are accepted (54BAH, 54CAH), and DISK=0 means no file at all (5284H). The manual's "The actual location of the buffers will be dynamically altered" is the move of full pages to records when no memory page is free.

Member 15: APPEND, COPY (5200H)

APPEND source destination adds the source file (or device) to the end of an existing destination file; COPY source destination copies a file or device to a file or device, creating the destination file when it is not there. Both read the two specifications with 441CH into control blocks at 549DH (source) and 54BDH (destination); a missing destination specification makes the member copy the rest of the command line from the character that stopped the read (5218H, 5288H), and 53CDH then puts the source's name in front when the destination has none and inserts the source's extension and password when the destination lacks them (never the drive). Between two files the copy goes sector by sector through the memory from 5500H up to the page below the top of memory (4049H): the destination's space is first written ahead with a sector of E5H (535BH), then the pages are filled from the source and written out in rounds, and the destination gets the source's end of file offset before it is closed. When either side of COPY is a device, or when the destination of APPEND does not end on a sector boundary, the copy goes byte by byte through the ROM's 0013H and 001BH; BREAK ends it and SHIFT with @ pauses it (both untested while DO commands run). APPEND refuses a device destination and COPY refuses a destination that is the source file itself.

Points to note:

• APPEND bug, 5259H-5263H: the record of the write ahead is the source's ending record number plus Register Pair BC, but BC is not loaded there: Register B = 00H (5236H) and Register C is what the calls before left (05H from SYS1/SYS's 4FCEH after a destination specification is read and nothing is inserted, 03H after an insertion into a read specification, 0DH after an insertion into a text copied by the LDIR, 00H after the LDIR with no insertion). The destination's own ending record number, just pushed in Register Pair HL, is not used. When source sectors + C is below the destination's sector count, 535BH writes a sector of E5H over an existing sector of the destination (the position is inside the file), and the append then starts at the old end, so that destination sector is left as E5H bytes. The intent (write ahead to the combined size, as COPY does with its own size at 52CCH) needs the destination's count in BC.
• APPEND from a device (for example APPEND with an asterisk and KI as the source) onto a destination that ends on a sector boundary: 535BH positions with bytes +0CH-+0DH of the device's control block (54A9H), which the device open does not set, writes an E5H sector there, and then 4436H at 52E5H on the device's block (type 10H, bit 7 clear) returns error 26H FILE NOT OPEN, which 52F2H displays. Only a destination with an end of file offset other than 00H takes the byte by byte path that handles a device source.
• APPEND does not test whether the source and destination are the same file; COPY does (52BFH-52C9H) and then displays DESTINATION FILE SPEC REQUIRED, the only use of that message.
• A missing destination specification: the LDIR at 5218H/5288H copies the command line from the character before HL. At the end of a line that is the last character of the source specification, so COPY ABC copies ABC to a file named C, COPY A/BAS to S/BAS (the extension is then inserted), COPY A:1 to A1 on any drive (the 1 is not a letter, so the source name is put in front), and COPY A gives DESTINATION FILE SPEC REQUIRED (A to A). With a colon or slash first (COPY A/BAS :1, COPY X/Y /Z) the destination is completed as the manual describes.
• The drive is never taken from the source (53CDH): manual "Note that this does not apply to the drive number due to its global nature." matches the bytes.
• Manual: "APPEND <filespec/devspec> [prep] <filespec/devspec>" and "The first file/device specified is appended to the end of the second file/device specified." The bytes refuse a device destination for APPEND with FILE SPEC REQUIRED (521AH-521FH).
• Manual: "The operation may be aborted at any time with the <break> key if a character oriented, logical device, copy is being performed." The bytes also stop at BREAK when a file is appended byte by byte, add a pause with SHIFT and @ (5436H-5453H) and test nothing while bit 5 of 430FH (DO commands) is set (5428H-542FH).
• Dead code: CALL 532CH at 531DH has no branch to it (531BH jumps over it). The test of the stop page at 5330H-5332H never fires from 5312H, the only caller, since 52F9H writes the pages out as soon as Register H reaches the stop page.
• The open is always given record length 00H (256), and 5318H copies the source's +09H (also 00H) to the destination: a destination that COPY creates gets 00H in byte +04H of its directory record, whatever the source's record length was.
• The write ahead of COPY (52CCH-52D0H) writes the E5H sector at the record number equal to the source's sector count, one past the last sector the copy writes; the close (4428H, SYS3/SYS) gives back the granules past the end of file.
• The results of 4442H (error 1DH for a record past the end of file) and of the write at 5371H are not tested in 535BH.

Member 16: BUILD (5200H)

BUILD filespec creates a new text file from lines typed at the keyboard. The file specification is copied by 441CH (SYS1/SYS 4FCEH) into the control block at 52CCH (no default extension is added); without one the member shows FILE SPEC REQUIRED. The file is opened with 4420H (create when absent); when it already exists BUILD shows FILE ALREADY EXISTS and aborts. Lines are read with the ROM's 0040H (at most 255 characters each, for any file) and kept in memory from 5400H, each ended by 0DH; BREAK as the first key of a line ends the input. When the extension is KSM each line is prompted with its letter (A=> to Z=>) and the input ends by itself after Z. Only then are all bytes written to the file (ROM 001BH) and the file closed.

Points to note:

• The manual (BUILD) says: "The input line length will be limited to 64 characters except in the case of a KSM file which may be up to 256 characters in length." The bytes give every line, KSM or not, the same limit: LD B,FFH at 5260H, 255 characters plus the 0DH.
• The text is kept in memory from 5400H up with no test against the top of memory (4049H) or any limit: a long ordinary file overwrites whatever lies above (for example drivers kept above the top of memory); a KSM file stops after 26 lines (at most 6657 bytes, up to 6E00H).
• The scan for the KSM extension (520CH-5214H) stops only at 0DH or "/", not at the 03H that ends the text copied by 4FCEH. With no extension in the specification it reads on past the 32 byte control block (52ECH up, the buffer 5300H, the text area) until it meets a 0DH or a "/": a "/KSM" left in that memory turns on the prompts for a file that has no KSM extension. The bytes after the 03H in the control block are what an earlier command left there.
• BREAK typed after some characters of a line does not end the input: the ROM ends the line with 0DH and BUILD keeps it (5270H). Only BREAK as the first key of a line (or the 26th KSM line) ends it. The manual: "The file will be written to disk when the <break> key is hit as the first keystroke of an input line." (agrees).
• Nothing is written until the input ends; a failure while writing leaves the file open and partly written (528EH goes to 4409H/4030H with no close).
• FILE ALREADY EXISTS: the existing file has been opened by 4420H but is not closed and is not changed.
• A device specification (an asterisk and a device name) is opened by SYS2/SYS's device open, which returns Z with A = 00H and no CARRY (SYS2/SYS 4E1CH, XOR A at 4E55H), so BUILD refuses it with FILE ALREADY EXISTS.
• 528DH NOP: dead filler between JP Z,402DH and the error exit; the NZ path of the close runs through it into 528EH.
• In KSM mode the prompt is the letter, "=", ">" and a space, displayed with ROM 0033H (which leaves Register Pair DE = 401DH; 5277H loads 52CCH again before writing).

