• Please review our updated Terms and Rules here

My first attempt at Tektronix 4052 vector graphics computer R14 GPIB Enhancement ROM Pack disassembly

nikola-wan

Veteran Member
Joined
Mar 7, 2018
Messages
1,348
Location
Texas, USA
@GanjaTron encountered an error message from the Tektronix 4052R14 GPIB Enhancement ROM Pack when he tested @jdreesen 4052/4052 Multifunction ROM Pack on his Tektronix 4052 computer: https://forum.vcfed.org/index.php?threads/tektronix-4052-4054-multifunction-modules-available.76192/post-1326954

I had supplied the binary image files from my 4052R14 ROM Pack - and I had the same error on my 4052. My suspicion is this ROM Pack was introduced with the 4052 in 1979 and the BASIC ROMs in mine and @GanjaTron 4052 are several years newer version 5.1 BASIC ROMs - so possibly this R14 ROM Pack is showing the error message based on comparison with a previous 4052 BASIC ROM version.

I decided to try disassembly of the part of the R14 ROM Pack code that is called during powerup.
 
@GanjaTron encountered an error message from the Tektronix 4052R14 GPIB Enhancement ROM Pack when he tested @jdreesen 4052/4052 Multifunction ROM Pack on his Tektronix 4052 computer: https://forum.vcfed.org/index.php?threads/tektronix-4052-4054-multifunction-modules-available.76192/post-1326954

I had supplied the binary image files from my 4052R14 ROM Pack - and I had the same error on my 4052. My suspicion is this ROM Pack was introduced with the 4052 in 1979 and the BASIC ROMs in mine and @GanjaTron 4052 are several years newer version 5.1 BASIC ROMs - so possibly this R14 ROM Pack is showing the error message based on comparison with a previous 4052 BASIC ROM version.

I decided to try disassembly of the part of the R14 ROM Pack code that is called during powerup to see if I could modify the code to eliminate the error message. As I indicated to @GanjaTron in the thread above - this error message is benign and this ROM Pack works fine in the 4052 computers we (and @jdreesen) all have.

All the 4052/4054 ROM Packs use 2732 4KB EPROMs which are scanned by the BASIC ROM immediately during powerup and this scan checks compatibility for the original 4052/4054 microcode and BASIC ROM or the 4052A/4054A different microcode and different BASIC ROM entry points. Many of these "4052" ROM Packs are compatible with both original and "A-series", but some are specifically marked on the label as "A-Series". In the case of the 4052R14 GPIB Enhancement ROM Pack there are two different versions: 4052R14 and 4052R14-1A.

All ROM Packs for the Tektronix 4051, 4052/4054 and 4052A/4054A vector graphics computers are bank-switched into the ROM space of the computer. The 4051 uses a Motorola 6800 CPU which only supports a 64KB memory space with up to 32KB of DRAM in low memory and 32KB of ROM in high memory. 4051 ROM Packs are limited to 8KB and are bank switched into the lowest 8KB of the 32KB ROM space.

The 4052/4054 and 4052A/4054A computers have custom Tektronix designed bit-slice CPUs that emulate the 6800 instructions at a 3x faster clock speed and include a 16-bit address and data bus with up to 64KB of DRAM and 64KB of BASIC ROM. Their custom bit-slice CPU also provided sixteen 16-bit registers and many new opcodes including floating point and graphics operations to speed up vector drawing speed compared to the original 4051 - see this recent vintagetek.org video: Tektronix 4052 Development and Speed Comparison to 4051

The 4052/4054 ROM Packs contained up to 16KB of code in up to four 2732 EPROMs that were bank switched at address 0000 of the 64KB ROM space.

The 4052/4054 BASIC ROM would detect each possible option ROM by bank switching one of four ROM slots in the back of the computer into the 0000 ROM space and examining bytes 0010 and 0011 for hex bytes "40" and "52" - if those bytes were not returned - then the BASIC ROM would continue the scan at a different location. Since Tektronix and other companies like TransEra created more than eight option ROM packs for the 4052/4054 computers - Tektronix developed an eight slot 4050E01 ROM Expander that plugged into a single option ROM slot and provided additional bank switch bits to select up to eight ROM packs in a single slot. Multiple ROM Expanders could be plugged into the two or four slot backpacks in the original 4051 or the newer 4052/4054 computers - although the ROM Packs for the 4051 were incompatible with 4052/4054 backpack slots and vice-versa. The 4050E01 ROM Expander supported both 4051 and 4052/4054 computers with special hardware that immediately detected the system type at power on and provided the appropriate bank switch address spaces based on the detected system type.

In the screenshot below I used HxD to edit the R14 U1 4KB ROM binary image I have posted on my github repo here:
4052R14 U1 ROM binary file

The BASIC ROM would not only scan each of the two or four backpack ROM slots - but also could detect that a 4050E01 ROM Expander was plugged into one of those backpack ROM slots and would scan all eight slots in the ROM Expander.

