Model 4 ROM Explained – XDROM – Diagnostic Part

3800H – This would be the “D” in XDROM – The diagnostic mode.

The way this is set up, it disassembled to 3800H-, but when involked, it relocates all of this code to 3000H-. With this, the below will be use the 3000 numbering system, as the JUMPs will make no sense otherwise.

3000-3014 – Copyright Text

3015-3037 – Initialization of the routine. Set the STACK, reset the Model 4 controls and set to 4Mhz, and program the CRTC

These next instructions are to program the CRTC (15 bytes) and are setting up the variables for an OUTD command.

3039 – This is jumped to only via interrupt.

383CH – Display a “STATIC RAM BAD” message and then HALT the system.

3045 – This instruction is jumped to by 3091H. At this point, screen memory should be all 20H’s, so this routine is testing screen memory and then displays the on-screen menu.

3857H – MAIN MENU – This routine tests the keyboard for D, B, V, P, S and M keys, and jumps accordingly. Falls through to 3882H if those keys were not pressed.

3082H – This routine fills the screen with spaces, backwards.

3092H – Message Storage Area for initial messages.

3181H – MEMORY – Loop to keep testing memory location 31C1H until it is NOT a zero

3184H – Loop to keep testing the memory location pointed to by Register Pair HL until it is NOT a zero

If we are here, then the byte stored in the memory location pointed to by Register Pair HL was NOT zero.

31A3H – MEMORY – This routine is called twice in the prior routine, once at 318D and once at 319A

The next sets of instructions pick up the byte at 3840H, rotate it until a bit 0 is found, and then delay 256 x 10 cycles.

Once the delay loop ends, we pick up here to keep torturing that poor location.

31B7H – This table is moved to the CRT Controller Control Registers in the 33E9H if called from the DISKETTE TEST routine.

31C8H – MEMORY – This is the MEMORY TEST routine start.

31D5H – MEMORY – Start of the memory test.

If we are here, then we are going to move the RAM test to 8100H and JUMP to it there.

If the memory location pointed to by IX+00H into Register A was NOT zero then we have a problem, so we need to display the memory test failure messages and addresses.

Now we will point to the 15th character on Row 5, right after the “Failing Rows:” message, to populate 8 single number rows (7 to 0). The byte at Register Pair BC will be the binary representation of the rows which failed.

Start of a loop of 08 cycles.

3261H – MEMORY – Message Storage Area.

32B3H – MEMORY – An alternate way of entry to the memory test but with setting Lower 32K Ram in Bank 0 / Upper 32K RAM in Bank 2.

32B7H – MEMORY – What the memory test does, at least on the initial passes is to load up memory with 00H-FF, test it, decrement each memory location 1, test it, etc. So, for example, a row of RAM might have 43H-52H, and on the next pass, that row will have 42H-51H, and then 41H-50H.

If we are here, the screen locations 3C30H-3C35H have had 00H put into them.

32C4H – Write from 8000H and then read it back.

If we are here, 8000H and higher (HL) have been filled with numbers and BC (8000H and lower) hit zero.

If we are here, then BC hit 00H, as did HL.

32E7H – MEMORY – Restore HL and BC from the STACK

32E9H – Clear A, reset the TRS-80, RETurn (to 31EBH)

32EDH – MEMORY – This routine is JUMPed to from 32D8H if the 8000H readback failed. It put gibberish onto the screen based on the value of the failed read.

330CH – SHARED ROUTINE – This routine does 4 RRA’s to the character held in Register A, and then JUMPs to 3317H to do some SERIOUS byte manipulation on the character held in Register A, puts the manipulated character into (HL), Bumps HL, and JUMPs to 3317H to do that again before it RETurns.

3313H – SHARED ROUTINE – Do 4 RRA commands to move the bits around

3317H – SHARED ROUTINE – Take Register A, do some manipulation to turn a hex value into an ASCII character representing that hex value, and put the manipulated character into (HL), Bump HL, and RETURN

3322H – DISKETTE – This is the DISK TEST routine entry point.

3338H – DISKETTE – Continue with the DISKETTE Test. On Entry Register A is holding a number 0-3 matching the disk drive number selected for testing.

If we are here, we have hit track 40.

3356H – This routine will do the track test in reverse.

If we are here, we have hit track 0.

Start of a loop between here and 336DH to do even more testing, this time with wild swings … 00 then 39 then 01 then 38 …

3371H – DISKETTE – Display the 2 bytes comprising BC onto the screen at location IY. In specific, it loads the screen responses for CYLINDER and SECTOR, overwriting them as they update.

