Top 10k strings from TECHINFO.DOC in <root> / bin / pc / Emulators / z80-305.zip /
Back to the directory listing
23
10
9 Offset Length Description
7 WRITE
5 -----------
5 Bit 7 6 5 4 3 2 1 0
3 ---------
3 Bit 7 6 5 4 3 2 1 0
2 following way:
2 AMX mouse interface.
2 READ
1 net output/
1 Sinclair ZX Spectrum Emulator 'Z80' v3.05 - 11/11/96 - by G.A. Lunter
1 5.9 The Z80 microprocessor
1 5.8 The AMX mouse interface
1 5.7 The Multiface 128
1 5.6 The SamRam
1 5.5 The Interface I
1 5.4 The ZX Printer
1 5.3 The AY-3-8912 sound chip.
1 5.2 The Spectrum 128K
1 5.10 File formats
1 5.1 The Spectrum 48K
1 5. TECHNICAL INFORMATION
1 turn on CMOS RAM (see also 6/7)
1 turn off CMOS RAM (standard Spec. ROM)
1 Writes to CMOS RAM allowed
1 Turn on beeper
1 Turn off beeper
1 Turn off IF 1 (IF1 rom won't be paged)
1 Switch on write protect of CMOS RAM
1 Select interface 1
1 Select CMOS bank 1 (Monitor,...)
1 Select CMOS bank 0 (Basic ROM)
1 Select 32K ram bank 1 (32768-65535)
1 Select 32K ram bank 0 (32768-65535)
1 Ignore all OUT's to 31 hereafter
1 Continue
1 Alternate
1 page no
1 address
1 rxdata
1 input
1 Border
1 zero to signal a version 2.01 (or later) snapshot file.
1 you want to disassemble, and let it run to the main starting point, so
1 wouldn't already cause either.
1 would refuse to load those.)
1 words, I have not tried to figure out whether the unofficial RET's are
1 word operand. The four opcodes CB, DD, ED and FD are 'shift' opcodes:
1 won't pause when you press 5,6,7,8 and 0 simultaneously.
1 with two bytes specifying how many bytes will follow (not counting the
1 with this split bus. After each instruction fetch cycle of the
1 with respect to the video is that the 128K ULA is more relaxed in
1 with it (when it is busy making the border left or right of the screen
1 with RECLEN=0.
1 with 'z80 -0m program.map program.z80'. Run it for a while, but be
1 will this work in full generality on the emulator.)
1 will give you control over the latches again. The write protect latch
1 who devised the format. This format is now also supported by XZX of
1 while. To keep all programs happy, and still have a fast emulator, I
1 which they appear in the table, i.e. the offset of a particular data
1 which the OUTs were executed.
1 which make a total of 69888 T states (70908 T states) per frame.
1 which is, at 3.5 MHz, very nearly 1/50th of a second.
1 where it was one. When there is a signal, this bit toggles
1 whenever it is >= R6. It is counted up at a frequency of 110830 Hz
1 when tracing. HALT instructions (118 decimal) are special in that they
1 when saving.
1 when saving, because of the altered behaviour of the -d switch.
1 wants to read of write the lower 16K, the ULA halts the processor if it
1 waiting for nothing.) The microdrive routines have not been modified
1 volume is given by the output of the envelope generator. The volume
1 video sync everything moves smoothly and doesn't flicker.
1 via OUT port #5F and #7F respectively:
1 very useful. The ED opcodes in the range 00-3F and 80-FF (except for
1 vertical retrace. This behaviour is actually used in some programs,
1 vertical retrace lines. The first screen byte is written to the screen
1 versions of the Interface I rom around, and program developers know
1 versions of Z80 prior to v3.04 did not change the flags, so that on old
1 versions (and on other emulators) loading will always seem to succeed.
1 version saves the pages in numerical order. There is no end marker.
1 variable area relative to the start of the program. If it's a Code
1 value of R1R0 (most significant bits are in R1), and is counted up at a
1 value of IFF2. Now IFF1 and IFF2 are usually equal (and become equal
1 using the ED FB opcode, and error handling.
1 uses the AF register to hold the return address of a subroutine for a
1 used it for debugging purposes, and it is also used in TAP2TAPE and
1 use the weird ones, I tried to figure them out and emulate them as best
1 use the same buffer area. HRC emulation still works, but destroys the
1 upon an interrupt request at least 1, and at most 1+23 T states after
1 up 5 T states. Then, in mode 0, any instruction that is placed on the
1 unusable block (as determined by the FORMAT command) is an EOF block
1 unit value corresponds to 1 T state (=1/3494400 s). After this, the
1 undocumented features. Some of these are quite useful, and some are
1 undergone some modifications, to speed up the RS232 input/output
1 two length bytes). Then raw tape data follows, including the flag and
1 two 2-bit mode registers (MODEA and MODEB), two 8-bit data registers
1 truly. It starts as an ordinary >= v2.01 .Z80 file. Directly
1 treated as part of an instruction, so that the Z80 cannot be interrupted
1 total length is 137923 bytes. On the cartridge tape, after a GAP of
1 took care of the refreshing of the lower 16K. (This example won't work
1 too. A zero on one of these lines selects a particular half-row of
1 tone generator changes it output from 0 to 1 or vice versa, so the
1 together, for example COPY /B FILE1.TAP + FILE2.TAP ALL.TAP
1 to, bits have the following meaning:
1 to the registers; no data is actually being moved, which explains why
1 to the amplitude registers take effect immediately.
1 to be regarded as separate instructions. So shifted instructions will
1 to be filled with 'snow'; however, the Spectrum won't crash, and
1 to any address with bit 15 and 1 zero; don't use this fact, though; it
1 to 4 T states.
1 to 1 produces a constant 1 as output. Also note that setting both Ta
1 time-consuming screen calculations as possible without causing
1 tick is increased by 1 until it reaches 15. If Attack = 0, the output
1 three bits of x determine which bit of this address corresponds to the
1 this. It is also a bit pointless to check whether the Interface I rom
1 this will be the byte FF, coincidentally (...) the opcode for RST #38.
1 this is the only mode that is emulated. The following discussion
1 they change the meaning of the opcode following them.
1 they cannot operate on IX or IY.
1 therefore timed as follows: 128 T states of screen, 24 T states of
1 therefore somewhat slower than the upper 32K block. This is also the
1 thereby making you miss the 8 pixels. This exception happens again
1 there. So the exact time in the 1/50 second time-slice at which the
1 then border again. All this takes 224 T states. Every half T state a
1 then IFF1 is off, and IFF2, holding the previous state of the interrupt
1 their name) or loading screens. The ".Z80"-file preceding the SLT must
1 the way, many DD or FD opcodes after each other will effectively be
1 the upper bit) act as a random generator.
1 the timing word; it has a value between 0 and 17471 inclusive (or
1 the timing won't be exact, and the music will sound harsh. Also,
1 the tape recorder does not change the polarity of the recorded signal!)
1 the status lines of the printer are not too reliable, so that a
1 the snapshot procedure, in order to get hold of this bit.) The
1 the sign flag in the BIT instruction isn't right. I quote:
1 the screen one pixel per frame on the whole screen. Very well done
1 the same way as the other IN instructions, however. The ED71
1 the rule are the highest 8 bits of the 16 bit result - that was to be
1 the processor seems to be halted for 64 T states. It is not clear to
1 the port controls a programmable latch chip (the 74LS259) which
1 the pixel address
1 the ordinary rom (48K or 128K) or the Interface 1, Disciple or Plus D
1 the mnemonic SLL, Shift Left Logical, shift left the operand and make
1 the law, the programs which use the processor's features do!
1 the latch. The 16 different possibilities are collected in the diagram
1 the interrupting device places on the data bus. The processor then
1 the instruction is executed as usual. However, if the instruction uses
1 the floating bus.
1 the flag byte. For example, when you execute the line SAVE "ROM" CODE
1 the emulator. Latch 4 pulls up the M1 output at the expansion port of
1 the emulator returns #81.
1 the chip actually). Note that even when a channel is disabled (say Ta
1 the block instructions of course) do nothing at all but taking up 8 T
1 the bits were arranged in a 128x128 matrix, and needed a 7 bit refresh
1 the bit and its corresponding register are present however. Reading
1 the address bus. The lowest 7 bits, the R register, are used for
1 the Z80 acts upon it), 63 video lines are written to the CRT. A first
1 the ULA; both the interrupt and the video signal are generated by it.
1 the ULA would display it. Also, the exact times the border colour is
1 the ULA won't stop, but nothing will put anything on the data bus.
1 the ULA reads the screen from page 5, otherwise it reads page 7. If
1 the ULA effectively flips the foreground and background colours.
1 the Spectrum. The Interface I won't page its ROM anymore then.
