Vector 4/8086 ROM Docs – VECTOR 4/8086 - Dual-CPU Architecture (Z80B + 8086)

Machine: Vector Graphic Vector 4-8086 / SX/5000
This ROM: Executive 2.00 (AC) Z80 Boot only — 8 KB image
Primary handoff path: type-21h load → 13A9 → JP FF4Ch
Related: Handoff 13A9 → FF4C · handoff-13A9.asm · Memory map

1. Roles of the two CPUs

CPU	Boot ROM	Evidence
Z80	Owns reset, I/O init, menu, disk load, self-test, mapper, first transfer	Entire image disassembles cleanly as Z80; vectors at `0000` are `C3`/`C9`
8086	No boot 8086 code found in this EPROM pair	No `mov ax,cs` / `mov ds,ax`, no reset at `1FF0`, no 8086-favoring code windows
8086 (runtime)	Likely started after Z80 prepares RAM + control ports + optional far-jump image	Stub `OUT (02),01`; param block `EA`+seg:off at `67F0`; high bases `FE00`/`FE60`

Hardware notes: Only four ROMs on the board (2× CG + 2× this boot). Z80 OS/helper code is loaded to RAM; 8086 code would come from the SYSTEM file or a later stage, not from these 2732s.

2. Final handoff code `13A9` → `JP FF4C`

Entry

From	How
Type-`21h` success	`JP 13A9` `@11BD`
Jump table	`JP 13A9` `@002A`

Step-by-step

13A9  LD HL,FE60 / LD (67E4),HL
13AF  LD HL,FE00 / LD (67E0),HL
13B5  LD HL,(0FFB) / LD (67E8),HL     ; dump: FFFF
13BB  LD HL,0200 / LD (67EA),HL
13C1  LD A,48 / LD (67EC),A
13C6  LDIR 0573 → 674C, BC=0012h      ; copy 18-byte Z80 stub
13D1  LD HL,E40C / LD (67EE),HL
13D7  LD A,EAh / LD (67F0),A          ; 8086 JMP FAR opcode
13DC  LD A,(5FDD) / LD (67F5),A       ; RAM-size flag
13E2  OR A
      HL = 1000h if Z else 3000h
      LD (67E2),HL / LD (67E6),HL
13F1  JR Z, 140B                      ; small RAM: skip swap

; --- large RAM only ---
13F3  LD D,3F / CALL 0436             ; map bank 3F
      swap 8 bytes (67F0..67F7) ↔ (77F0..77F7)
      LD A,01h                        ; “large RAM” marker

140B  EX AF,AF'                       ; preserve 0/1 for epilogue
140C  LD C,16h / LD D,0 / LD B,0
1412  loop:
        LD A,D / CPL / OUT (C),A      ; OUT (16), ~bank
        LD A,B / ADD A,08 / LD B,A
        JP Z, FF4Ch                   ; ★ B wrapped F8→00
        INC D
        if B==F0: LD D,CEh / continue ; video bank slot
        if B==F8: epilogue
        else loop

; epilogue when B becomes F8:
142A  EX AF,AF' / OR A
      LD D,3Fh / JR Z, loop           ; small: final ~3F = C0h
      LD D,7Fh / JR loop              ; large: final ~7F = 80h
; next iteration: OUT final bank, B=00 → JP FF4C

After `JP FF4C`

Item	Fact
Still Z80?	Yes — opcode is Z80 `C3 4C FF`
In boot ROM?	No — image is only `0000`–`1FFF`
What runs	Bytes visible at `FF4C` under the final mapper state = loaded SYSTEM (and/or high RAM prepared during bulk load)
Return	None — Executive does not come back to the menu

Simple floppy / Winchester paths never reach 13A9; they use JP/CALL 2400.

3. Control ports that could release / reset the 8086

Full-ROM scan of real OUT/IN (false positives from strings/LD (nn),A filtered).

Only dual-CPU-specific candidates

Port	Access	Where	Value / meaning
`02h`	OUT only once	Stub `@0575` (copied to `674C`)	`A=01h` — strongest 8086 release/hold line candidate
`0Ch`	IN only once	Stub `@0580`	Status / ready / sync after remap (before `JP 0000`)

0573  LD A,01h
0575  OUT (02h), A      ; ★ unique in entire ROM
0577  …
057E  OUT (16h), FFh    ; mapper
0580  IN A, (0Ch)       ; ★ unique
0582  JP 0000h

Important: 13A9 copies this stub to 674C but does not CALL it. Primary transfer is JP FF4C. The stub is a second-stage helper for the loaded OS (or dual-CPU protocol) to:

Drive port 02 (likely un-reset / bus grant / 8086 RUN),
Force a known mapper value,
Sample port 0C,
Re-enter at 0000 under the new map (possibly now shared with or owned by the other CPU’s view of memory).