Member 17: LIST, PRINT (5200H)

LIST and PRINT list a file, LIST on the display (DO device control block 401DH), PRINT on the printer (PR device control block 4025H). Syntax as the code parses it: LIST filespec (NUM,LINE=n,HEX,REC=r,LRL=l), the list optional, read by SYS1/SYS's parameter reader (4476H) into the operands of LD BC instructions. The file specification gets the default extension TXT; when that open fails the specification is opened again as typed. A device (an asterisk first) is refused with FILE SPEC REQUIRED. Without HEX the file is listed as text, line by line (lines end at 0DH, bit 7 of each byte cleared), from line LINE (default 1), each line preceded by its five digit number and ". " when NUM is given. With HEX the file is positioned to record REC (records of LRL bytes, default 256) and listed 16 bytes a line as "nnnnn:oo = " (record number, offset in the record in hex) followed by the bytes in hex; LIST puts the bytes as characters on a second line under the hex, PRINT on the same line after it; a blank line separates the records. BREAK stops the listing, SHIFT and @ pause it until another key (not while a file of commands runs).

Points to note:

• The leading zero suppression of 542BH never works: a 0 becomes a space only when the byte before it is a space, and the bytes before the two fields are 0DH (54D7H, the end of PARAMETER ERROR) and 03H (54DFH). Line and record numbers are always shown with five digits and leading zeros (00001. , 00000:00 = ).
• LINE=0 makes the count of lines to pass over FFFFH (DEC BC at 5284H), and LINE alone (FFFFH) FFFEH: the member reads to the end of the file and shows END OF FILE ENCOUNTERED as an error (528CH), where an end of file during the listing is a normal end.
• The manual gives "LIST <filespec/devspec>" and "PRINT <filespec/devspec>", but 522FH-5231H refuse a specification starting with an asterisk (a device) with FILE SPEC REQUIRED.
• The manual says the default extensions are "'TXT' and if not found, all blanks": the code opens NAME/TXT first and, when that open fails for any reason (not only file not found), the specification as typed.
• PRINT pads a short last line of a HEX record to align the characters (53B5H-53C6H); with exactly 8 bytes on the line it sends one space too many (CP 18H then CCF counts the extra space after the eighth byte as not sent, though 536AH-536EH sent it). LIST places the extra space between the halves by the count of characters of the line (53A8H-53ADH), so on a last line of 9 to 15 bytes it falls after byte 1 to 7.
• 5461H has no stop after the first digit: past 99999 the carry runs into the bytes before the field (54D7H and the text PARAMETER ERROR, or 54DFH) and the number shows 00000. The member is reloaded at each command, so the damage does not last.
• A byte with bit 7 set is sent with bit 7 cleared (52CAH) and makes the text listing test the keyboard after it (52D0H-52D2H); otherwise the text listing tests the keyboard only after each line.
• REC is never reset by the member (unlike NUM, HEX, LINE, LRL); it starts at 0000H only because the member is loaded fresh for each command.
• 531AH is a NOP that does nothing.
• 5402H shows the six codes 5BH-60H (between the capital and the small letters) as a period but small letters 61H-7AH as they are.
• An empty file, or REC at or past the end of the file, gives END OF FILE ENCOUNTERED as an error in a HEX listing (4442H at 5314H returns 1CH or 1DH, 5317H jumps to 549EH), while the text listing of an empty file ends normally at 52F6H (VTOS READY).

Member 18: ATTRIB (5200H)

ATTRIB filespec (INV, VIS, ACC=password, UPD=password, PROT=level) changes the protection of a file in its directory record. The member reads the specification into the control block at 53DBH (a device is refused with FILE SPEC REQUIRED), opens the file with 4424H and goes on only when the open granted access level 0 (the update password, the code CAD2H, or the access password of a file of protection level 0), else it shows error 25H. The rest of the line is made upper case in place; parameters are told by their first letter only (I, V, A, U, P; the rest of the word up to the equal sign is passed over), each value is a letter followed by letters and digits (at most 8, an optional pair of quotation marks), and PROT takes the first two characters of its value from the table at 53CBH (ALL and FULL 0, KILL 1, NAME and RENAME 2, WRIT 4, READ 5, EXEC 6). After the closing parenthesis the directory record is read with 4B10H, the attribute byte's level (bits 2-0) and invisible bit (bit 3), the update password code (+10H-+11H) and the access password code (+12H-+13H) changed as asked, and the sector written back with 4B1FH; the hash codes are made by SYS2/SYS (request E4H) in its own work cells at 51E0H-51F6H.

Points to note:

• Bug: PROT is stored with AND F0H (5334H), which clears bit 3, the invisible bit, along with the old level; unless INV or VIS is given in the same command, PROT makes an invisible file visible.
• Level 3 cannot be chosen: its table entry at 53D3H-53D4H is two tildes (7EH), and the line is upper cased first (7EH becomes 5EH) and values are copied by SYS2/SYS's 50B1H as letters and digits only.
• Only the first two characters of a PROT value count (and the third for RE), so PROT=EXAMPLE gives EXEC and PROT=NAMELESS gives NAME. Manual: "The values p may take on are: EXEC(ute only), READ (only), WRIT(e), RENA(me), NAME, KILL, and FULL (or ALL)." The bytes give RENA and NAME the same level 2, and ALL and FULL level 0.
• Parameters are recognised by their first letter alone (5239H-524DH): INVISIBLE, IX, VERY, PASSWORD= are taken as INV, INV, VIS, PROT. A space after the opening parenthesis or after a comma gives PARAMETER ERROR; a missing closing parenthesis gives PARAMETER ERROR; no list at all gives -NOTHING DONE-. Manual syntax: "ATTRIB <filespec> ([ACC=a], [UPD=u], [PROT=p], [INV], [VIS])".
• ACC= or UPD= with an empty value (followed at once by a comma, a closing parenthesis or a closing quote) stores the hash code of 8 spaces, which removes that password. A value that starts with a digit gives PARAMETER ERROR, after the hash code of 8 spaces has been worked out but before anything is written.
• ATTRIB needs access level 0 from the open (521CH-5223H, error 25H otherwise). SYS2/SYS's password check (its 4F03H) gives level 0 for the update password (so a blank password when the update password is blank), for the hash code CAD2H that opens every file, and for the access password when the file's protection level is 0 (FULL or ALL): a user who knows only the access password of such a file can change all its passwords and its level.
• ATTRIB uses SYS2/SYS's code and cells left in the overlay area by its own open: a direct CALL 50B1H (531CH) and the cells 51E0H-51F6H; request E4H (52F4H) finds SYS2/SYS still in memory, so nothing is loaded over them.
• The file is never closed (nothing of it is written); the directory record is changed directly in 4200H and written with 4B1FH.
• 53CAH, a 0DH between the upper case routine and the table of levels, is not read by any code.