3383H is one of many interrupt jump points in this routine and is a VERY common one at that.

If we are here, there was an error, so we need to set up to display the error message on screen.

33B3H – DISKETTE – This routine will scroll the display by moving everything on the 3rd video line and later to the 2nd video line and later.

33C6H – DISKETTE – This is the exit routine for a 3371H call. STACK to BC, Bump C, Set A as C – 12H and, if A = 0, set C = 0. Return

33CEH – BOOT – This routine is CALLed from 3426H as an alternate entry to 33D0H but with the character in Register A being a SPACE.

33D0H – MULTIPLE USE ROUTINE – This routine fills Video Page 1 with the character held in Register A, swaps to Video Page 0, and fills that with the character held in Register A.

This code sets the Model III MISC controls (including the VIDEO PAGE SELECT), and fills the screen with the character held in Register A.

33E2H – This routine is a pass through as well as being called. It is called as a subroutine from the DISK scan after scrolling the screen and DE will be 3FC1 and HL will be 3F81.

33E9H – MEMORY – This routine is CALLed from 319DH to program the CRT Controller Registers, but to set HL at 3401H.

33ECH – This routine is CALLed from 3197H to program the CRT Controller Registers.

Top of a loop

33F8H – MEMORY – This table is moved to the CRT Controller Control Registers in the 33E9H if called from the MEMORY TEST page.

3408H – PRINTER – Main Menu Jump Point

Start of a loop.

If we are here, then Register A is now set to a character too high to print.

3419H – PRINTER – Keep polling the Printer Port (0F8H) until No Printer Fault and Device Select are returned. Register A is preserved.

Start of a loop.

3426H – BOOT – Main Menu Jump Point

3439H – SHARED ROUTINE (BOOT and DISKETTE). This is the jump point if there is a CRC ERROR, SEEK ERROR, or NOT READY from the FDC.

344FH – MEMORY – This routine is the jump point when a final, hard error, has been found, but with DISABLING the interrupts.

3453H – DISKETTE – This is the entry point for a routine to ultimately reset the FDC, set track number and density, get the FDC status, and error out if it is CRC ERROR, SEEK ERROR, or NOT READY. Otherwise, clear all flags and Register A, and RETURN.

345EH – SHARED ROUTINE – This routine is called to display one of the messages. When called from the DISKETTE test routine, for example, it displays “Cylinder Sector Drive:” + 00H. On entry from the DISKETTE test routine, BC and DE are 00, HL is 352DH, and A is 10H.

346AH – DISKETTE – This is a lookup table for Disk errors in 3482H

3482H – DISKETTE – Error Message Storage Area

3546H – DISKETTE – This routine decrements A, resets the floppy controller and waits, sets C to 01-08H based on the drive number selected before exiting to 355DH.

The next loop sets C=01 when the Disk Drive Selected (held in A) is 0, C=02 when the drive 1, C=04 when the drive is drive 2, and C=08 when the drive is drive 3 and then exits to 355DH.

355DH – DISKETTE – We’re here when Z is set from the loop in the above routine and C is now 01, 02, 04, or 08 based on the disk drive selected.

3585H – DISKETTE – This routine is called when we need to fail out of the DISKETTE test routine. A specified value is put into Register A, the flags are set, and then we RETurn out of the call.

3588H – DISKETTE – Routine is jumped to from 3568H if Register A (which was Register B) is >= 05H. I have no idea when this occurs; I couldn’t trigger it. FWIW, bot Dh and E point to the track number to test.

If we are here, then Register A was 32H.

This is the start of a DJNZ loop for a count of 4.

Begin a loop.

35AFH – DISKETTE – This routine is JUMPED to by 358AH if Register A did not equal 32H. On Entry E holds the track number to test.

If we are here, then EITHER the FDC track register equalled E (and 35B2 jumped here) OR we told the FDC to go to track E and didn’t get any errors, so we are where we need to be on the diskette.

35C6H – DISKETTE – Alternate entry point to the disk test continuation routine EXCEPT that the contents of Register D (the response from the FDC that spat out an error) are preserved into Register B.

35C7H – DISKETTE – If the selected floppy drive is not returning BUSY and NOT READY, we wind up here to continue the test. Set D to 08H and then JUMP to 35D3H to test for SEEK ERROR, CRC ERROR, and NOT READY and jump out if they are found; return with A=0 and clear flags if OK.

35CBH – DISKETTE – This routine is jumped to from 3636H. It tests Bit 2 of the FDC Status and proceeds with D=0AH if that was high (and JUMP to 3585H) or 0BH if it was low (and PASS THROUGH to 35D3H).