1 the RS232 input and output of the Interface I and several things of the
1 the MIC when the ear is written to; the emulator doesn't. This is no
1 the JR will jump to FFF4, where a long JP to the actual interrupt
1 the Interface I, you could put that code at the right place in the
1 the IM 2 interrupt routine, the border will change at exactly the
1 the H or L register, it will now use the high or low halves of the IX
1 the A register, and allow him to supply a .DAT file (or .Z80/.SLT file)
1 the 16K ROM which occupies the lowest part of the address space, and
1 that uses this to generate a nice effect: Vectron. (which has very
1 that the printer is attached. The printer motor is started by writing
1 that the PIO leaves the Z80 in peace for a few clock cycles after
1 that old .Z80 files used. Bit 4 and 5 of the flag byte (offset 12)
1 that by executing a whole lot of slow instructions in a block, it is
1 that all decoding, decompressing, and moving around has probably been
1 that after the ordinary data another section follows, containing things
1 terminate with the usual tape-loading-error flags set, leaving the
1 takes precedence, the Multiface routines are executed. In fact, it
1 table contain FF's (or use the ROM for this) and put a byte 18 hex, the
1 synchronisation, corresponding to a screen update after 1/200, 2/200 or
1 synchronisation the top four or five lines of the background move
1 swap itself into oblivion.
1 sure never to reset the Spectrum, or to enter the SamRam or Multiface,
1 supply the result. Therefore, INning from port FE is a tiny bit slower
1 suggestion. These files are meant to be used with a future version of
1 structure of a memory block is:
1 still halt the Z80 occasionally. Partly for this reason it is
1 still does not take into account the possibility of self-modifying
1 states. A complete '50 Hz' frame consists of 311 video lines (of which
1 states, the border would change at 8 pixels left of the upper left
1 states, but if you wait 14325 T states the ULA happens to be reading
1 states each in which the program counter is pushed, and two memory-read
1 states and incrementing the R register by 2. Most of the unlisted
1 states (or 70908/4=17727 T states on 128K Spectrums), a time-wraparound
1 state of the MIC and EAR outputs is not written to the .OUT file, to
1 starts running and the cartridge will be erased completely in 7
1 starts off at 15 and is falls to 0.
1 start with 256 screen pixels, then border, then horizontal retrace, and
1 start of the last T state of each instruction. The Z80 starts to act
1 stands for 'super level loader trap files') are like .Z80 files except
1 specified register, except when it is (HL). For example,
1 some time the Interface I writes 10 zeros and 2 FF bytes (the
1 some not-so-neat hardware devices put things on the data bus when they
1 software. The preamble is not saved to the microdrive file:
1 so that the running Spectrum program can decide what to do. Note that
1 so that the program will try to print, and will wait for the printer to
1 so simple to implement that I thought it to be worthwhile.
1 snapshot was saved, the emulated program will most probably crash when
1 snapshot file last loaded, and checks whether it contains the level
1 snapshot file last loaded (see description of the .Z80 file format); if
1 simply acts on IX instead of HL. (A notational awkwardness, that will
1 similar things don't happen at the right edge because the ULA don't
1 silent, its value is zero, except in the early Model 2 of the Spectrum,
1 signals. You can see this if you save something: the bars in the
1 shouldn't, so later programs didn't assume the low index byte was 0FF.
1 set, through the write-only control register CTRLA and CTRLB, accessed
1 set), bits 3-5 control the background colour, bit 6 is the bright bit
1 select one of three possibilities (low, normal and high video
1 seems that the Disciple rom is not paged at all (but possibly the
1 seemed to me that the only reliable way was to actually emulate the
1 seeing a RETI, before generating another interrupt.
1 section, 'Spectrum' by itself refers to the 48K machine only.
1 seconds. CAT 1 will respond with 'microdrive not ready'. Try it on the
1 screen; in this way, what you see on your PC monitor is exactly what a
1 screen+border lines are displayed, followed by 56 border lines again.
1 screen select bit (or, on 48K machines, the value of bit 3 of the byte
1 screen lines are written, and then 56 border lines and (possibly)
1 screen itself. Many 128K programs use this effect. Note however that,
1 screen is updated is very important. Normally the emulator updates the
1 screen information is read, by the ULA, from the first 6912 bytes of
1 screen for this frame already, the electron beam will for a moment not
1 saved in the snapshot file. If the Multiface was paged when the
1 save disk space when recording music. If you want all OUTs, specify
1 runs at 110830 Hz; otherwise it runs at 110830/R12R11 Hz. The envelope
1 routines. If you don't like this, or want to use another version of
1 routine to an external hardware device (read: the Z80 PIO). The RETN
1 routine is put.
1 roms. If the Multiface rom is selected, the Spectrum and peripherals
1 right, the block will be treated as a GAP. For instance, if you type
1 right border, 48 T states of horizontal retrace and 24 T states of left
1 return #FF too, so that the Spectrum program will not even consider to
1 retrace, but luckily that's not really important. Then the 192
1 result is the logical AND of all single inputs, so a zero in a bit
1 respectively. Shift, Symbol Shift, Enter and Space are denoted by
1 required to make it at most 8 characters long). If this file is not
1 requested (see the description of the .Z80 format below). If this
1 remarks. Any two keys pressed simultaneously can be uniquely decoded
1 remained unchanged except for offset 34 (Hardware mode):
1 regularly misses a screen byte. Instead of the actual byte, the byte
1 registers. If you look at the instructions carefully, you see how they
1 register. If the emulator fails to load a level data block, it
1 register, except for R14 and R15 when bit 6 or 7 of R7 are reset (R14 /
1 register! Example:
1 register number in bits 0-3 to port #FFFD (only A15, A14 and A1 are
1 register appended to it (dropping letters from the snapshot name if
1 region. With low video synchronisation the background moves smoothly
1 refresh. Assemble this program:
1 rectangle).
1 record block will have the right checksum. If the checksum is not
1 reason that you cannot write a sound- or save-routine in lower memory;
1 really spectacular.
1 real Spectrum would display on a television. Remember Aquaplane, with
1 reading from port 00FE (for instance by XOR A/IN A,(FE)) is one, no key
1 read FF (because the ULA also doesn't read the screen if it generates
1 randomly chooses 0 or 1 as its new output [2]. When R6 is zero, the
1 ram very, very often. The ULA can't cope with this read-frequency, and
1 programs like Sabre Wulf, Ghosts'n Goblins and Speedlock. The Mystery
1 program. ED FF is a nice one: it returns you to DOS immediately. I
1 program will continue to run normally. There's one program I know of
1 program only changes the entire ATTR line every two scan line times.)
1 produces in the X direction, and a B interrupt for each mickey in the
1 processor, the processor puts the I-R register 'pair' (not the 8 bit
1 processor reads from IN address #BF. Bit 7 of the returned byte is the
1 processor is halted each time you want to access the ULA or low memory
1 problem; MIC is only used for saving, and when saving the Spectrum
1 printer is off-line, busy, or out of paper, the emulator will usually
1 printer head stops at the start of the new line, instead of halfway
1 printer attached (e.g. with SuperSpy, which makes screendumps on the ZX
1 printed as follows. Wait for bit 0 (encoder) to go high, and write a
1 print, unless you set option -xj. In that case the emulator returns 1
1 previously read is used to build up the video signal. The screen seems
1 previously marked *) are documented by ZiLog, though not normally used.
1 pressed decoding may not be uniquely possible. For instance, if you
1 press Y or N according to whether the screen changed at some point of
1 press Caps shift, B and V, the Spectrum will think also the Space key
1 precedes an instruction that doesn't use the HL register pair at all,
1 preamble), and then a fifteen byte header-block-with-checksum. After
1 practical in 128K modes, in SamRam mode, and for mapping the execution
1 possible to jam the horizontal synchonisation of the ZX81 video signal.
1 position of byte 16384 of the screen. The other positions can be
1 ports, and contains logic to page and unpage an 8K ROM if new commands
1 ports are recorded in the .OUT file, together with the exact time at
1 port 31. If this port is read, it returns the position of the
1 polarity of this bit (which it definitely should not be, not only
1 pixel is written to the CRT, so if the ULA is reading bytes it does so
1 pixel (x,y). This bit-map constitutes the larger part of the screen
1 parameter 2 holds 32768. For data files finally, the byte at position
1 parameter 1 holds the autostart line number (or a number >=32768 if no
1 over the entire width of the screen. It might be, however, that this
1 output 0.
1 out-of-phase with the rest, and your space-ship flickers in that
1 out which parts of memory were actual code, and which were data. It
1 otherwise it doesn't change. How if Hold = 1, the output is a constant
1 otherwise be impossible get hold of (the Disciple requires the user to
1 other I/O devices only port FE should be used. If this port is written
1 other 38.5% of the time the ULA is building the border or generating a
1 oscilloscope, but luckily we don't need this information. Then 192
1 ordinary M1 instruction fetch cycle with two wait states added, taking
1 or load another snapshot. After a while, quit the emulator
1 opcodes in the range 40-7F do have an effect, however. The complete
1 opcode for JR, at FFFF. The first byte of the ROM is a DI, F3 hex, so
1 opcode ED FB in RAM (above 16384), it loads a block of code into memory
1 only when the internal counter reaches 0.
1 only time to change approximately half of it. (This does not seem to
1 only happen when the ULA is reading the screen memory, 61.5% (192/312)
1 only bother assembler and disassembler writers: JP (HL) is not
1 only 192 contain actual screen pixels, and the ULA will only read bytes
1 one frame on the Spectrum 128K is 1.5% longer than a 48K frame.
1 on the tape.
1 on the emulator of course!)
1 on the bus (physically) at interrupt time, the Spectrum continued to
1 on average than INning from other ports; whilst normally an IN A,(nn)
1 on also 128K snapshots had to be supported. This new format is used
1 old scheme, except for the end-marker, which is now absent. The
1 offset length name contents
1 of two transitions). If R1R0 contains 0, the counter behaves as if R1R0
1 of the shadow roms (128K, SamRam, Interface I, Multiface). It works
1 of the Undocumented Flags!