Member 19: PROT (5200H)

PROT (member 19, code 52H) changes the protection data of a diskette: PROT :d (PW,LOCK,UNLOCK,NAME,MPW), each value given as ="text" or left out to be asked for. The drive is a colon and one character right after the command word (drive 0 without it). At least one of PW, LOCK, UNLOCK and NAME must be given (else -NOTHING DONE-); the current master password (MPW="text" or typed at MASTER PASSWORD ?) is hashed by SYS2/SYS (request E4H) and must equal the allocation table's code +CEH-+CFH (the code C294H is accepted for every diskette). NAME copies 8 characters to the table's +D0H-+D7H, PW stores the new password's hash code at +CEH-+CFH; the table is written back, and when its byte +CBH is below 30H (a table VTOS's FORMAT/CMD did not write) +CCH is worked out from the lockout bytes and DIR/SYS's hash index byte 2CH is changed to C4H and its access password removed. LOCK gives every user file (not system, not invisible) the master password code as update and access password code, UNLOCK the code of 8 spaces (no password).

Points to note:

• Register C (the drive) is lost before the hash index table is read (5276H-527EH): the LDIR of NAME (5264H) leaves Register C = 00H, and a PW typed at the prompt leaves it 08H (the ROM's 0040H line input copies its maximum, Register B = 8, into Register C at 05DFH and keeps it). 47A0H uses bits 2-0, so in both cases the hash index table and the directory cylinder (Register D) of drive 0 are used. Then for PROT :n with n not 0: LOCK/UNLOCK (5300H-535FH) choose the records of drive n by drive 0's hash index table (files of drive n at other places are not changed), and on a diskette whose table byte +CBH is below 30H the repair at 52C4H writes drive 0's index sector (with 5801H changed to C4H when it held 2CH) over drive n's sector 1 of the cylinder of drive 0's directory; 52CFH-52DDH read and write sector 3 of that cylinder. Only the allocation table (52A7H) and the LOCK/UNLOCK records (5303H) use Register C reloaded from 5370H. Without NAME and without a typed PW all of this uses the right drive.
• The code C294H is accepted as the master password of every diskette (5378H-537EH). The same two bytes 94H C2H are also in BACKUP/CMD (file offset 06C2H) and in another SYS6/SYS member (file offset 3657H). Which text gives this code was not looked for.
• The drive is the one character after a colon right after the command word, less 30H (5221H-522BH): there is no range test (:8 and :9 give drives 8 and 9, which 47A0H turns into 0 and 1), and with more than one space before the colon the colon is not seen and drive 0 is used.
• Only the low bytes of the PW, LOCK, UNLOCK and NAME words are tested at 5239H-5247H; MPW alone does nothing (-NOTHING DONE-). A value given as a number (NAME=X'4000' or NAME=123) is taken as the address of the text: 539CH copies 8 bytes from that address (a decimal 0, or =N, =NO, =OFF, counts as not given).
• The text of a value is cut at 8 characters and also ends at a comma or a double quote (53AAH-53B0H); a typed text is cut at 8 by the ROM's line input. The CARRY FLAG the ROM's 0040H returns for BREAK is not tested (53C3H): BREAK at a prompt takes what was typed so far, like ENTER. Small letters are not made capital: a password typed in small letters gives another hash code.
• With both LOCK and UNLOCK, LOCK wins (52F1H). The passwords set by LOCK/UNLOCK leave records alone whose attribute has bit 6 or bit 3 set (532DH-5331H) and the entry codes 00H-07H and 20H-27H (530EH), which the manual calls "all non-system, non-invisible files".
• The "two additional services" of the manual ("These services perform certain maintenance functions needed for reading the directory of disks generated by non-VTOS systems ... Any PROTect command will automatically invoke these additional services") run only when the allocation table's byte +CBH is below 30H (FORMAT/CMD writes 40H): +CCH (cylinders past 35) is set from the lockout bytes of cylinders 70, 40 and 35 (2AH, 23H, 05H or 00H: 77, 70, 40 or 35 cylinders; an 80 cylinder diskette gets 77), and when DIR/SYS's hash index byte is 2CH it becomes C4H (verified: SYS2/SYS 50CBH's hash of "DIR SYS" is C4H) and DIR/SYS's access password code becomes 4296H. +CBH itself is never written, so the +CCH work is done again at every PROT of that diskette; the index sector and directory sector 3 writes are not read back (4768H only). They are not done for a command that gives only MPW (it ends at -NOTHING DONE- first).
• The member holds the patch the distributor's manual prints as "Fix for the PROT command. Permits a new name or master password to be specified either on the command line, or by answering the follow-on prompts": lines D26,9C (520BH-521AH), D27,19 (5288H-528AH: CP 30H / JR NC,52A7H), D28,37 (53A0H JP 520DH) and D28,63 (53CCH, LD A,09H) are all in the bytes, as are the earlier patch SYS6A/FIX's D27,19=30 and D27,1B=1C. The manual's SYS6A note says it lets a disk be renamed with PROT :1(NAME="UTILITIES").
• A name must be typed in full (PW, LOCK, UNLOCK, NAME, MPW): SYS1/SYS's 50BCH needs a space in the table where the typed word ends.
• The prompts end in spaces so that every answer starts in column 23 (53D8H, 549BH, 54B3H). The fill at 53CFH writes 5608H, one byte past the 8 characters, after a typed text.
• The 4200H read of sector 3 (52CFH) and the record at 4212H assume DIR/SYS's record is record 0 of directory sector 3 (entry code 01H), where FORMAT/CMD writes it.