Here are four steps I believe the BASIC ROM would perform during the scan for Option ROM Packs:
  1. Detect Option ROM: Bank switch a potential Option ROM into ROM space. If address offset 0010 and 0011 contained hex 4052 then store the bank switch location for this Option ROM for use with all the detected CALLs below.
  2. Record the Option ROM CALL names: Record the six character CALL names found starting at offset 001D, followed by their two-byte hex word starting address until hex byte 00 indicates end of CALL name table.
  3. Record the Option ROM common functions: POWERINGUP, INITIALIZE, DELETING_ALL, CLOSE_FILE (from Michael D. Cranford 4051 ROM Notes) hex 16-bit words starting at offset 0012 until hex 00 indicates end of common function table.
I believe from my experiments that if the BASIC ROM has already recorded an Option ROM CALL name - then that duplicate Option ROM is ignored and the BASIC ROM continues detecting the next possible Option ROM bank address.

4052R14 ROM1 hxd.png

I see the not compatible error message starting at offset 01EE. The offending code is likely the POWERUP common code at offset 01A6.

I know the 4052/4054 microcode is a superset of 6800 opcodes - so I decide to try to disassemble code from 01A6 to 01ED.

Not having done this in many years - I decide to try the Tektronix 4051 DDT program which was included with the 4051 Enhanced BASIC ROM Pack which I added to the Latest 4051 Emulator with Flash Drive Support

Download this emulator and run the jsTEKTRONIX4051_universal.html file in Chrome web browser.

Press the Start button (I then press the Mute button too).

Press the Auto Number button and type in this program to access the 4051 "DEBUG" (DDT) program.
Press Auto Number after entering the program and type RUN:

Code:
100 INIT
110 PAGE
120 DIM A$(5632)
130 CALL "DEBUG",A$

4051 Emulator DDT program.png

The DDT commands are documented here: 4051 Assembler documentation

I used these commands to enter three hex bytes at a time starting at offset 21A6:
(2000 is filled with 00's and ready for your assembly program. Don't forget to type the " in front of the hex on the subsequent lines)

Code:
21A6;"7DE1C6
"270B8D
etc until
"0C0A0A

Then I displayed the hex bytes I manually entered with this command:
(DDT commands are hex, so M=21A0, N=C means dump 12 lines of 16 hex bytes plus ASCII beginning at memory location 21A0)
Code:
21A0;CQ

R14 init manually entered into DDT offset 2000.png

Then I typed the following command to try to 6800 disassemble the 4052 code starting at 21A6: (the N=22 may not be right, I paged the screen before running the command to get all the code on one screen)
Code:
21A6;22/


R14 init disassembly with 4051 DDT.png
The first instruction is a TST of ROM location E1C6 (I would have to figure out which 4052 v5.1 ROM has this address to see the data).

This looks like proper 6800 instructions except for opcode 21 at 21BD and 21C7 and opcode 18 at 21C1.

Fortunately we have the complete 4052/4054 with 4052A/4054A opcode additions in this doc: 4052A Assembler documentation

Page 42 in that doc shows 4052 opcode 21 is SDB "Set Data Space to B" and page 41 shows 4052 opcode 18 is SDA "Set Data Space to A"

The 4052/4054 architecture has all 64KB of RAM in DATA space which is A (see SFA opcode description on page 42).
The ROM space is B.

Option ROMs run in space B, but may need to access data in RAM space A - which will require use of the SFA instruction.

The SFB instruction would then change the data access to space B - the ROM space.

There is a small amount of ROM at the top of the data space with the Boot and interrupt vectors and the COMMON ROM which limits user RAM space to 56KB out of the Data space A.

As further background - pdf page 2 discusses how a user assembly program would access ROM CALLs through an SWI to the ROM CALL entry point to create a JSR-to-ROM with the return back to the user program running in the Data space A - with a couple of simple examples on pages 4, 7 and 9.

That is as far as I've investigated so far.

I need to know what is in the 4052 ROM version 5.1 at E1C6.

I've glanced at the 4052R14-1A ROM which is the one I use in my 4054A - but it is quite different code and I don't get a power up error, so I'm not sure looking at it will help much.
 
Last edited:
If you need to disassemble lots of 4052 code, then you could use my adaption of Bruce Tomlins universal disassembler. This includes all new 4052 opcodes. The zip-file (not .TXT !) is included below.
I used to to disassmble the Transera 764 RAM code, since that neede chanes for my auxMEM project.
 

Attachments

  • asm4052.txt
    52.9 KB · Views: 1
Brain fart....that was of course the assembler that I posted, not the disassembler....

Like you i used a 6800 disassembler ( fd9dasm in 6800 mode ) andf handcorrected the endresult. Which I then assembled again to do a binary compare with the original binary. Sorry for the misinformation !
 
Another potential solution to the assembler is the cross32 meta-assembler.

This is a table-driven assembler where the instruction sets are available in plain text that you can modify.

This meta-assembler covers a large range of 8 and 16 bit micros; but taking the M6800 table and adding the Tektronix 4052 instruction extensions to it should be straightforward.

Of course, this is a commercial piece of software to start with, so that may dissuade you...

Dave
 
I looked for Cross-32 and it looks like the datasynceng.com lost their domain name in May 2023. When you try that domain name you get cdadapter.com that used to sell Cross-32 but no longer has that webpage.
 
Back
Top