1 of the SamRam code anyway, this won't cause any more problems it
1 of the A register. (Bit 7 of F is the sign flag, and fits the rule
1 of the 1/50th second time slice in which a frame is generated. The
1 of the /IORQ line instead of the /MREQ line, and since the Z80 does not
1 of ram, paged into 8192-16383, and a latch storing the screen select
1 of course) it can't fetch or store the data byte. (A hint in this
1 of Spectrum's video memory, but with a bit or (hard) thinking you can
1 not, but since many programs use the useful ones, and a few programs
1 not distinguish between the extensions.
1 normally, these effectively decouple the buses. However, if the Z80
1 non-maskable interrupt. Since the state of IFF2 can be read by using
1 noise generated is the same as when R6 is 1. Changes to R6 take effect
1 no matter what is on the bus.
1 nice music too by the way). This effect has not been implemented
1 never sounds the internal speaker. The upper three bits are unused.
1 network.
1 net
1 need to read things there - it has just finished!
1 name as the snapshot last loaded, and the decimal value of the A
1 multiple of 257. A useful but not so much used trick is to make the
1 multi-load games on the emulator. If the emulator encounters the
1 motor isn't running, or there is no formatted cartridge in the
1 most probably implemented by toggling a flag that changes the reference
1 monitor didn't display the others or whether it was in vertical
1 modulo 255; this will never produce a checksum of 255. Possibly, this
1 mode 0 or 1 (or 0/1) interrupt takes 13 T states. (Thanks to Ian
1 missing from the official list. These instructions, usually denoted by
1 mirrored in the other bank at 4000 or at 8000, and vice versa. The
1 microdrive, the Spectrum hangs. This is the famous 'IN 0 crash'.
1 microdrive is not being used, the COMMS DATA output selects the
1 memory. A coordinate (x,y), x between 0 and 255 and y between 0 and
1 memory, the processor is halted sometimes. This part of memory is
1 memory, for instance the UDG graphics. It will have faded. Only the
1 memory, 256*192/8=6144 bytes. The final 768 bytes are attribute bytes.
1 memory) will disable opcode mapping. Finally, the mapping procedure
1 memory) is the only right solution. The current approach however was
1 memory refresh. However, the ULA gets confused if I is in the range
1 memory or accessing I/O devices is the same thing except for activation
1 means that the printer head is in the starting position. A line is
1 means that at least one of the corresponding keys are pressed. For
1 me when, and for how long exactly, the ULA halts the processor.
1 matrix behaviour is also emulated - without it, Zynaps for instance
1 marked (though the Z80 chip is, I think, in machine cycle 1, M1, during
1 mapping buffer. Also, option -xu (disable HCR emulation to use less
1 mapped. A one at bit-position k in byte n means that at least once
1 makes the 'Slow' bit 1 in the last two lines; this ensures that the
1 lower memory through the resistors. A very fast, cheap and neat design
1 locking the emulated Spectrum. If the printer is happy to accept data,
1 locations, but invalidating these if necessary when data is written to
1 locations of the opcodes executed. By tracing the code blocks found,
1 loaded when the opcode ED FB is executed. The block is loaded at the
1 loaded back.
1 list: (* = not official)
1 line times pass before the byte 16384 is displayed. At least the last
1 like level data (previously stored in .DAT files, and giving .SLT files
1 level data (in contrast to the level data in .Z80 files, which are
1 length 8 characters if necessary. .DAT files simply contain the plain
1 last written to port #7FFD - unlikely to be useful.) Other bits follow
1 knowledge no interesting bugs or quirks. However, it has some
1 keyboard row. The high byte is a mask byte and determines the column.
1 joystick, as a normal Kempston joystickinterface would. If written to,
1 joystick keys; the information in the 5 keyboard mapping words
1 joystick interface, and also by the Disciple interface, and that #3F is
1 its full-width horizon?
1 it's so good that it by itself is enough reason for implementing the
1 it was remarked by someone on comp.sys.sinclair)
1 it is not found there, the emulator looks for a .DAT file with the same
1 it is made active, as the slowest instructions (e.g. INC (IX+d), RL
1 it is ignored. ED instructions never operate on the IX or IY register.
1 is the value that is read by the Interface I if there's no or bad data
1 is set).
1 is pressed.
1 is pressed, and reacts by giving the 'Break into Program' report. This
1 is not emulated; you're never able to write the emulated CMOS ram in
1 is never changed (except possibly by LD R,A of course). This is
1 is loaded.
1 is controlled by introducing wait states". My guess is this holds true
1 is considered as one very long instruction, and will result in only the
1 is checked, and a PIO interrupt is emulated if necessary. The IRET
1 is busy reading, and after it's finished it lets the processor access
1 is being pressed. If more than one address line is made low, the
1 is allowed only 1 access to contended RAM in every 8 T states. The CPU
1 is DTR [3]). D2 is ignored as the AY chip has only one I/O register;
1 investigations on the AY chip.
1 into it. Stop the printer by writing a byte 4. See #0EF4 in the ROM
1 interrupts per frame per coordinate. Care is taken to execute the 50
1 interrupting device places on the data bus. On a standard Spectrum
1 interrupt vector is read, followed by two stack-write cycles of 3 T
1 interrupt time, so that in mode 0 also a RST #38 (opcode #FF) is
1 interrupt mode 0. In IM 1 the Z80 just executes a RST #38 (opcode FF)
1 interrupt is received (and interrupts are enabled). As a NOP takes 4
1 internal format of these blocks depend on the data type:
1 internal Instruction Register, but the Interrupt and R registers) on
1 instructions, but throws away the result. It does change the flags in
1 instructions 'should', by regularity of the instruction set, use (HL)
1 instruction. It is used only to signify the end of an interrupt
1 instruction would take 11 T states, it takes 12.15 T states on average
1 instruction operates on (IX+nn), but also copies the result to the
1 instruction is trapped, and if caught, more PIO interrupts are emulated
1 instruction OUTs a byte zero to port (C), interestingly. These
1 instead of 16K), a soundchip, and a serial printer port. Nothing
1 instance Spinads); for these programs the emulator can mimic a Model 2
1 input does load the output register.
1 inofficial DD and FD instructions are implemented, a sequence of DD's
1 information, as you can readily figure out by using PUSH AF and POP AF.
1 indirect; it should have been denoted by JP HL.) If a DD opcode
1 index byte, but that isn't true. The normal Spectrum contains no
1 indeed! This is the only program I know to feature hi-res colour effect
1 indeed!
1 increase R by two. There's an exception: doubly-shifted opcodes, the
1 inactivated when the Z80 executes the RET at address 0700.
1 in the ROMS.BIN file, do have system files pre-loaded however.
1 in mode 2,4,5,6. Fields 38-54 are valid in modes 4-6. Fields 83-85
1 in any way. Here are the changes of the Interface I rom:
1 in Z80.DOC. These files have no default extension; .MAP seems a natural
1 in April '95, and to Ian Collier who recently carried out some thorough
1 impossible to have hi-res colour effect over the entire screen; there is
1 immediately.
1 immediately resets to 0. Every time the internal counter is reset, the
1 if nn=FE. See below for more exact information.
1 if necessary, after actually executing the IRET, with a maximum of 32
1 however is different from RET in that it resets IFF1 to the current
1 however - it's a bit useless (but maybe I'll include it in the future).
1 himself.
1 hi-resolution colour effects not only in the border, but also on the
1 header block), immediately followed by the data block of 512 bytes, and
1 header always consists of 17 bytes:
1 haven't done any testing, so I cannot say anything definite here.
1 have no meaning anymore, and the program counter (offset 6 and 7) are
1 hasn't been modified; who would put his snapshot software in there
1 hardware to place a byte on the bus, and the bus will therefore always
1 hard to control, is sometimes significant in practice for hi-resolution
1 had to make a compromise. The undocumented flags are not always
1 go on line. The reason for including the -xj switch is that usually
1 giving the Z80 access to (screen) memory. This allows programs to make
1 given as to when exactly the screen should be updated. The user can
1 generator is reset by writing to R13 (but not by writing to R11 or
1 generates one scanline on the television screen. It seems therefore
1 generates its once-in-every-20-ms interrupt, it is 3, and is increased
1 generate interrupts when prompted by the hardware, and put the
1 function of bit 0 of out-port F7:
1 ftp.nvg.unit.no).
1 from PIO interrupts by the fact that it puts a #FF on the bus. It was
1 frequency of the tone generated is 110830/R1R0 Hz (one period consists
1 frequency of 221660 Hz (which is the driving frequency of the chip
1 frequency of 110830 Hz. The lowest frequency attainable by the
1 found either, a window is popped up to inform the user of the value of
1 format of a single table entry is:
1 for the relevant routine.
1 for the 128K too.
1 for instance). Many modern programs use the fact that the screen is
1 for instance by Arkanoid, and Z80 also emulates this.
1 for example ED 6*00 is not encoded into ED ED ED 06 00 but into ED 00
1 for all snapshots (48K or 128K).