Member 20: RENAME (5200H)

RENAME (member 20, code 53H) gives a file a new name and extension: RENAME old new, with the word TO between them when wanted. The old specification is read with 441CH into the control block 539AH (a device is refused), the new one into 53BAH; a new specification without a name (such as /TXT or .PW) is taken as typed (LDIR of 32 bytes of the line). 52C0H completes the new text from the old one: the name when the new one starts with a character below A, then the extension and the password when the new one lacks them. The old file is opened (4424H, SYS2/SYS) and must have access level 0-2; the new text gets the old file's drive (a different drive digit is ILLEGAL DRIVE SPECIFICATION); the new name is opened on that drive and must give FILE NOT IN DIRECTORY (found = DUPLICATE FILE NAME). Then the directory record of the old file (4B10H, entry code from +07H) gets the new name and extension at +05H-+0FH from SYS2/SYS's 51E8H, is written back (4B1FH), and the record's hash index byte gets the new name's hash code (request D4H; 51B5H read, 51C7H write in SYS2/SYS).

Points to note:

• With no new specification the LDIR at 5217H-521BH copies the line from the character before Register Pair HL, which is the last character of the old specification (441CH leaves Register Pair HL on the 0DH): RENAME A/BAS renames the file A/BAS to S/BAS (52C0H adds /BAS, 5243H the drive). RENAME IT TO WHAT? (533CH) is shown only when that byte is below 0EH, which a normal line does not give. With a space after the old specification the copied text starts with the space: 52C0H puts the old name and extension in front of it (A/BAS followed by the space), the drive goes after the space, and the second open finds the old file itself: DUPLICATE FILE NAME.
• The drive digit of the new specification is compared in bits 2-0 only (5257H-5258H): :8 and :9 pass that test for drives 0 and 1, but the second open (5275H; SYS2/SYS 5050H takes only the digits 0-7) then returns error 20H, ILLEGAL DRIVE NUMBER, which 5281H shows through 4409H; nothing is renamed.
• A new name that starts with a digit (441CH copies digits as name characters) is taken as no name by 52C2H: the old name is put in front of it (RENAME A/BAS 1X gives A1X/BAS).
• The password of the new specification (given or copied by 52C0H) is used only by the second open; the record keeps its passwords. A file of the new name that has a password gives FILE ACCESS DENIED (19H, through 4409H) instead of DUPLICATE FILE NAME, unless the copied or given password opens it.
• The save and restore of 51DEH around the second open (526EH-5279H) has no effect: nothing reads 51DEH before request D4H (52BDH) stores the new code there.
• The opens get Register Pair HL and Register B as the code leaves them (a place in the old text and 2EH; the hash word) as buffer and record length; RENAME never reads or writes the file, so this does no harm.
• The access level test (5237H-5240H) allows the levels 0, 1 and 2; the manual's level names (ATTRIB: "EXEC(ute only), READ (only), WRIT(e), RENA(me), NAME, KILL, and FULL") are not in this member.
• The manual says "Dynamic defaults will be used for the name, extension, and password of the second specification"; the code agrees and also forces the old drive (5243H-526CH).
• The entry flags are not tested: a load error (NZ on entry) is not noticed.

Member 21: DEVICE (5200H)

DEVICE (member 21, code 61H) shows the drives and the devices of the system; it takes no parameters (the text after the word is never read). First one line for each drive 0-7 whose drive code table (4700H-474FH, via 478FH) begins with C3H: ":d 5" FLOPPY #s, CYLS=nnn, SDEN or DDEN, SIDES=1 or 2, STEP=rr MS, DLY= 1 S or DLY=.5 S" (no DLY part for an 8 inch drive), or ":d 5" RIGID #s, CYLS=nnn, REMOVABLE or FIXED" for a rigid disk (8" for one with +03H bit 5 set); s is the select bit (+04H bits 3-0) in hex, the size, density, rigid, delay and step rate come from +03H, the sides from +04H bit 5, the cylinders from +06H plus 1. Then one line for each device control block in use (4015H, 401DH, 4025H, 43C0H-43F8H, type not 00H): an asterisk and the name, the direction (a less than sign for input, the equals sign, a greater than sign for output), then NIL, or X'nnnn' with the driver address, or for a routed block the asterisk and name of each block it routes to, or for a route to an open file the file's NAME/EXT:d read from its directory record with SYS3/SYS function B5H (44BBH). Each device line is built in the 40 byte buffer 53F6H-541DH and shown with 4467H; drive lines go straight to the display through the ROM's 0033H and 4467H.

Points to note:

• DEVICE also lists the drives (drive code tables), which the manual's DEVICE text ("all logical devices which are currently enabled ... the I/O direction ... any ROUTE-ing ... the address of the actual I/O driver module") does not mention.
• The number after FLOPPY # or RIGID # is the select bit of the drive (+04H bits 3-0) in hex, 1, 2, 4, 8 for drives 0-3, not the drive number (5242H-5249H).
• A rigid disk's CYLS= shows twice the cylinders of +06H plus 1 (5259H ADD HL,HL); its line has no density, sides, step or delay, but REMOVABLE (+03H bit 2 clear) or FIXED (bit 2 set): the same bit gives the floppy's DLY.
• The result of 44BBH (538AH) is not tested: on a directory read error (11H) SYS3/SYS writes nothing, and the search for 03H at 538EH-5394H runs on through the buffer and the memory past 541DH to the first 03H byte (the buffer is not in the file and earlier lines leave no 03H in it, so unless the memory there held one it is 5438H, the end of the FLOPPY text), storing 0DH there and displaying everything from 53F6H up to the first 03H or 0DH.
• The direction shown for a route to a file is always " <=> " (53F1H), whatever the routed block's own type bits; for a route to a device the direction shown is the target block's (53A0H with HL = the target), not the routed block's.
• A route target that is not routed is shown by name alone, with no driver address (533DH). A ring of routes (a block routed back to itself through others) never ends the loop 531CH-533BH; a line takes 3 bytes for the name, 8 for each device hop and 1 for the carriage return, so a chain of five device hops (44 bytes), or three device hops before a file with a long NAME/EXT:d (up to 19 bytes with its direction), overruns the 40 byte buffer into the step table at 541EH.
• 5382H-5385H moves to +06H of a file control block with ADD A,06H on Register L alone: a control block whose +06H/+07H lie on the next page would be read wrongly.
• At the top level only bits 4 (routed) and 3 (NIL) of a block's type are tested: any other block in use is shown as X'nnnn' with its +01H-+02H.

Member 22: LINK (5200H)

LINK (member 22, code 62H) joins two devices: LINK, an asterisk and the device name d1, the word TO when wanted, then an asterisk and the device name d2. Both specifications are read with 441CH into the blocks 5304H and 5324H and must start with an asterisk; the device control blocks are found by their two letter names (5288H: 4015H KI, 401DH DO, 4025H PR, then 43C0H-43FFH). The 30 byte routine 526AH-5287H gets d1's driver address (its two CALL operands) and d2's block address (its two LD DE operands), the top of memory 4049H is lowered by 30 and the routine is copied above the new top; d1's +01H-+02H then point at the copy. From then on an output (or control) request to d1 runs d1's old driver and then sends the old driver's Register A to d2 through ROM 001BH, returning d1's result; an input request asks d1's old driver and, when it gives 00H, asks d2 through ROM 0013H. LINK refuses to run when 402DH holds C3H (a program's JP, as BASIC/CMD stores at its 66A6H-66A9H before it runs a command line through 4405H).

