• Please review our updated Terms and Rules here

Five Undocumented Tektronix 4052A/4054A CALL instructions discovered

nikola-wan

nikola-wan

Veteran Member
Joined
Mar 7, 2018
Messages
1,304
Location
Texas, USA
As I was working on the Tektronix 4052R14 GPIB Enhancement ROM Pack powerup "incompatible" message, I discovered the 4052A/4054A ROMs contain five undocumented CALLs!

These calls are located in the 16KB BASIC ROMs at address 0000-3FFF hex.

The 4052 and 4054 have 64KB of BASIC ROM located in the ROM Data Space B and an additional 8KB of CONSTANTS ROM located at E000-FFFF (minus the top 256 bytes of I/O space) in the RAM Data Space A which also provides up to 56KB of RAM for programs and data.

Here is a screenshot of the HxD program decoding the 000-0220 hex part of the ROM Data Space B:

The 4052/4054 16K bytes of ROM from 0000-3FFF hex is the bank-switch ROM area which can be replaced by any of the backpack Option ROM Packs based upon a CALL to a routine in that Option ROM Pack.

Each 4052/4054 ROM Pack contains several important data items at the beginning which are used by the BASIC ROM to detect Option ROM Packs at powerup, initialize the ROM Packs and record the Option ROM CALL names:
  1. Detect Option ROM: Bank switch a potential Option ROM into ROM space. If address offset 0010 and 0011 contained hex 4052 then store the bank switch location for this Option ROM for use with all the detected CALLs below.
  2. Record the Option ROM CALL names: Record the six character CALL names found starting at offset 001D, followed by their two-byte hex word starting address until hex byte 00 indicates end of CALL name table.
  3. Record the Option ROM common functions: POWERINGUP, INITIALIZE, DELETING_ALL, CLOSE_FILE (from Michael D. Cranford 4051 ROM Notes) hex 16-bit words starting at offset 0012 until hex 00 indicates end of common function table.
You can see in the HxD dump below the hex 4052 at offset 0010 which identifies a 4052/4054 option ROM, and also the table of CALL names beginning with "BITAND" with the code starting at address 0E8A hex.

Each CALL name can contain up to six ASCII characters - and CALL names shorter than six characters file the remaining characters with a space. The next two bytes contain the hex starting address for that CALL.

1690146131351.png

Undocumented CALLs were not published in the Tektronix 4050 Programmers Manual.

However the Tektronix Tekniques Winter 1982 Vol 6 No4 newsletter introduced a 4052A/4054A Assembler program on Tekniques Vol6 No4 Tape T1 which I have posted on my Tektronix 4050 Program repository:
Tekniques Vol6 No4 Tape1

The description in the newsletter reported CALL "EXEC" and when I read the 4052A/4054A assembler documentation they explained the underlined E in the CALL is typed as Ctrl-E.

If you look at the highlighted bytes in the HxD screenshot it begins with hex 05 58 45 43 20 20 and the ASCII decode on the right shows ".XEC ". The byte 05 hex is ASCII ENQ control character which can be typed in Tek 4050 BASIC as Ctrl-E! So the subsequent two bytes: 18FA indicate the start address of the CALL "EXEC" routine is at 18FA hex!

The table of Option ROM CALLs is terminated by byte 00. I noticed six more CALLs followed CALL "EXEC" - all of them starting with a control character:

Here is my table of those CALL names and their corresponding addresses - including CALL "EXEC":

Code: 
<Ctrl E>XEC                   18FA
<Ctrl C>L<Ctrl I>S<Ctrl T>    0B88
<Ctrl V>L<Ctrl I>S<Ctrl T>    0C86
<Ctrl L>XL                    12F8
<Ctrl L>XA                    142D
<Ctrl A>XA                    1578
<Ctrl N>TA                    16EF
<Ctrl N>TL                    17AC

Using an underlined character for the control character - here are the undocumented CALLs:

CALL "EXEC" jumps to 4052A/4054A assembly code
CALL "CLIST" displays all the detected ROM CALLs including Option ROM Packs
CALL "VLIST" displays all the BASIC variables currently defined or dimensioned and their values
CALL "LXL"
CALL "LXA"
CALL "AXA"
CALL "NTA"
CALL "NTL"

Tektronix Tekniques Fall 1983 Vol 7 No 3 page 35 in the Programming Tips section had a note about "4050A Commands Aid Program Development" and detailed the CALL "CLIST" and CALL "VLIST" commands.

I have never seen any documentation on the remaining five commands - but I suspect they are for debug. It would be great if they were for assembly language debug :biggrin:

By the way - I found CALL "EXEC" in the 4052/4054 ROM files posted here 4052 Firmware v5.1 (wow).

That call doesn't work on my 4052 - maybe I need to check my ROMs against the ROMs posted above.
 

Attachments

  • 1690146054322.png
    1690146054322.png
    130 KB · Views: 3
Last edited:
I searched for a Tekniques article containing "AXA" and found all five undocumented 4052A/4054A Graphics commands in Vol 7 No 4, with example programs:
  1. CALL "NTA" - Line normal to an arc
  2. CALL "NTL" - Line normal to a second line
  3. CALL "LXL" - Intersection of two lines
  4. CALL "AXL" - Intersection of an arc and a line
  5. CALL "AXA" - Intersection of two arcs

1690330511471.png
 
I typed in the Tektronix Tekniques newsletter article above with program listing on these undocumented graphics commands - however when I ran this program on my Tektronix 4054A vector graphics computer I realized the program is not a standalone demo of these commands - it is an interactive demo. It requires use of either a optional Tektronix 4952 joystick, optional Tektronix 4953/4954/4957 digitizing tablet or Tektronix 4054 graphics cursor thumbwheels to operate the Tek 4050 BASIC POINTER command!