1 follows. If Attack = 1, the output starts off at 0 and at each clock
1 following this comes a
1 follow the standard rule. If a DD or FD precedes an ED instruction,
1 flip flop, is on, signifying that interrupts were enabled before the
1 five keys:
1 first. The Z80 samples the state of its interrupt request line at the
1 first the (internal) 'Attack' bit is toggled if Alternate is set,
1 first period (except that Attack has possibly changed). To sum it up:
1 first few bytes of each 256 byte block will still contain zeros,
1 files with SLT data will always have extension .SLT, Z80 does in fact
1 file, parameter 1 holds the start of the code block when saved, and
1 field will never hold values larger than 16383. (Previous versions of
1 few may be verical retraces; this is difficult to find out without an
1 fetches the 16-bit address at this interrupt table entry, and finally
1 fast in reality, but on the PC two blocks of 32K bytes had to be REP
1 fashion, with 8 rows of 5 columns, as is obvious from the above
1 fails, it looks for a .DAT file of the level; the name of this file is
1 extract from above formula all information you need... The lowest
1 expected since the S flag is extracted from bit 15.
1 execution, most of the code can probably be found.
1 executed. A RST #38 normally takes 11 T states, so that the complete
1 executed after a RETI was a HALT, which is then skipped. It seems
1 execute normally, whereas when an EF (RST #28) was put on the bus it
1 exceptions left of the actual screen rectangle are the only ones;
1 example, only if each of the five lowest bits of the result from
1 example, a displacement byte is added. Otherwise the instruction
1 exactly). An exception is the CP x instruction (x=register, (HL) or
1 everything must be exactly right for it to run. Finally, the '128 rom
1 every byte directly following a single ED is not taken into a block,
1 error handling to the calling Z80 program.
1 equipment. The ZX Printer is controlled through one I/O port, namely
1 envelope generator, three mixers, and three volume generators.
1 envelope clock tick. A 'period' is the time taken by 16 clock ticks.
1 envelope clock is therefore 1.7 Hz. If R12R11 contains 0, the clock
1 entire screen at once (50 times a second), and no best solution can be
1 encountered. I don't think this makes sense. ZiLOG doesn't dictate
1 encountered, even two ED's are encoded into ED ED 02 ED. Finally,
1 encountered during emulation, the following block is written to the
1 emulator...
1 emulator, which halts the program if an undocumented opcode is
1 emulated right, but they are most of the time. Not telling you when
1 empty record block has a zero in bit 1 of RECFLG and also RECLEN=0. An
1 empirical rule:
1 either page 5 or page 7.
1 either 110830/(16*R12R11) Hz (R13 = 8 or 12) or 110830/(32*R12R11) Hz
1 effectively executing NOPs and not incrementing the PC until an
1 each 4 T states (and then it reads two: a screen and an ATTR byte). The
1 during the time the emulator emulated, it emulated the opcode it found
1 during execution of such a block. (This last remark was not checked;
1 during 128 of the 224 T states of each screen line. But if it does,
1 dropping characters from the original snapshot name to make the total
1 done. Then save the snapshot ('program.z80'), and start the emulator
1 does not work on the +3, where there's another port 1FFD, and neither
1 does not take memory paging into account, and it is therefore not very
1 does is store 2 times 254 blocks in the .MDR file as it is OUTed,
1 documentation. It can also be found in the 'Spectrum Microdrive Book',
1 do not generate a block in the log file; this is to make comparisons
1 do exist, LD (HL),(HL) is absent and replaced by the HALT instruction.)
1 divided by 8). Loading R0 or R1 takes effect directly. If the internal
1 direction is that, even though the NOP-synonyms LD B,B, LD C,C etcetera
1 direct argument). In that case the bits are copied from the argument.
1 different modes.
1 did not do this.
1 determine which key is actually pressed (and should correspond to the
1 descriptor-with-checksum (which has a structure very much like the
1 derived from the name of the last snapshot loaded by appending the
1 decoded). Then write to a register by OUTing to #BFFD, read it by
1 cycles to push the program counter, which adds up to 11 T states. I
1 cycles of 3 T's each that read the interrupt address. That is 19 T's.
1 cycle. Probably for this reason ZiLOG decided to count only the lowest
1 crashed, just as it does in that case when the Z80 is in the official
1 counts down from 17471 to 0 inclusive (or 17726 to 0 in 128K modes),
1 counter which is reset to 0 whenever it is larger than or equal to the
1 counter that is updated every instruction, where DD, FD, ED and CB are
1 counter is below the new value, it simply continues; if it is above, it
1 corresponding to the joystick directions left, right, down, up, fire
1 corresponding interrupt vector on the data bus at interrupt time. In
1 corner of the screen. This is right for 14322, 14323 and 14324 T
1 copy of every screen- and attribute-line in a buffer at the exact time
1 controller produces an output voltage proportional to its channel's
1 contended RAM [pages 4-7] (which shares time between the video
1 contains 8 latches:
1 contains 512 bytes of data (RECLEN=512, i.e. bit 1 of MSB is 1). An
1 contained 1.
1 constitute the version 2.01 header, and their interpretation has
1 constant 0. If Hold = 0, the envelope generator behaves just as in the
1 conform the format of v2.01 or v3.0x files (long header).
1 computer is reset. This bit is set if you select 48K Spectrum in the
1 computed by remembering that 8 pixels take 4 T states, and a line takes
1 compressed).
1 compressed data of a 16K block. The compression is according to the
1 complete frame is 311 x 228 = 70908 T states long.
1 complements the carry flag. Versions of the emulator prior to v3.04
1 comp.sys.sinclair. Thanks, and large parts of the information below,
1 colour effects. When the Z80 is executing a HALT instruction, it is
1 colour (the colour of the pixel if the corresponding bit in the bitmap is
1 collected 8 bits from the microdrive head; therefore, it the microdrive
1 coded. The exception is sequences consisting of ED's; if they are
1 code. For completely general programs, the approach that Arnt
1 code. For almost all programs this will be sufficient. It however
1 code of the emulator if you want to know some details, or read the
1 clocks to execute, in this case the start of the interrupt is fixed up
1 circuitry and the processor), during 128 out of every 228 CPU T states
1 circles in a corner, if the (in this case undocumented) behaviour of
1 chunk. If we forget about the screen for a moment, if you OUT to port
1 checksums, see below; the other fields are dealt with by the emulated
1 checksum bytes. The checksum is the bitwise XOR of all bytes including
1 check for BREAKs, so that the encoder bit is always high to prevent
1 characters, full-screen horizon (Aquaplane) or pixel colour (Uridium
1 character flickering: although the ULA has started displaying the
1 channel A) and the 4-bit output of the envelope controller.
1 changed is stored. Using this information the emulator builds the
1 causes the ULA to halt the processor. When and how much? The
1 bytes of RAM to display the screen, and contains the logic for just one
1 bytes get written to the log file every second.
1 bytes are replaced by the four-byte code ED ED xx yy, which stands for
1 bytes are asked for than exist in the block, the loading routine will
1 byte flag which is non-zero is the cartridge is write protected, so the
1 byte 16384 (or 22528, or both) and will halt the processor for a while,
1 by the Network to synchronise, GAP, SYNC, WR_PROT, ERASE, R/_W, COMMS
1 by reading from the IN ports; however, if more than two keys are
1 by one every 5 emulated milliseconds to take the values 0,1,2 and 3
1 by Ian Logan (co-writer of the excellent 'Complete Spectrum ROM
1 by Arnt Gulbrandsen, and originated from David Librik.)
1 but the sprites flicker in all parts of the screen. Only with high
1 bus in the acknowledge cycle is executed, whereas in mode 1 this is
1 both the shift fetch and the secondary opcode fetch). Due to the way
1 border.
1 border move differently. The really important difference of the 128K
1 border is 48 pixels wide at each side. A video screen line is
1 block. If less bytes are loaded than are available, the other bytes
1 block is written to the .OUT file:
1 block is the sum of the lengths of the blocks that precede it. The
1 block is not compressed and exactly 16384 bytes long, and the length
1 bit of the Spectrum 128K (bit 3 of OUT-port #7FFD), which would
1 bit of data (1=black dot), and do this 256 times. The Spectrum ROM
1 bit 3 is data output); when it is 0 R14 acts as input register (bit 6
1 bit 0 of the vector byte is always 0. Z80 only emulates PIO mode 1
1 bit 0 always one. Bounder and Enduro Racer use them, to name just two.
1 binary tone channel output is constant and equal to 1, not 0. Changes
1 binary output value times the current volume. These analogue outputs
1 binary output of the noise generator. Note that setting both Ta and Na
1 between different logs of the same program easier. Admittedly, this is
1 between 0 and 17726 inclusive when a 128K Spectrum is emulated), and a
1 best results. Try for instance Zynaps; with normal video
1 best for mapping the ordinary rom and ordinary 48K Spectrum programs.
1 below:
1 being 1. Following this header block of 30 bytes the 48K bytes of
1 behaviour (bit 7=0, bit 6=1 when setting PIO mode), and won't do
1 behave as they did before, but the bytes the Z80 sees are always the
1 behave as is does on a real Spectrum; if it is off it will (except for
1 because they were refreshed during the execution of the loop. The ULA
1 because of this model difference, but also because one cannot be sure
1 because in the old days everyone used 16 Kbit chips. Inside the chip
1 be true; the Shock Megademo manages to move 1-pixel thick lines up on
1 baud, by the way, if you replace the rom code, there's no point in
1 attached to the LPT port selected for ZX Printer output. If the
1 at address HL. The data is first looked for in the .Z80 or .SLT
1 at address 8n+k. The shifted opcodes will only have the shift code
1 at 0000-3FFF contains either the original 48K ROM or the new 128K ROM.