35D3H – DISKETTE – This routine tests for SEEK ERROR, CRC ERROR, and NOT READY. If any are found, the error routine at 3585 is jumped to. Otherwise, Register A and the flags are reset, and we RETURN. On Entry Register B contains the response from the FDC and D has an error code.

35E5H – DISKETTE – This routine is jumped to from 35C54 if we are on the track that we want to test AND Register A is still holding 0CH.

If we are here, then we have reached Sector 18, so we need to check SIDE 1 of the disk …

35F9H – DISKETTE – This routine is JUMPed to from 35F1H if we have not yet hit Sector 18 on the track we are testing.

The variable shuffling that is about to happen is so that the INI command in 361EH is properly set. INI requires that the port be in Register C, the destination memory location in Register Pair HL, and the bytes to read in Register B.

The only register being modified from this point to the end of the routine is Register A. Everything else is now set up for the INI command in 361EH.

361EH – DISKETTE – This routine is JUMPed to from 3615H if we have found the INDEX mark after moving to the right track, sector, and side to test. It loads the buffer at 4300H with the sector values but is exited only by an interrupt.

Start of a loop of reading bytes into memory location HL, exited only via an interrupt.

3629H – DISKETTE – Put the value at the top of the STACK into Register Pair BC, Clear Register A and all flags, Disable the DRQ and INTRQ interrupts and then continue to 362DH

362DH – DISKETTE – If we are here, we are on the right drive, side, track, sector, and the INDEX just triggered!

3633H is one of many interrupt jump points in this routine.

3638H – DISKETTE – Execute a RETN

363AH – Reset the Floppy Drive Controller, Push BC, Set Register B as 00H, and JUMP to 3646H. B is unchanged from entry value.

3643H – DISKETTE – Delay (13H loops) to let the FDC process a command and RETurn

3646H – Delay REGISTER B loops, Restore BC from the top of the STACK, and RETurn

364AH – DISKETTE – Send the command held in Register A to the FDC and LOOP until anything other than “NOT READY” is returned by the FDC. Register A holds the response from the FDC on exit.

365CH – BOOT FROM RS-232 – Routine Entry Point.

Do a loop polling Port E8H, Masking against 00100000 to leave only Bit 5 on, and LOOPing back until Bit 5 is NOT ZERO.

At this point, we have a carrier detect.

3680H – This location is LOOPED back to from either 3699H, 36A0H or 36A4H.

3682H – This location is LOOPED back to from 3697H

If we are here, then we fetched a byte from the RS-232 into Register A.

3692H – This routine is passed through if the byte received from the RS-232 was not 55H -or- was jumped to from 368CH if the RS-232 threw an error.

If we are here, then the RS-232 spat out errors 10H times.

If we are here, then the RS-232 spat out errors 10H x 16 times.

369BH – BOOT FROM RS-232 – If we are here, then we received a 55H byte from the RS-232 at 3690H.

Start of a loop which exits if we get 55H from the RS-232 10 times.

If we are here then the RS-232 gave us a 55H with no errors.

If we are here then the RS-232 gave us TEN 55H’s with no errors, so proceed …

From what I can tell, if we are here, Register C is still holding FF as it was set in 3682H and DE is pointing the to screen location after the message. I can’t test because I cannot figure out how to get TRS80GP to fake RS-232 responses.

Start of a loop to keep getting bytes from the RS-232 until a FFH is received.

If we are here, we received a FFH from the RS-232, so display LOADING and continue on.

If we are here, then the load from RS-232 completed without error and HL contains the transfer address.

36D1H – BOOT FROM RS-232 – This routine puts a LOAD ERROR message along with a modified version of the error code received on the screen, and then restarts the BOOT FROM RS-232 routine again. This routine is JUMPed to from either 36BCH (if got the 55H’s ok, but were looking for FFH’s and got an error instead) or 36CEH (if we were already loading from the RS-232 but then got an error). When 36F1H exits with an error, A holds only the error bits returned by the RS-232 Controller (bits 3, 4, and 5).

36F1H – BOOT FROM RS-232 – This SUBROUTINE waits for DATA READY, and then either returns NZ with an error or fetches a byte from the RS-232 into Register A with the Z Flag set.

If we are here, then DATA READY was set and Register A holds the RS-232 Controller Status byte.

If we are here, then DATA READY was set and we have no errors from the RS-232 Controller.

36FDH – BOOT FROM RS-232 – This SUBROUTINE is called from a number of locations to display a message to both the screen AND the RS-232, and RETurn once sent. Only Registers A and HL are affected. Before entry HL and DE are specifically set for a message display:

• If called from 36AE, the message will be Found Baud Rate + 00H
• If called from 36C8, the message will be Loading… + 00H
• If called from 36DE, the message will be Load Error + 00H

This is the beginning of a loop. On Entry HL points to the first letter of the message which was displayed.