Points to note:

• The test of 402DH (5200H-5205H) looks for C3H only: BASIC/CMD writes C3H there (its 66A6H-66A9H) before running a command line through 4405H, so LINK from BASIC's command is refused; the manual says nothing of it.
• A control request (Register A = 04H, the NZ and NC flags of CP 02H) goes the output way (526AH): the old driver gets it, then Register A as the old driver returned it is sent to the second device as an output byte.
• The byte sent to the second device is the old driver's returned Register A, not Register C: right for drivers that return the character in Register A (the ROM's display driver does), wrong for one that does not.
• The second device's result of an output is dropped; the caller gets the first device's Register A and flags (5272H-527CH).
• LINK does not look at the type byte of either block (5288H): a routed block (type 10H) holds the block it is routed to at +01H-+02H, and LINK takes that as a driver address and replaces it with the routine's address.
• Every LINK takes 30 more bytes of the top of memory (5251H-5257H); LINK itself gives none back. Linking a device to itself makes the routine call itself through 001BH for every output without end (the manual: "Multiple LINKs of the same devices may produce an endless condition").
• A one letter device name is looked up with 03H as its second character (441CH stores 03H after it): it matches only a block whose +07H is 03H, none of KI, DO, PR, JL, SI, LO.
• The manual: "all output sent to the first device will also be sent to the second device and all input requested from the first device may be satisfied from either device"; the code asks the second device only when the first gives 00H.
• The entry flags are not tested: a load error (NZ on entry) is not noticed.

Member 23: RESET (5200H)

RESET (member 23, code 63H) resets one device or all of them. RESET *dd (an asterisk and the device name, read with 441CH into the block 5405H) finds the device control block by name (4015H, 401DH, 4025H, 43C0H-43F8H), closes the open file at the end of its route (a copy of the file control block at 530CH is closed with 4428H), and sets the block NIL (type 08H); KI, DO and PR (4015H-402CH) are then copied back from templates that hold the start-up drivers saved by SYS0/SYS's reset at 43B8H-43BDH, and for DO the screen is cleared (1CH, 1FH). RESET with nothing after it (or with text that is not a specification) resets all: the files at the ends of all routes are closed, the top of memory 4049H is found again by testing FFFFH down in 1K steps unless a task slot (4500H-4517H) points above 4049H, KI, DO and PR are copied from the templates (the DO cursor kept), 43BEH-43BFH is cleared, JL (NIL), SI (routed to KI) and LO (routed to DO) are copied to 43C0H-43D7H and the free blocks 43D8H-43FFH are cleared. A file specification gives DEVICE SPEC REQUIRED; RESET of all when 402DH holds a JP gives CAN'T -- VALID ONLY AT VTOS COMMAND LEVEL.

Points to note:

• Every text after RESET that 441CH does not take as a specification gives NZ (521AH) and resets ALL the devices, not only an empty line: an asterisk with no name (RESET *), a line starting with a character that is neither a letter, a digit nor an asterisk (RESET ,), a second space before the asterisk (5076H ends an empty field at a space), a name with a period and no password (RESET X.) or a colon and no drive. A name without the asterisk (RESET PR) is a file specification: DEVICE SPEC REQUIRED.
• Only KI, DO and PR (page 40H, 5234H-5237H) are restored to a start-up state by RESET *dd; SI, LO and JL are made NIL, so RESET *SI and RESET *LO do not give back their start-up routes to KI and DO (RESET of all does). The manual: "If the device is a standard system device, it will be reset to its normal system power-on driver. If the device is a non-standard device, it will be set to a 'NIL' driver".
• The file is closed through a 32 byte copy of its control block (52F8H-5302H); the control block itself keeps its open bit 7.
• 52EAH follows the whole route chain: RESET *LO, when LO routes to DO and DO is routed to a file, closes DO's file though DO stays routed to it.
• A close error stops RESET at once (5305H): during RESET of all, the blocks after the failing one keep their files open and nothing is reset.
• The test of 402DH for C3H (5288H-528DH) is skipped when a task lies above the top of memory (5284H jumps over it), so RESET of all then resets the devices even from inside a program that has changed 402DH. The CAN'T -- VALID ONLY AT VTOS COMMAND LEVEL case is not in the manual; the files at the ends of routes are closed before it is shown.
• The manual: "RESET 'ALL' ... attempt to reset HIGH$ to the top end of physical memory. Note that if any currently active foreground tasks are resident in high memory, HIGH$ will not be altered": the bytes agree; a task counts as high when its task control block address (the slot word) is above (4049H).
• A one letter device name (RESET *K) leaves 03H as the second letter (5407H) and never matches: DEVICE NOT AVAILABLE.
• The memory test (5291H-52A0H) has no lower limit: it stops at the first 1K step that keeps a complemented byte.

Member 24: ROUTE (5200H)

ROUTE (member 24, code 64H) sends a device's input and output somewhere else: ROUTE, an asterisk and a device name, then (NIL), or [TO] an asterisk and a second device name, or [TO] a file specification. The first specification (read by SYS1/SYS's 4FCEH into 5389H) must be a device; (NIL) makes it type 08H (NIL). A second device is found by name in the device control blocks (4015H, 401DH, 4025H, 43C0H-43FFH) and the device gets type 10H (routed) with that block's address at +01H-+02H. For a file (refused when 402DH holds a JP, as under BASIC/CMD) the file is opened or created with a 256 byte buffer just under the top of memory 4049H, positioned to its end, its 32 byte control block copied below the buffer and 4049H lowered under it; the device is routed to that control block. A device name that does not exist takes the first free device control block (name 0000H). Before a device is changed, a route it had that ends in an open file is followed and that file closed.