1 ascii values). The low byte is in the range 0-7 and determines the
1 as operand, but since from the processor's point of view accessing
1 as I could. There is a Z80 emulator around, intended as a CP/M
1 are valid in modes 3 and 6 (all mode codes are as in v3.0x files).
1 are used. I won't be very detailed here; you could refer to the source
1 are then added together to give the final output (this is done outside
1 are skipped, and the last byte loaded is used as checksum. If more
1 are saved. In '128 mode, all pages from 3 to 10 are saved. This
1 are ignored. The table ends with an all-zero end marker:
1 are due to Alastair Booker, who put a detailed description on the net
1 applies to mode 1 only, and refers to the I/O addresses as used by the
1 anyway, and that's what those people are afraid of.
1 anything if the mode is set differently.
1 another GAP, it writes a preamble again, with a 15-byte record-
1 and very useful very occasionally.
1 and the ULA is busy reading. Of the 312 'lines' the ULA generates,
1 and bit 7 is the flash bit - if it is set, every 16/50th of a second
1 and also taking the conditional branches that were left alone during
1 and Na to 0 produces bursts of noise and half-periods of constant
1 and #3F respectively. (Note that #1F is also used by the Kempston
1 an interrupt), so the resulting index address is 256*I+0FF. However,
1 an NMI, which, by some combined hardware and software wizardry,
1 ambiguous. The special cases are: LD H,(IX+d) and LD L,(IX+d), and
1 always reads 255. Writing to R14 or R15 when they are selected for
1 always RST #38. The Spectrum ordinarily leaves the bus floating at
1 always 0. Reading always yields the value last written to the
1 although the 128K ULA is more relaxed towards memory access, it does
1 although precise explanations were hard to find. The R register is a
1 alternatingly of length 15 and 528 bytes. The emulator does check
1 also used by the Multiface.) The other registers cannot be read, only
1 also necessary to take care of cases where the first instruction
1 again respectively. In these 1/200s intervals, the low T state counter
1 after DI and EI and after a maskable interrupt has been accepted).
1 after 224 T states, and again after 448, an so forth. These 192
1 address pointed to by the HL register. The level number is in the A
1 address of the first DD that was executed being tagged.
1 address by combining the I register (as the high byte) with whatever
1 address buses of the Z80 and the ULA are connected by small resistors;
1 address 16384 and length 6912 decimal. If the file is a Program file,
1 address 0008 or 1708 hexadecimal, the error and close# routines. It is
1 activates the MIC output, and a one in bit 4 activates the EAR output
1 activate OUT logging, a trace is dumped also. For each instruction
1 accordingly. The Spectrum loading software is not sensitive to the
1 access memory twice in one instruction (disregarding instruction fetch
1 a very crude way of tracing a program, but it's better than nothing,
1 a final checksum of those 512 bytes. The preamble is used by the
1 a few are vertical retraces), that is, 1 less than for 48K models. A
1 a byte 0 to #FB (Mot=0). Then check bit 7 until it goes high; this
1 [3] I don't know which bit is data input; it is probably not bit 3.
1 [2] The algorithm used for the pseudo random output is not known. It
1 [1] This has been checked by Pierre Guerrier using an oscilloscope.