If we are here, then the RS-232 reported DATA SENT. For some reason, the next instructions take the message which was displayed at the beginning of the routine, and push them out the RS-232 port, RETurning once it is completely sent.

3710H – BOOT FROM RS-232 – Message Storage Area for RS-232 Test.

3721H – BOOT FROM RS-232 – This SUBROUTINE loads the boot routine from the RS-232 and sets HL with the transfer address. It is called from 36CBH. If an error occurs, NZ is set and Register A will hold the 3 error bits)

Start of a loop which encompasses this whole subroutine.

If we are here, the RS-232 gave us 02H. An 02H in an executable program signals that the TRANSFER ADDRESS is coming. It then has 3 bytes afterwards — the length of the block, then the LSB of the transfer address, and then the MSB of the transfer address.

3731 – This is both a pass through (if an 02H was received) and a a JUMP point from 3742H (if an 01H was received). In either case, the RS-232 is about to provide a load address in LSB, MSB order, so we need to capture that into Register HL.

If we are here, the RS-232 gave us 2 non-errors after giving us a 02H, and Register A holds the 2nd byte the RS-232 sent after the 02H or an 01H (if called from there), which is the LSB of the transfer address.

373BH – BOOT FROM RS-232 – Process the LOAD BLOCK. This routine is jumped to if we received a 01H byte from the RS-232. An 01H, when applied to a executable program, indicates a LOAD BLOCK.

If we’re here we have no error from the RS-232 and HL has the LOAD address. This is the start of a loop of B passes.

3750H – This routine is jumped to if we received anything other than a 01H or 02H from the RS-232

Start of a DJNZ loop of that number of bytes.

375C – I don’t see what jumps to this.

Start of a Loop

3765H – DISKETTE – This SUBROUTINE was called from 3380H to set Register A=1 and pass through

3767H – DISKETTE and BOOT – Set HL=4300, B=0CH, and JUMP to 3546 to decrement A, reset the floppy controller and waits, sets C to 01-08H based on the drive number selected before exiting to 355DH.

376FH and on … Just FF’s.

What went into this:

In order to do this page I needed to use a few tools:

• TRDL, to convert a ROM/BIN file to a CMD file, as diassemblers won’t disassemble a ROM/BIN file. The command line was trld file.rom file.cmd. Lawrence Kesteloot’s TRS80-TOOL can do this as well, effective as of v2.4.1, with trs80-tool convert –start 0x1000 in.rom out.cmd
• David Goben’s Model I/III/4 Disassembler v1.4. It is the only disassembler which seemed to give me everything needed, including NO labels, no errors in disassembling (XOR A,A), the hex and ASCII, uniform columns so I could manipulate them easily, etc.
• TRS80GP because David Goben’s disassembler produced unusable output when I tried it with saving source to disk, but produced wonderful output when sent to the printer; and TRS80GP allows you to save the printer output!.
• Microsoft Visual Basic 6. Had to write a program to parse the columns and to add HTML cross reference jumps for jumps. I also used my prior disassemblies to populate the comment field. A waste in terms of things like PUSH HL, but a godsend for jumps to code in ROM A and B, or explaining how the C and NC jumps work.
• TRS80GP’s amazing Z-80 Debugger.

and the following pages to help with the commenting:

• The Binary to Decimal to Hexadecimal Converter page athttps://www.mathsisfun.com/binary-decimal-hexadecimal-converter.html.
• The ASCII CODE TABLE page athttps://www.ascii-code.com/.
• The Hex Calculator Page athttps://www.calculator.net/hex-calculator.htm.
• The Z-80 Opcode page athttps://clrhome.org/table/.
• This sites very own RAM ADDRESS page at https://www.trs-80.com/wordpress/ram-addresses-and-routines/.
• This sites very own PORTS AND I/O DEVICES page at https://www.trs-80.com/wordpress/ports-and-i-o-devices/.
• This sites very own KEYBOARD MAP page at https://www.trs-80.com/wordpress/ports-and-i-o-devices/.
• A little program I wrote to try to figure out where the video accesses were …

10 CLS
20 INPUT Y
30 CLS
40 FORX=1 TO 7
50 PRINT "        10        20         30       40        50"
60 PRINT "12345689012345678901234567890123456789012345678901234567"
70 NEXT X
80 PRINT@0,Y;
90 POKE Y,88
100 IF INKEY$="" THEN 100