My edits to the program were to add a Title on each page with a menu list of each of the five commands. I also added a comment on each selected command for how many POINTER command inputs were required and the note that simply pressing the RETURN key would return to the main menu.

Here is the screenshot running the program - selecting Line INTERSECT Arc. Note the orange graphical cursor crosshair lines. I have drawn several lines that are persistent green that intersect the circle - and one line that does not. The BASIC POINTER command requires a key be pressed to input the current graphics coordinates to be returned to the program. The program first examines the string that was returned and if NULL will return to the main menu. The line intersections with the arc have been marked by the program with "X". I am working on a video showing this program and running all five of the undocumented graphics command demonstrations.

1690720362718.png

In the original 4054 the cursor crosshair lines were drawn at a lower intensity green. My 4054A includes the Option 31 Color Dynamic Graphics CRT which mixes short persistence RED phosphor with the long persistence GREEN phosphor. For lower intensity refresh graphics like the crosshair cursor - the lines illuminate both RED and GREEN creating an "orange" line which is continuously redrawn by the BASIC ROM allowing the graphical input from the joystick, digitizer tablet or graphical cursor thumbwheels to move the graphical cursor around the screen without storing those lines.

Note that one of the lines stops inside the circle but the program shows two intersections - predicting the second intersection with the circle.

I have attached my edited program as a zip file.

Tek 4050 BASIC makes heavy use of control characters for PRINT statements. The undocumented commands include control characters.
When you list the BASIC program on the computer - control characters are represented by underlined ASCII text characters. Subtracting 64 decimal from the decimal value of the underlined ASCII character will give the decimal value of the control character.

I use Notepad++ to create and edit Tektronix 4050 BASIC programs. Control characters in those programs is entered into Notepad++ by holding down the ALT key and typing the decimal value of the control character. I always set the Notepad++ View | Show Symbol setting to Show All Characters when I'm editing 4050 BASIC programs so I can see the control characters in the program. In addition - you see the CR at the end of each line. Tek 4050 BASIC uses LF characters in PRINT statements - so you must ensure that the BASIC program you are editing does NOT have CR/LF at the end of each line - only CR. I use Notepad++ to search and replace CR/LF with CR if I'm porting a BASIC program to Tek 4050 BASIC from another language.
 

Attachments

  • Tektronix_4054A_Undocumented_Graphics.zip
    1.3 KB · Views: 0
Last edited:
Monty:

I was reading the 4052 Assembler documentation you posted to GitHub, and was intrigued by the details of the stack parameters discussed on Page 3 for the EXEC call.

This level of information is not found in the 4051 Assembler document, but from my inspections of memory using DDT, it appears that the EXEC function there uses a similar method of passing parameters.

My question is where to find further details on the following data types used in the parameter call(s):

Item Types:

VALTG
PNTSTG
PNTNTG
PLOSTG
PAETG
SEMITG

Is there a document somewhere that covers these Item Types?


Regards,



Nelson
 
Vermithrax said:
Monty:

I was reading the 4052 Assembler documentation you posted to GitHub, and was intrigued by the details of the stack parameters discussed on Page 3 for the EXEC call.

This level of information is not found in the 4051 Assembler document, but from my inspections of memory using DDT, it appears that the EXEC function there uses a similar method of passing parameters.

My question is where to find further details on the following data types used in the parameter call(s):

Item Types:

VALTG
PNTSTG
PNTNTG
PLOSTG
PAETG
SEMITG

Is there a document somewhere that covers these Item Types?


Regards,



Nelson
Click to expand...
I don't know.

Did you check out my google translation of this German doc I found on CALL "EXEC"?
https://github.com/mmcgraw74/Tektronix-4051-4052-4054-Program-Files/blob/master/4051-Assembler/Call%20Exec_my_English_translation.txt

or this doc from Michael D Cranford (author of Fast Graphics ROM Pack) in the same 4051 assembler folder?
https://github.com/mmcgraw74/Tektronix-4051-4052-4054-Program-Files/blob/master/4051-Assembler/4051%20assembly%20code%20documentation.pdf
 
Monty:

Thanks, I had seen the CALL "EXEC" document before, and I was hoping that additional details on the 4054 assembly language calls and data types would shed some light on how parameters are passed in the 4051 version. When I invoke CALL "DEBUG" on a 4051 emulation, I see some interesting stack manipulation that I am hoping is similar.

I may have to use the CALL "EXEC" document and experiment with how known variables are passed to the assembly language program on the stack since the documents are focused on how to call the assembly program.

In my wandering through the 4051 ROMs, I did notice an error in the 4051 Assembly documentation -

This line:

; .EQU 0H0045B ; SELF MODIFYING CODE, JUMP TO ADDRESS [A,X]

Should read:

; .EQU 0H0045D ; SELF MODIFYING CODE, JUMP TO ADDRESS [A,X]

Regards,


Nelson
 
You must log in or register to reply here.
Back
Top