1 [,],/,\ respectively. The ascii values are used only to display the
1 Z80 could produce 'compressed' blocks of more than 16384 bytes, but
1 Z80 Interrupt mode 2, this will then be used as a vector. Note that
1 You should not use Hi-res color emulation during opcode mapping; they
1 You can easily check that the R register is really crucial to memory
1 Y direction. The sign of the direction is stored as a 0 (positive) or
1 With CB instructions, the situation is more interesting. Every DD CB
1 When the emulator fails to load a block, it complements the carry flag,
1 When an interrupt occurs, the running instruction has to be completed
1 When an ED FB opcode is encountered, the emulator first looks for the
1 When (parts of) HL are used both as source and target, above rule is
1 Version 2.01 and 3.0x .Z80 files start with the same 30 byte header
1 Two instructions do not obey the DD/FD rule. They are EX DE,HL and
1 Tone generator A is controlled by R0 and R1. It contains a 12 bit up
1 To print, first read port #FB and check that bit 6 is 0 to make sure
1 Though it is agreed that .Z80 files will not contain SLT data, and
1 This section describes the format of the files used by the emulator.
1 This option has been added after reading a remark of Leslie Styles
1 This makes a total of 312 lines of 224 T states, or 69888 T states,
1 This device consists of an 8K rom, paged into the area 0-8191, and 8K
1 This concludes the specification of .Z80 files. .SLT files (which
1 This chip is used in for instance the Sinclair ZX Spectrum 128/+2/+3,
1 This chip is fairly complicated, and can operate in several modes. The
1 They're different only if an NMI occurs when interrupts are enabled;
1 These types of inofficial instructions are used in many programs. By
1 These programs contain a 257 byte table of equal bytes starting at
1 These instructions are quite commonly used.
1 These files are used to store level data; blocks of memory that are
1 These files are produced when logging OUTs; see menu option O in the
1 These changes are not likely to cause problems; there are several
1 Therefore, you'll read a mixture of FF's (idle bus), and screen and
1 There are a number of inofficial ED instructions, but none of them are
1 There are 248 different CB opcodes. The block CB 30 to CB 37 is
1 Then there's one other dark corner of the Z80 which has its effect on
1 Then there's border, horizontal retrace and border again, of 100 T
1 Then the other things. Memory is arranged in banks of 16K. The bank
1 Then a table follows, each entry describing a piece of data. The
1 The value of the word at position 30 is 23 for version 2.01 files, and
1 The type is 0,1,2 or 3 for a Program, Number array, Character array or
1 The two Spectrum 128 roms have not been modified, and neither have the
1 The three checksums are calculated by adding all the bytes together
1 The sound chip of the Spectrum 128 is described in the next section.
1 The rhino in Sabre Wulf walks backward or keeps running in little
1 The processor has three interrupt modes, selected by the instructions
1 The pages are numbered, depending on the hardware mode, in the
1 The output of the envelope generator during the first period is as
1 The output in the subsequent periods is 0 if Continue = 0. Otherwise,
1 The ordinary rom has not been modified. The Interface I rom has
1 The opcode ED FB, which is used by the SamRam, is now also used to use
1 The only program I know of that uses the AMX mouse is Art Studio, but
1 The old .Z80 snapshot format (for version 1.45 and below) looks like
1 The noise generator contains a 5 bit up counter, which is reset to 0
1 The noise and tone output of a channel is combined in the mixer in the
1 The lowest three bits specify the border colour; a zero in bit 3
1 The lowest three bits of the attribute byte control the foreground
1 The latter is active at reset. The bank at 4000-7FFF always contains
1 The instructions ED 4E and ED 6E are IM 0 equivalents: when FF was put
1 The hi T state counter counts up modulo 4. Just after the ULA
1 The following section was put together using information collected from
1 The first and second SamRam rom have been modified more extensively.
1 The envelope generator is controlled by R11, R12 and R13.
1 The envelope generator contains a 16-bit up counter, operated at a
1 The emulator will always start reading bytes at the beginning of a
1 The emulator uses a cartridge file format identical to the 'Microdrive
1 The emulator returns #FF on a port #FB IN if there is no printer
1 The doubly-shifted opcodes that start with DD CB and DD ED also do not
1 The compression method is this. Repetitions of at least five equal
1 The biggest problem was that switching the upper 32K ram bank is very
1 The best way to use this feature is the following. Load the program
1 The basic video timings, with the Z80 out of the way, are as follows.
1 The address selects on of the eight latches; bit 0 is the new state of
1 The address of the attribute byte corresponding to pixel (x,y) is
1 The ZX81 hardware generates a WAIT only 16 T states before it generates
1 The Z80 processor is quite straightforward, and contains to my
1 The ULA with the lower 16K of RAM, and the processor with the upper 32K
1 The Spectrum is at the hardware level a very simple machine. There's
1 The SamRam monitor can disassemble these and uses the mnemonic SLL.
1 The SamRam contains a 32K static CMOS Ram chip, and some I/O logic for
1 The SLT format was cooked up by Damien Burke, James McKay and yours
1 The ROM is paged if the processor executes the instruction at ROM
1 The RETI instruction is functionally exactly equivalent to the RET
1 The PIO contains two 8-bit interrupt vector registers (VECA and VECB),
1 The Multiface rom and ram pages have highest priority, higher than both
1 The Multiface memory is paged out by reading from port #3F. The
1 The Multiface memory is paged in when an NMI occurs, or when the
1 The Interface I is quite complicated. It uses three different I/O
1 The ED70 instruction reads from port (C), just like the other
1 The ED63 and ED6B instructions have shorter and faster equivalents.
1 The DD and FD opcodes precede instructions using the IX and IY
1 The AY has 16 internal registers. A register is selected by OUTing the
1 The AY chip consists of three tone generators, one noise generator, an
1 The AMX is emulated as follows. At every 50 Hz frame, the mouse status
1 The AMX interface uses a Z80-PIO (programmable In/Out Interface).
1 The AMX interface generates an A interrupt for each 'mickey' the mouse
1 The 50 Hz interrupt is synchronized with the video signal generation by
1 The 5 ascii words (high byte always 0) at 73-82 are the keys
1 The .TAP files contain blocks of tape-saved data. All blocks start
1 The .OUT files are also used to make a simple trace of a running
1 That's the format of .Z80 files as used by versions up to 1.45.
1 TXDATA and RXDATA are the input and output of the RS232 port. COMMS
1 System and the MSX.
1 Starting with version 3.05, a length field of 65535 (-1) means that the
1 Starting from version 3.05, Z80 ignores the setting of byte 29, bit 3
1 Starting from version 2.0, a different format is used, since from then
1 Spectrum. It starts with 128 T states of screen pixels (or border).
1 Spectrum.
1 Spectrum program. Specify -xy on the command line; as soon as you
1 Spectrum program may halt on a COPY statement even if there's no
1 Spectrum memory, from #0000 to #FFFF. Note that the rom is also
1 Spectrum memory are stored, in a compressed format (if bit 5 of byte 12
1 Spectrum is normally in. The other mode that is commonly used is IM 2.
1 Spectrum 128 offers more RAM (128K, you guessed it), more ROM (32K
1 Sometimes the ULA even stops the processor when it is not interfering
1 Some use it to generate fantastic effects, such as full-screen
1 Some old programs rely on the fact that bit 6 is always one (for
1 So even when the Spectrum does not OUT to the logged ports at all, 1000
1 Sinclair Interface 2 joystick.
1 Set IE latch
1 See the end of section 5.9 for an explanation how to load these blocks
1 Saukas told me that the TK-90X sets bit 7 to 0.)
1 SamRam. These opcodes, ED F8 to ED FE are of little use to any other
1 SAMLIST.
1 RS232 will be slower (always FORMAT the "b" or "t" channel at 19200
1 ROMS.BIN:
1 ROMS.BIN file. The interface I should work properly, although the
1 ROM software, and it is utterly useless in normal software. In other
1 RETI's or RETN's. One can make an educated guess though.
1 RAM page 5. The bank at 8000-BFFF is always page 2. The bank at
1 RAM and 16K ROM are working independently of each other. The data and
1 R=0, the 128K Rom is selected in bank 0000-3FFF; otherwise the 48K Rom.
1 R15 used for input). On the AY-3-8912, when R7 bit 7 is reset, R15
1 R15 in input mode always yields 255. Changes made to R7 take effect
1 R12); otherwise it works just as the other counters.
1 Printer without asking). In the inner printing loop, the ROM does not
1 Port EF is used for several things:
1 One additional port, IN port #DF, reads out the mouse button status.
1 OUT port that was written to follows, then the value OUTed itself:
1 OUT 239,0 on a normal Spectrum with interface I, the microdrive motor
1 Now when to OUT to the border to change it at the place you want?
1 Now for the timings of each line itself. I define a screen line to
1 Now for the emulated Z80. I have added eight instructions, to speed up
1 Note that it is possible to join .TAP files by simply stringing them
1 Note that an NMI also pages the Disciple rom, but as the Multiface
1 NOPs, doing nothing except repeatedly setting the flag 'treat HL as IX'
1 Multiface routines page it out themselves).
1 Multiface rom+ram.
1 Multiface does not put bits on the bus.
1 Multiface 128 also works on 48K machines.
1 Most Z80 opcodes are one byte long, not counting a possible byte or
1 Melbourne House - but don't expect the same level of detail as of Ian
1 Map files are those that are produced via option -0m; see section 2.19
1 Map files are 8192 bytes long. Each byte represents 8 addresses in
1 Map files
1 Many programs use the interrupt to synchronize with the frame cycle.
1 MOVSWded (or the EMS emulator be called). But since no programs know
1 M1 cycle in which the opcode is ignored, then two 3-T stack-write
1 Logan and Frank O'Hara in their Rom disassembly book.
1 Leslie Styles' DSNA (a snapshot disassembler; you can find it on
1 LINE parameter was given) and parameter 2 holds the start of the
1 LDIR increases it by 2 times BC, as does LDDR etcetera. The sequence
1 LD R,A / LD A,R increases A by two. The highest bit of the R register
1 LD IXl,IXl / LD IXl,IXh / LD IXh,IXl / LD IXh,IXh. Things like
1 LD IXh,(IX+d) or LD H,IXh do not exist.
1 LD A,R and LD A,I, the RETN instruction is not used much in Spectrum
1 L1 XOR A
1 It will take about three minutes to run. Look at the upper 32K of
1 It returns #FF or #00.
1 Interface I software.)
1 Interface I hardware to synchronise, and is not explicitly used by the
1 In this section, the hardware of the 48K Spectrum is discussed. In this
1 In section 5.1 there is some information on Z80 interrupt timings in
1 In normal operation, all first-fifteen-byte blocks of each header or
1 In interrupt mode 0, the processor executes the instruction that the
1 In comparison to the Spectrum 48K, and on the hardware side, the
1 In all interrupt modes, the interrupt acknowledge cycle is basically an
1 In Hi-resolution colour emulation mode, however, the emulator makes a
1 In 48K mode, pages 4,5 and 8 are saved. In SamRam mode, pages 4 to 8