Points to note:

• The file route takes 288 bytes of high memory (the 32 byte control block and the 256 byte buffer) by lowering 4049H; nothing in ROUTE gives them back. When a device that went to a file is routed again or made NIL, 530EH closes the file through a copy at 532DH and the old control block and buffer stay in high memory, still marked open.
• The memory is taken and the file opened before the device to route is looked up (5276H-52A1H, then 5240H): when no free device control block is left (error 21H), the file stays open and the 288 bytes stay taken.
• The route to a file adds to the file: 4448H positions the new or existing file to its end before any data is sent (5284H); the manual does not say that an existing file is appended to.
• 530EH follows the whole chain of routes of the device being changed: with device A routed to device B and device B routed to a file, making A NIL or routing A to DO closes B's file, although B still goes to that control block. A device routed to itself (routing PR to PR is not refused) makes 530EH loop without end at the next ROUTE of that device, and makes SYS0/SYS's route following loop too.
• 5212H stores 0000H at 5220H, which is 0000H in the file already; since the member is loaded afresh at every command the store changes nothing.
• DEVICE SPEC REQUIRED is shown for any bad specification, for a first specification that is a file name (520CH) and for a missing second specification (522DH), for which the manual's "ROUTE <devspec> [(NIL)] [prep] <filespec/devspec>" requires one or the other. With (NIL) the second specification is not read at all (5224H); a parameter list after a second specification is not read either.
• An existing device made NIL keeps its old +01H-+02H (52E5H changes only +00H); a new device made NIL gets only the type and the name (52F8H-5300H). The routed and new-NIL changes are made with interrupts off (525BH-526AH, 52F3H-5301H), the NIL change of an existing device is one store.
• 53C9H searches 4015H-402CH and then 43C0H-43FFH; the search stops when Register L wraps to 00H after 43FFH. A name of 0000H finds the first free block; the reset clears 43D8H-43FFH (five free blocks).

Member 25: FILTER, SET (5A00H)

SET and FILTER install a device driver or a filter on a logical device. Syntax as the code parses it: SET or FILTER, a device (an asterisk and its two letter name), an optional preposition (TO), a file specification, then any parameters; the first specification must be a device (an asterisk, else DEVICE SPEC REQUIRED), the second a file (else FILE SPEC REQUIRED), and whatever follows it is left for the loaded program. The member runs only at the system's command level: when 402DH holds a JP (C3H, written by a program such as BASIC/CMD that took over the exits) it shows CAN'T -- VALID ONLY AT VTOS COMMAND LEVEL. The device control block is looked up by its two letter name among 4015H, 401DH, 4025H and 43C0H-43F8H; SET takes a free block (name 0000H) for a new device (NO DEVICE SPACE AVAILABLE when none is left) and writes the name into it, FILTER needs an existing device (DEVICE NOT AVAILABLE). The file (default extension DVR for SET, FLT for FILTER) is loaded with SYS0/SYS's program loader 4430H and entered at its transfer address with Register Pair DE = the device control block and Register Pair HL = the rest of the command line. The member loads at 5A00H, above the 5200H where driver and filter files load (ADDLF/FLT loads at 5200H).

Points to note:

• The SET entry 5A01H is the operand byte of OR AFH at 5A00H: run from 5A01H the byte AFH is XOR A. FILTER's flag is the code from 430EH ORed with AFH, never 00H.
• The member checks only the first byte of 402DH: a program that keeps 3EH there but hooks the exits in another way is not detected; BASIC/CMD (its 66A6H-66AFH) writes C3H at 402DH, 4030H and 4409H, so SET and FILTER are refused from BASIC.
• SET with a device name that exists loads the driver for the existing block and writes the same name again; SET with a new name takes the first free block (name 0000H) without any other test. A one letter device name (441CH accepts 1 or 2 letters) leaves 03H as the second letter in 5B1CH, and SET writes that 03H into +07H of the block.
• The search 5A82H looks at the name bytes of every block, the system blocks 4015H, 401DH, 4025H too; a free block is one whose name is 00H 00H (the reset clears 43D8H-43FFH). Nothing protects JL, SI or LO from SET.
• The loaded file must not reach 5A00H-5B59H: after 4430H the member still runs 5A63H-5A7BH and reads 5B1BH-5B1CH.
• The manual's syntax "SET <devspec> [pre]) <filespec> [prep] [(params)]" and "FILTER <devspec> [prep] <filespec> [prep] [(params)]": the member itself reads no parameters; everything after the file specification (a second preposition and the parameter list included) is handed to the driver in Register Pair HL.

Member 26: DUMP (5200H)

DUMP writes a block of memory to a disk file as a load module. The code reads DUMP filespec (START=s,END=e,TRA=t), with S, E and T accepted as short names; values are decimal or X'hex' as SYS1/SYS's parameter reader (510FH) takes them, and they are stored straight into the operands 5294H, 529AH and 52D7H. The default extension is CIM, the default start and end are 6000H and the default transfer address is 402DH (VTOS READY). The start must be 6000H or more and the end not below the start. The file (opened or created through 4420H with a 256 byte buffer at 5400H) receives a module name record 05H 06H with the first six letters/digits of the file name, load blocks 01H of up to 254 bytes (length byte = count + 2), and a transfer record 02H 02H lo hi; then it is closed (4428H) and the command ends at 402DH.

Points to note:

• The range checks (527AH-5291H) come after the open or create (525EH) and after the first 8 bytes (the 05H record) were written. END LESS THAN START and START LESS THAN X'6000' abort with JP 4030H and the file is never closed: a new file stays in the directory as created, with nothing of the dump written to it.
• Any error while writing a byte (5203H) also aborts through 4409H without closing the file.
• The start must be at least 6000H (5289H-5291H: 5FFFH - start must borrow). The end has no upper check; END=X'FFFF' works (end + 1 wraps to 0000H and the count comes out right). START, END or TRA given with no value store FFFFH (510FH's rule), so START alone gives END LESS THAN START with the default end, and TRA alone gives a transfer to FFFFH.
• A block holds 254 data bytes (length byte 00H, which the loader reads as 254); when exactly 255 bytes are left the code still writes 254 and then a block of 1 (52A9H-52ABH), though a length byte 01H would also be read correctly by the loader.
• The module name is the first six characters of the name only up to the first character that is not a digit or capital letter; a name of 7 or 8 characters is cut to 6.
• The member never writes an end record: the module is 05H, 01H blocks, 02H.
• Manual (user manual page 18): "TRA (or T) --- transfer block's length". The bytes: TRA is the transfer address written into the 02H record (52D6H-52DEH). The manual: "The memory area must be above X'6000'"; the bytes accept a start of exactly 6000H and refuse 5FFFH and below. The distributor's manual says patch SYS6D "corrects DUMP to permit dumping files which start as low as X'6000'" and "prevents the disk from spinning indefinitely when an error occurs in the DUMP command": the bytes of this file are already the patched ones (the routine 5203H with its error exit, 60H in 5295H and 529BH (the defaults 6000H), 5FH in 528BH (5FFFH), 402DH at 52D7H, the 6 of X'6000' at 532DH).
• 520EH-5211H: four 00H bytes nothing reaches (left over from the patched area 5200H-5211H).