1 If you run a program in the lower 16K of RAM, or read or write in that
1 If the processor reads from a non-existing IN port, for instance FF,
1 If the instruction is one that operates on a 16 bit word, the 8 bits of
1 If the envelope generator is used to generate a tone, its frequency is
1 If port FE is read from, the highest eight address lines are important
1 If an interrupt is requested, the processor first builds a 16 bit
1 If a memory byte is addressed indirectly via HL, as in the second
1 If P=1, port #7FFD will be disabled and keep its value until the
1 If IEA or IEB are set (1), the corresponding interrupt sequences will
1 If Ev=0, the current volume is given by V3V2V1V0. If Ev=1, the current
1 If D1 is 1, R14 acts as output register (RS232 output: bit 2 is CTS,
1 Ian Collier states that an NMI cycle takes 15 T states. My reference
1 INning from port FE will halt the processor, because the ULA has to
1 INning from #FFFD. When reading from a register, unused bits are
1 IM 0, IM 1 and IM 2. In mode 1, the processor simply executes a RST
1 IEB). The data registers can be read at any time through IN ports #1F
1 I/O port completes the machine, from a software point of view at least.
1 I/O Port E7 is used to send or receive data to and from the microdrive.
1 I don't know whether the 128K model uses a different crystal. If not,
1 I admit this is not quite the clearest way to explain the organization
1 Hz frame interrupt as well. This latter interrupt can be distinguished
1 Hereafter a number of memory blocks follow, each containing the
1 Here are the names of the AY registers:
1 Here Tone_A is the binary output of tone generator A, and Noise is the
1 Has this ever been tried?
1 Gulbrandsen followed in his JPP (also keeping a map of executed opcode
1 Guenter Woigk remarked that the three instructions marked # (which were
1 Ghosts'n Goblins use the undocumented flag due to a programming error.
1 Furthermore, sometimes their values change. I found the following
1 Furthermore, no time-wraparound blocks are written to the .OUT file
1 For instance, after an ADD A,B those bits will be identical to the bits
1 For completeness, I'll include the structure of a tape header. A
1 For 128K timings, which are slightly different, see the next section.
1 First of all, you cannot change the border within a 'byte', an 8-pixel
1 Finally, there is an interesting bug in the ULA which also has to do
1 Finally, the data blocks follow. The blocks are stored in the order in
1 File' format of Carlo Delhez' Spectrum emulator Spectator for the QL,
1 Fields 30-34, 36-37, 55-82 are valid in all modes. Field 35 is valid
1 FE after 14326 to 14329 T states (including the OUT) from the start of
1 Extra Functions menu. For the specified I/O ports, all OUTs to these
1 Every even I/O address will address the ULA, but to avoid problems with
1 Every 1/200th of an emulated second, that is, every 69888/4=17472 T
1 Enter for example is stored as 0x0106 (row 6 and column 1) and 'g' as
1 Each volume generator is controlled by its amplitude register (R8 for
1 Each video line takes 228 T states, 4 T states more than on the 48K
1 Each time the envelope generator up counter is reset, it produces a
1 Each line takes exactly 224 T states. After an interrupt occurs, 64
1 Each binary tone channel output is fed to a separate volume generator.
1 EXX. These instructions take 4 T states to execute, and are therefore
1 ED ED 05 00. The block is terminated by an end marker, 00 ED ED 00.
1 Disciple roms or the Multiface rom. The Disciple roms, as they appear
1 Disassembly').
1 Directly after an interrupt is generated by the ULA (so slightly before
1 Des Harriot. The following information is adapted from Carlo's
1 Data types other than type 1 and 3 are not supported by Z80 v3.04, and
1 DDCB and FDCB ones, increase R by two too. LDI increases R by two,
1 DATA determines whether bit 0 of F7 is output for the RS232 or the
1 Collier for correcting this in the FAQ version)
1 Code file. A screen$ file is regarded as a Code file with start
1 CLK and COMMS DATA are used by the microdrive system. If the
1 CALLs the subroutine at that address. Rodnay Zaks in his book
1 C000-FFFF contains any page from 0-7, including page 2 and 5. If page
1 Bytes 61 and 62 are a function of the other flags, such as byte 34, 59,
1 Byte 60 must be zero, because the contents of the Multiface RAM is not
1 By default, an OUT to an even I/O address which does not change the
1 But for the same reasons as above, this is not really reliable.
1 Bits DTR and CTS are used by the RS232 interface. The WAIT bit is used
1 Bits 5 and 7 are always one (except in some clones; Einar Gattoni
1 Bits 0-2 determine which page is to appear in bank C000-FFFF. If S=0,
1 Bit 6 (value 64) of IN-port FE is the ear input bit. When the line is
1 Bit 3 and 5 of the F register are not used. They can contain
1 Because of compatibility, if byte 12 is 255, it has to be regarded as
1 At reset, all latches are 0. If an OUT 31,5 is issued, only a reset
1 As noted above, reading or writing in low ram (or OUTing to the ULA!)
1 As always, how very Sinclair, this is a simple but ingenious piece of
1 Another difference with the 48K Spectrum is in the timing of the video
1 An amazing piece of code! Speedlock does so many weird things that
1 An .OUT file consists of a string of 5-byte blocks. The first word is
1 Amstrad CPC 464/664/6128, Mattel Intellivision, Atari ST, Sega Master
1 Also note that the map is never cleared, not even when another snapshot
1 All words in the format have the least significant byte first.
1 All this is controlled by writing to port 7FFD (or, in fact, by writing
1 After the first 30 bytes, the additional header follows:
1 Accessing this port will halt the Z80 until the Interface I has
1 About the R register. This is not really an undocumented feature,
1 ATTR data bytes (the latter being very scarce, by the way). This will
1 AMX interface only uses mode 1 (no connection with IM 1 by the way), so
1 A zero in one of the five lowest bits means that the corresponding key
1 A used record block is either an EOF block (bit 1 of RECFLG is 1) or
1 A reset signal causes the IE latches of the PIO to reset.
1 A quote from the +2 manual, page 279; Cliff Lawson writes: "For the
1 A mode 2 interrupt starts off with a 7 T state M1 cycle in which the
1 A final remark about the keyboard. It is connected in a matrix-like
1 A cartridge file contains 254 'sectors' of 543 bytes each, and a final
1 A DD opcode simply changes the meaning of HL in the next instruction.
1 = Na = 1), changing the volume level changes the final output, as the
1 7 bits. If the R register emulation is switched on the R register will
1 64-127, because it thinks the processor wants to read from lower 16K
1 60 and 83.
1 542 1 DCHK data block checksum (of all 512 bytes of data
1 54 for version 3.0x files. The starred fields are the ones that
1 5.9 The Z80 microprocessor
1 5.8 The AMX mouse interface
1 5.7 The Multiface 128
1 5.6 The SamRam
1 5.5 The Interface I
1 5.4 The ZX Printer
1 5.3 The AY-3-8912 sound chip
1 5.2 The Spectrum 128K
1 5.10 File formats
1 5.1 The Spectrum 48K
1 48K of RAM which fills up the rest. An ULA which reads the lowest 6912
1 48 of these are actual border-lines. I could not determine whether my
1 3/200 of a (relative) second after a Z80 interrupt) to try to get the
1 256*I, and the interrupt routine is placed at an address that is a
1 254 times
1 224 T states. You would think that OUTing after 14322 to 14325 T
1 2 or 5 is enabled in the high bank, every byte written in this bank is
1 192, (0,0) being the upper left corner of the screen, corresponds to
1 15 in this and subsequent periods if Attack = 1, otherwise it is a
1 14364 T states after the interrupt was generated.
1 14 decimal holds the variable name.
1 128K startup menu, so that no 48K program is able to (accidentally)
1 1 (negative) in the respective data registers.
1 0x1001 (row 1 and column 4). The default values correspond to the Left
1 0,2 this will result:
1 .Z80 and .SLT files:
1 .TAP FILES:
1 .SCR files are memory dumps of the first 6912 bytes of the Spectrum
1 .SCR FILES:
1 .OUT file:
1 .OUT FILES:
1 .MDR FILES:
1 .DAT files:
1 -xg on the command line.
1 --------------------
1 (which sounds the internal speaker). The real Spectrum also activates
1 (or IY) and taking up 4 T states. Note that the FD or DD 'opcode' is
1 ([email protected]), who had been trying to make his disassembler figure
1 (driving frequency divided by 16) [1]. Every time it reaches zero, it
1 (decimal) value of the A register to the name of the snapshot file,
1 (The information about the inofficial CB instructions was given to me
1 (R13 = 10 or 14).
1 (Mostek Technical Manual of the Z80) breaks it down as follows: a 5 T
1 (IX+d), EX (SP),IX) take 23 T states). This difference, which may be
1 (Double Interrupt frequency) when loading snapshots, and resets the bit
1 (DATAA and DATAB), and two 1-bit interrupt-enable latches (IEA and
1 (Ctrl-Break), and you'll find the file 'program.map' contain the
1 (Actually, this information is 'transparent' to the emulator. All it
1 (1 TV line), and during 192 out of every 311 TV lines (1 frame) the CPU
1 'written' (or 'fired') to the CRT in a finite time to do as much
1 'pass' this-or-that part of the screen so it's safe to change something
1 'Spectrum Shadow ROM Disassembly' by Gianlura Carri, published by
1 'Programming the Z80' states that only even bytes are allowed as low
1 #FB. It is decoded using A2 only. Port #FB:
1 #38 instruction if an interrupt is requested. This is the mode the
1 "byte yy repeated xx times". Only sequences of length at least 5 are
1 "Invalid" fields are "don't care" for Z80 when loading, and "undefined"
1 Set interrupt vector
1 Set PIO mode
1 30 512 data block
1 29 1 DESCHK record descriptor checksum (of previous 14 bytes)
1 19 10 RECNAM filename (blank padded)
1 17 2 RECLEN data block length (<=512, LSB first)
1 16 1 RECNUM data block sequence number (value starts at 0)
1 15 1 RECFLG - bit 0: always 0 to indicate record block
1 14 1 HDCHK header checksum (of first 14 bytes)
1 interrupt vector
1 IN: Reads keys (bit 0 to bit 4 inclusive, in that order)
1 4 10 HDNAME microdrive cartridge name (blank padded)
1 2 2 not used
1 1 1 HDNUMB sector number (values 254 down to 1)
1 0 1 HDFLAG Value 1, to indicate header block
1 * 39 16 Contents of the sound chip registers
1 * 38 1 Last OUT to fffd (soundchip register number)
1 * 37 1 Bit 0: 1 if R register emulation on
1 * 36 1 Contains 0FF if Interface I rom paged
1 * 35 1 If in SamRam mode, bitwise state of 74ls259.
1 * 34 1 Hardware mode (see below)
1 * 32 2 Program counter
1 * 30 2 Length of additional header block (see below)
1 #FEFE SHIFT, Z, X, C, V #EFFE 0, 9, 8, 7, 6
1 #FDFE A, S, D, F, G #DFFE P, O, I, U, Y
1 #FBFE Q, W, E, R, T #BFFE ENTER, L, K, J, H
1 #F7FE 1, 2, 3, 4, 5 #7FFE SPACE, SYM SHFT, M, N, B
1 length of second block ........................^^^^^
1 header info ..............^^^^^^^^^^^^^^^^^
1 flag byte ............................................^^
1 first two bytes of rom .................................^^^^^
1 file name ..^^^^^^^^^^^^^
1 checksum of header .........................^^
1 checksum (checkbittoggle would be a better name!).............^^
1 ^^^^^...... first block is 19 bytes (17 bytes+flag+checksum)
1 WRITE
1 READ
1 R8
1 R7
1 R13
1 Port #7FFD:
1 Bit 7 6 5 4 3 2 1 0
1 Bit 7 6 5 4 3 2 1 0
1 Bit 7 6 5 4 3 2 1 0
1 13 00 00 03 52 4f 4d 7x20 02 00 00 00 00 80 f1 04 00 ff f3 af a3
1 that changed the usual flags.
1 sounds are audible if you set R6 to 31.
1 seems not to be too good, as sounds vaguely similar to tape loading
1 corresponding bits of the last 8 bit result of an instruction
1 Value: Meaning in v2.01 Meaning in v3.0x
1 Type: Format:
1 The values of bit 7, 5 and 3 follow the values of the
1 Register Name Bits used:
1 RET
1 R9 Amplitude channel B 0-4
1 R8 Amplitude channel A 0-4
1 R7 Mixer and I/O control 0-7
1 R6 Noise generator pitch control 0-4
1 R5 CTC channel C 0-3
1 R4 FTC channel C 0-7
1 R3 CTC channel B 0-3
1 R2 FTC channel B 0-7
1 R15 I/O port 2 0-7
1 R14 RS232 i/o 0-7
1 R13 Envelope control 0-3
1 R12 Envelope coarse period control 0-7
1 R11 Envelope fine period control 0-7
1 R10 Amplitude channel C 0-4
1 R1 Coarse tone control (CTC) channel A 0-3
1 R0 Fine tone control (FTC) channel A 0-7
1 Page In '48 mode In '128 mode In SamRam mode
1 Output_A = (Tone_A OR Ta) AND (Noise OR Na)
1 OUT 31,
1 ORG 32768
1 OR L
1 LD R,A
1 LD B,0
1 LD A,H
1 JR NZ,L1
1 FD 44 LD B,IYh
1 EI
1 ED5F LD A,R ED7F * NOP
1 ED5E IM 2 ED7E * IM 2
1 ED5D * RET ED7D * RET
1 ED5C * NEG ED7C * NEG
1 ED5B LD DE,(nn) ED7B LD SP,(nn)
1 ED5A ADC HL,DE ED7A ADC HL,SP
1 ED59 OUT (C),E ED79 OUT (C),A
1 ED58 IN E,(C) ED78 IN A,(C)
1 ED57 LD A,I ED77 * NOP
1 ED56 IM 1 ED76 * IM 1
1 ED55 * RET ED75 * RET
1 ED54 * NEG ED74 * NEG
1 ED53 LD (nn),DE ED73 LD (nn),SP
1 ED52 SBC HL,DE ED72 SBC HL,SP
1 ED51 OUT (C),D ED71 * OUT (C),0
1 ED50 IN D,(C) ED70 # IN (C)
1 ED4F LD R,A ED6F RLD
1 ED4E * IM 0 ED6E * IM 0
1 ED4D RETI ED6D * RET
1 ED4C * NEG ED6C * NEG
1 ED4B LD BC,(nn) ED6B # LD HL,(nn)
1 ED4A ADC HL,BC ED6A ADC HL,HL
1 ED49 OUT (C),C ED69 OUT (C),L
1 ED48 IN C,(C) ED68 IN L,(C)
1 ED47 LD I,A ED67 RRD
1 ED46 IM 0 ED66 * IM 0
1 ED45 RETN ED65 * RET
1 ED44 NEG ED64 * NEG
1 ED43 LD (nn),BC ED63 # LD (nn),HL
1 ED42 SBC HL,BC ED62 SBC HL,HL
1 ED41 OUT (C),B ED61 OUT (C),H
1 ED40 IN B,(C) ED60 IN H,(C)
1 DJNZ L1
1 DI
1 DEC HL
1 DD CB nn CE SET 0,(IX+nn)
1 DD CB nn C0 SET 0,(IX+nn) ; copy result to B
1 DD 7E d LD A,(IX+d)
1 DD 2A nn LD IX,(nn)
1 CB CE SET 0,(HL)
1 CB C0 SET 0,B
1 Byte Length Description
1 Bit 7 6 5 4 3 2 1 0
1 Address: Old: New: Address: Old: New:
1 AD8A F2 8F AD JP P,#AD8F
1 AD86 DD CB 06 7E BIT 7,(IX+6)
1 9 \__________ single decay then off
1 85 1 Disciple inhibit flag: 0=rom pageable, 0ff=not
1 84 1 Disciple inhibit button status: 0=out, 0ff=in
1 83 1 MGT type: 0=Disciple+Epson,1=Discipls+HP,16=Plus D
1 8 2 Stack pointer
1 8 \|\|\|\|\|\ repeated decay
1 7E LD A,(HL)
1 73 10 5x ascii word: keys corresponding to mappings above
1 63 10 5x keyboard mappings for user defined joystick
1 62 1 0FF if 8192-16383 is ROM, 0 if RAM
1 61 1 0FF if 0-8191 is ROM, 0 if RAM
1 60 1 0FF if Multiface Rom paged. Should always be 0.
1 6 2 Program counter
1 6 - 128k + M.G.T.
1 59 1 0FF if MGT Rom paged
1 58 1 Flag byte used by Spectator (QL spec. emulator)
1 57 1 Hi T state counter
1 55 2 Low T state counter
1 5 1 A register
1 5 - 128k + If.1
1 44 LD B,H
1 4,5,6,7 /|_________ single attack then off
1 4 4 Length of data block in bytes (Note: long word)
1 4 2 HL register pair
1 4 1 Value
1 4 1 Not used
1 4 128k + If.1 128k
1 3 [0] Compressed data
1 3 Compressed data expanding to exactly 6912 bytes of data
1 3 128k 48k + M.G.T.
1 2A nn LD HL,(nn)
1 29 1 Bit 0-1: Interrupt mode (0, 1 or 2)
1 28 1 IFF2 (not particularly important...)
1 27 1 Interrupt flipflop, 0=DI, otherwise EI
1 25 2 IX register
1 23 2 IY register (Again LSB first)
1 22528+INT (x/8)+32*INT (y/8)
1 22 1 F' register
1 21 1 A' register
1 2 2 Program counter
1 2 2 Port address
1 2 2 Length of preceding block (17472 or 17727 T)
1 2 2 Id word: Level number (between 0 and 255 inclusive)
1 2 2 BC register pair (LSB, i.e. C, first)
1 2 1 Page number of block
1 2 SamRam SamRam
1 1e000-1ffff Multiface rom (8K)
1 1a000-1dfff Disciple rom, system file 3b, HP printer code
1 19 2 HL' register pair
1 17 2 DE' register pair
1 16384+INT (x/8)+1792*INT (y/64)-2016*INT (y/8)+256*y
1 16000-19fff Disciple rom, system file 3b, Epson printer code
1 15 2 Parameter 2
1 15 2 BC' register pair
1 15 /|_________ single attack then off
1 14 /\/\/\/\/\/ repeated attack-decay
1 13 2 Parameter 1
1 13 2 DE register pair
1 13 / single attack then hold
1 12000-15fff Second Spectrum 128K rom (contains BASIC)
1 12 1 Bit 0 : Bit 7 of the R-register
1 12 /|/|/|/|/|/ repeated attack
1 11 Multiface rom Multiface rom -
1 11 2 Length of data block
1 11 1 Refresh register (Bit 7 is not significant!)
1 11 \| single decay then hold
1 10 1 Interrupt register
1 10 - page 7 -
1 10 \/\/\/\/\/\ repeated decay-attack
1 1 Compressed data (ED ED xx yy scheme, see above) expanding
1 1 10 Filename (padded with blanks)
1 1 1 F register
1 1 48k + If.1 48k + If.1
1 0e000-11fff First Spectrum 128K rom (active at RESET)
1 0a000-0dfff Second SamRam rom (contains monitor,...)
1 0BA3 20 0C 0D4C FB 00
1 0BA2 21 34 0D2D 00 10
1 0BA1 5C C3 0D2C CE 18
1 0BA0 C3 F5 0D2B F3 FD
1 0B9F 5B FC 0D2A 37 ED
1 0B9E ED ED 0D20 FB 00
1 06000-09fff First SamRam rom (contains BASIC)
1 04000-05fff Interface I rom (8K)
1 00000-03fff Ordinary Spectrum rom
1 0,1,2,3 \__________ single decay then off
1 0 8 End marker (all zeroes)
1 0 6 Separator (0,0,0,'S','L','T')
1 0 2 Time (0-17471 or 0-17726)
1 0 2 Length of data (without this 3-byte header)
1 0 2 Flag word (#FFFE)
1 0 2 Flag word #FFFF indicating wraparound-block
1 0 2 Data type: 1=level data, 3=loading screen
1 0 1 Type (0,1,2 or 3)
1 0 1 A register
1 0 (no data)
1 0 48k 48k
1 9 - page 6 -
1 8 4000-7fff page 5 4000-7fff
1 7 - page 4 Shadow c000-ffff
1 6 - page 3 Shadow 8000-bfff
1 5 c000-ffff page 2 Normal c000-ffff
1 4 8000-bfff page 1 Normal 8000-bfff
1 3 - page 0 samram rom (monitor,..)
1 2 - rom (reset) samram rom (basic)
1 1 Interface I, Disciple or Plus D rom, according to setting
1 0 48K rom rom (basic) 48K rom
1 15
1 14
1 13
1 12
1 11
1 10
1 9
1 8
1 7
1 6
1 5
1 4
1 3
1 2
1 1
1 0
1 |------ Spectrum-generated data -------| |---------|
1 ^^... flag byte (A reg, 00 for headers, ff for data blocks)
1 ^^ first byte of header, indicating a code block
1 to anything up to 48K
1 __________
1 _________
1 Ignored by Z80 when loading, zero when saving
1 If in 128 mode, contains last OUT to 7ffd
1 For example, bit 6=1 after an OUT 31,13 (=2*6+1)
1 Bit 6-7: No meaning
1 Bit 6-7: 0=Cursor/Protek/AGF joystick
1 Bit 5 : 1=Block of data is compressed
1 Bit 4-5: 1=High video synchronisation
1 Bit 4 : 1=Basic SamRom switched in
1 Bit 3 : 1=Double interrupt frequency
1 Bit 2 : 1=Issue 2 emulation
1 Bit 1: 1 if LDIR emulation on
1 Bit 1-3: Border colour
1 (Default values: 0x0103,0x0203,0x0403,0x0803,0x1003)
1 (Default values: 0x0031,0x0032,0x0033,0x0034,0x0035)
1 type 3.
1 for type 1, border colour (between 0 and 7) for
1 - bits 3-7: not used (value 0)
1 - bit 2: reset for a PRINT file
1 - bit 1: set for the EOF block
1 block, even when not all bytes are used)
1 3=Sinclair 2 Right joystick
1 3=Low video synchronisation
1 2=Sinclair 2 Left joystick (or user
1 1=Kempston joystick
1 0,2=Normal
1 defined, for version 3 .Z80 files)