Member 27: PURGE (5200H)

PURGE offers the files of one drive one at a time and removes those the user answers Y to. The code reads PURGE :d (MPW="password"): an optional colon and drive digit (drive 0 by default), then the parameter list with the one parameter MPW. It refuses to run while a chain of commands runs (430FH bit 5), tests the drive (44B8H), takes the master password from MPW or asks MASTER PASSWORD ? (8 characters, padded with spaces), hashes it through SYS2/SYS (request E4H) and compares the code with the allocation table's +CEH-+CFH (or with C294H). It then reads the hash index (directory sector 1) into 5700H and walks all 256 entry codes in directory order, skipping codes 00H and 01H (BOOT/SYS and DIR/SYS), empty index bytes, free records and extension records; for each file it shows PURGE FILE: NAME/EXT ?, reads up to 3 characters, and on a first character Y removes the file through SYS10/SYS (442CH) with a control block it builds by hand (5457H), then shows the word PURGED between three asterisks on each side at the right of the line. At the end it shows a carriage return and goes to 402DH.

Points to note:

• A master password whose hash code is C294H passes on every diskette (5328H-532EH), whatever the diskette's master password is. Computed with SYS2/SYS's hash (511EH): the passwords KNAB, AQMW, NAOX, NPMH and ZLQB give C294H (checked against 8 spaces = 4296H, PASSWORD = 42E0H, RVEJARAJ = 29EBH).
• Typing all eight characters at MASTER PASSWORD ? leaves Register B = 00H at 537EH, so the pad loop 537FH-5382H runs 256 times and writes spaces over 5508H-5607H. It does no harm here: the allocation table is read into 5600H afterwards (5321H) and nothing else lives there; the password itself (5500H-5507H) is correct.
• The drive digit is not checked (5212H): any character after the colon minus 30H is the drive; SYS0/SYS's table lookup uses only bits 2-0 (C AND 7), so :9 works on drive 1, and 5320H keeps the unmasked value for the control block +06H.
• Every failure of the drive test is reported as ILLEGAL DRIVE NUMBER (521EH) and every failure of the hash index read as HIT READ ERROR (5245H), whatever the real error was. The write protect flag (C FLAG) 44B8H returns is not tested; a write protected diskette fails only at the first purge, with SYS10/SYS's error.
• PURGE offers every file but BOOT/SYS and DIR/SYS (entry codes 00H and 01H, 5266H-5269H), including the system files SYS0-SYS10 and SYS6/SYS itself, and invisible files: no attribute bit is tested except bit 4 (in use) and bit 7 (extension record). The file is removed with access level 1, so its own passwords are not asked.
• Only the first character of the answer counts and only a capital Y purges (52E1H); BREAK at the question (the C FLAG of ROM 0040H) is not tested and counts as whatever is in 541AH.
• 52CFH PUSH HL / 52E3H POP HL keep 5441H across the question for nothing: the value is not used afterwards.
• The routine 5346H ends with RST 28H (request E4H) in place of a CALL and RET: the request handler drops the RST's return address, so SYS2/SYS's hash routine returns straight to 531EH.
• The MPW text is cut at 0DH, a comma or a quotation mark (5356H-5360H); MPW given with no value stores FFFFH and up to eight bytes from FFFFH (FFFFH, then the ROM from 0000H) are taken as the password; MPW=n (a number) takes the bytes at address n.
• Manual (user manual): "PURGE :D [(MPW=mpw)] ... All files (except BOOT and DIR) will be listed one at a time, and the user can respond with either 'Y' to purge the file, or 'N' (or <enter> to leave the file intact." The bytes agree; any answer but a first Y keeps the file. The addendum: "All MPW specifications should be in quotes": the bytes need them, since an unquoted letter value is a flag to 510FH (PARAMETER ERROR or 0000H/FFFFH).
• The distributor's manual patch SYS6B ("A MANDATORY PATCH THAT FIXES THE PURGE/CMD", D35,DF=10 and D35,EB=04) is in the bytes: the operands of JR Z,52C6H at 52B5H and 52C1H (the end of the extension text).

Member 28: XFER (5200H)

XFER <filespec> copies one file from a source diskette to a destination diskette in the same drive, prompting for the source, destination and (for drive 0) system diskettes, so neither data diskette needs the system on it. The code parses one file specification with SYS1/SYS (441CH) into the source control block at 54CEH, copies it to the destination control block at 54EEH (same name, extension, password and drive), and takes the drive from the digit after a colon (drive 0 when none). It recognises each diskette by bytes CEH-DFH of its allocation table (master password hash, name, date), refuses when source and destination have the same 18 bytes, opens the source (4424H) and opens or creates the destination (4420H) with 256 byte records, then moves the file in passes: sectors are read straight into pages 5600H up to the page below the top of memory (4049H), then written from the same pages. SYS2/SYS, SYS8/SYS and SYS3/SYS are loaded in advance from drive 0 with function 0 requests (84H, 8AH, 85H) so no overlay load happens while a data diskette is in drive 0. At the end the source's end of file offset is copied to the destination and the destination is closed.

Points to note:

• 52F0H-530DH (30 bytes) is dead code: nothing branches to 52F0H (the JR 52EEH before it always jumps, and no pushed or stored address 52F0H exists in the member). It is the ending of 530EH without the copy of the end of file offset (5311H-5316H).
• Bug with a drive other than 0: when the source ends exactly at the start of a pass (an empty source file, or a file whose sector count is a multiple of the buffer's pages), 5333H returns at once (Register H = 56H) without asking for the destination diskette, and 5321H asks for it only for drive 0. The close at 5327H then runs with the source diskette in the drive, and SYS3/SYS reads and rewrites the directory record of the destination's entry code on that diskette (and may give back granules from it). With drive 0 the prompts at 5317H/5321H avoid this.
• The diskette checks after the first ones (5364H, 5381H) ignore the read result of 53DDH; a failed read just makes the compare fail and the prompt come again. 5357H never checks that the system diskette is the one put in.
• Two diskettes whose allocation table bytes CEH-DFH (master password hash, name, date) are equal are taken for one diskette: XFER refuses with SOURCE AND DESTINATION DISKS ARE THE SAME even when they are different physical diskettes with the same name, date and master password.
• The destination control block is a copy of the source's specification, so the destination file has the same name, extension and password; when it is created, SYS2/SYS stores the code of that password as both passwords of the new record and the record length byte of the new record is 00H (256) whatever the source's was (B = 00H at the open, 51FDH). Attributes of the source (protection level, other password, LRL) are not copied. Only the end of file offset and the FCB record length byte (both from the source control block, +08H-+09H) are copied at 5311H-5316H.
• The drive digit is taken as character - 30H with no check (522EH-5231H). Without a drive in the specification XFER checks diskettes on drive 0, but the open and create in SYS2/SYS are given the specification without a drive and so are not limited to drive 0 (SYS2/SYS searches the drives; create takes the first ready, not write protected drive).
• Only one file specification is read. The Addendum's one drive example "XFER BASIC/CMD.BASIC:0 :0" has a second ":0" that the code never reads; the manual's syntax "XFER <filespec>" matches the code.
• The manual says XFER "will transfer a file from one diskette to another without requiring a VTOS system present on either of the two data disks"; the bytes do this by loading SYS2/SYS, SYS8/SYS and SYS3/SYS from the system diskette in advance (5241H, 52B2H, 531AH) and asking for the system diskette before each exit, all only when the drive is 0.
• The 4.0.2 manual's patch "Fixes obscure bugs in the commands COPY and XFER. D1E,EE=24 / D38,4E=44": file offset 384EH is the byte at 52C9H, the offset of JR Z,530EH at 52C8H, and it is 44H in this file, so the XFER part of the patch is in the bytes (the value before the patch is not known from this file).
• The source file is never closed (it is only read). No check is made that the transfer buffer has at least one page: with a top of memory of 56FFH or below (page limit 56H or lower) the page loops would run past the limit; not reachable on a normal system.
• The prompt routine 53A7H waits for the ENTER key to be released first, tests it 4000H times with the prompt shown, erases the line (1EH) and waits with the ROM's 0060H (BC = 3333H): the prompt blinks. Any key ends 0049H, but only ENTER (row 6 bit 0 at 3840H) leads there.

Member 29: LOAD, RUN (5200H)

LOAD filespec (X) loads a program file into memory without running it and returns to VTOS READY; RUN filespec (X) loads it and jumps to its transfer address. Both copy the file specification into the control block at 52D2H (441CH), refuse a missing or bad specification or a device name (asterisk first) with FILE SPEC REQUIRED, add the default extension CMD (4473H) and read the parameter list with the single parameter X (4476H; its word is the operand at 5239H-523AH); a bad list gives PARAMETER ERROR. Request 84H then brings SYS2/SYS into the overlay area. With X the member shows INSERT SOURCE DISK (ENTER), blinking until ENTER, before the load, and INSERT SYSTEM DISK (ENTER) after it. The program is loaded with 4430H (SYS0/SYS's loader, not 4433H) by the code at 52F2H-5307H, which the patch SYS6C2 (07H record and four load blocks) adds.

Points to note:

• The patch SYS6C2: the file's member 29 has, after its 04H record and the first load block 5200H-52D1H, a 07H record "SYS6C2" and four load blocks 52F2H-52FFH (14 bytes), 5300H-5307H (8), 5308H-5323H (28) and 5323H-5324H (2). The member's own block ends at 52D1H and 52D2H-52F1H is the control block (not loaded), so every patch byte goes where the member loaded nothing before: the patch adds code and the text, it replaces nothing of the member. 5323H is loaded twice: the third block's last byte puts 20H (a space) there, and the fourth block, loaded after it, writes 1DH over it (file offsets 3B79H = 20H, 3B7EH = 1DH). The distributor's notes ("THE VTOS CHRONICLES", SYS6C2/FIX by Roy Soltoff) give the same four zaps: X'52F2'=CD 30 44 3A 39 52 B7 21 06 53 C2 45 52 C9, X'5300'=CD 30 44 E5 18 EF 1D 1E, X'5308'="INSERT SYSTEM DISK (ENTER)", X'5323'=1D 03 (the bytes have two spaces before "(ENTER)" and a space after it: 28 bytes in the block, the 28th at 5323H is the space that X'5323'=1D 03 then overwrites).
• The jumps into the patch code (JP 52F2H at 520AH, JP 5300H at 5213H) are bytes of the member's own first block. The notes list them as the earlier in place patch SYS6C1 (D3A,66=2D 40 -> 5204H; D3A,6D=F2 52 -> 520BH; D3A,76=00 53 -> 5214H; D3A,84=28 4E 35 -> 5222H-5224H; D3A,8D=E1 11 C6 52 CD 76 44 20 47 -> 522BH-5233H). The file holds no earlier form of these bytes, so what LOAD and RUN did before the patches cannot be read from it. The notes' third byte 35 for D3A,84 differs from the file, which has E5 (PUSH HL) at 5224H; E5 is the byte the code needs (POP HL at 522BH).
• The patched code does not test the result of 4430H (52F5H overwrites Register A and the flags at once). LOAD of a missing or bad program shows nothing and goes to VTOS READY; RUN of one RETurns to whatever Register Pair HL held after the failed load, and starts executing there.
• RUN loads with 4430H and RETs to the program itself: 430FH bit 2 (program being loaded to run) is not set, and DEBUG (430FH bit 7) does not get the start, unlike SYS0/SYS's 4433H.
• The source prompt tests both bytes of the X word, the system prompt only its low byte: X=256 (0100H) gives the first prompt but not the second. X=N or X=0 gives neither.
• Request 84H (526FH) is issued with or without X: SYS2/SYS is always read in before the load; the handler drops RST 28H's return address, so 5272H after the RST 28H is reached only from 521CH/5222H.
• The prompts blink: shown, then 4000H polls of ENTER, then the line is erased and ROM 0060H waits 3333H counts, and again; ENTER must first be let go (5248H-524CH). The keyboard is read straight from 3840H, not through the keyboard driver.
• The manual (LOAD, RUN): "You will be prompted for the appropriate disk insertions if the 'X' option is specified" and the default extension is CMD: the bytes agree; the manual says nothing of the missing error reports.

The work cells, tables, messages, self-modified operands and the memory outside the file that each member uses, then the system memory and routines below 5200H the members use.

Member 1 (AUTO)

Member 2 (DATE, TIME)

Member 3 (ALLOC)

Member 4 (KILL)

Member 5 (LIB)

Member 6 (DEBUG, CLOCK, TRACE, VERIFY)

Member 7 (O!)

Member 8 (MEMORY)

Member 9 (SYSGEN (requested by SYSTEM))

Member 10 (DIR)

Member 11 (FREE)

Member 12 (CHAIN)

Member 13 (SYSTEM)

Member 14 (SPOOL)

Member 15 (APPEND, COPY)

Member 16 (BUILD)

Member 17 (LIST, PRINT)

Member 18 (ATTRIB)

Member 19 (PROT)

Member 20 (RENAME)

Member 21 (DEVICE)

Member 22 (LINK)

Member 23 (RESET)

Member 24 (ROUTE)

Member 25 (FILTER, SET)

Member 26 (DUMP)

Member 27 (PURGE)

Member 28 (XFER)

Member 29 (LOAD, RUN)

Memory and Routines Outside the Members