Ports that are not 8086-specific (but part of “machine ready” state)

Port	Role before handoff
`16h`	Memory mapper — full rebuild in `13A9`; also cold boot, bulk load, tests
`00`/`01`	Keyboard / console (`OUT 00` values `08`, `10`, `02`)
`0E`/`0F`	CRTC
`04`	Video data stream
`A0`–`A8`, `10`, `13`	Disk subsystem
Cold table `9x`/`1A`/`1B`/`70`	Early hardware init

No other port is written with a one-shot “start the 8086” pattern. There is no classic 8086 reset-vector programming in this ROM (F000:FFF0 / FFFF:0000 image area is zeros).

Console `OUT (00),02` (`03DD`)

Used on error paths and test failures — not the dual-CPU stub. Same port family as keyboard, different from port 02.

4. Scanning the 8 KB ROM for 8086 code

Method

Z80 flow-following (known good for boot/load/test).
Pattern search: 8C C8 8E D8 (mov ax,cs / mov ds,ax), FA FC B8 (cli/cld/mov ax), far EA with sensible seg:off.
Sliding-window scores (Z80 vs 8086 heuristics).
ndisasm -b16 vs radare2 -a z80 on padding and mid-image regions.
String search: 8086, Z80, CPU, 8088, INTEL — none.

Results

Finding	Detail
No 8086 code body	No region that is garbage as Z80 but clean as 8086
False `EA` hits	`@13BF`, `@13D8` sit inside Z80 handoff immediates (`LD (67xx)`, `LD A,48`, etc.), not real far jumps
False `INT`/`RETF`	`CD nn` = Z80 `CALL`; `CB` = bit ops; not 8086 INT/RETF streams
Padding	`09D3`–`0FFC`: 1578 × `FFh`; `16DC`–`1FFF`: 2340 × `00h` — empty, not 8086 BIOS
Last real code	`16DB` = `C9` (end of disk driver); rest is pad
8086 reset area	Offset `1FF0` = zeros — this image is not an 8086 boot ROM

Conclusion: Dual-CPU support in this EPROM is preparation and transfer only. 8086 instructions maybe in the loaded SYSTEM image, not in boot XHE/XHO ROM.

5. How the Z80 prepares the machine for the 8086

Phase A — Any successful boot path

DI, program I/O table, mapper probe, video/CRTC, console.
Optional self-test.
Load SYSTEM (floppy simple / Winchester / type-21h).
Leave keyboard, disk, and screen in a known state.

Phase B — Type-`21h` only (dual-CPU setup)

Preparation	Where	Purpose
SYSTEM body in banked RAM	bulk `0420`+`1231` → banks via `7000` window	OS code/data for both CPUs to share after map
Drive/media tables	`6600` / `6660`	OS configuration
Param block	`67E0`–`67F5`	High bases `FE00`/`FE60`, size flag, constants
8086 far-jump image	`67F0`: `EA` + offset `(2227)` + segment `(2229)`	Ready-made JMP FAR for 8086 if it starts executing there or is pointed at it
Z80 stub	`674C` ← `0573`	`OUT (02),1` + map + `IN (0C)` + `JP 0000`
Optional vector swap	`67F0`↔︎`77F0` under bank `3F`	Coherent copy of trampoline in high window
Full mapper rebuild	port `16h` walk + final `3F`/`7F`	Define physical layout including high memory
Transfer	`JP FF4C`	Z80 enters loaded system at high address

Phase C — Possible later (not executed by `13A9`)

Someone (code at FF4C or OS) may:

CALL/JP 674C
  → OUT (02),01     ; release / un-reset 8086 (hypothesized)
  → OUT (16),FF
  → IN A,(0C)
  → JP 0000

and/or the 8086 may begin at a reset vector that eventually uses the EA trampoline at 67F0.

                    ┌─────────────────────────────────────┐
  Z80 cold boot     │  init I/O, mapper, video, menu      │
                    └───────────────┬─────────────────────┘
                                    │ load SYSTEM
            ┌───────────────────────┼───────────────────────┐
            ▼                       ▼                       ▼
     simple floppy            Winchester              type 21h file
     JP/CALL 2400             JP/CALL 2400            multi-bank load
            │                       │                       │
            │                       │                       ▼
            │                       │                 13A9 setup 67xx
            │                       │                 stub@674C, map walk
            │                       │                       │
            └───────────────────────┴───────────┬───────────┘
                                                ▼
                                         Z80 runs OS entry
                                      (2400 or FF4C)
                                                │
                              optional: stub OUT(02),1
                              optional: 8086 uses EA@67F0
                                                ▼
                                         dual-CPU OS runtime

6. Where control is transferred

Path	Transfer instruction	Address	CPU	Code source
Floppy simple	`JP 2400`	`2400`	Z80	First sector buffer
Winchester menu	`JP 2400`	`2400`	Z80	First sector buffer
Winchester auto-boot	`CALL 2400`	`2400`	Z80	First sector buffer
Type `21h`	`JP FF4C`	`FF4C`	Z80	Loaded SYSTEM under final map
Stub (if invoked)	`JP 0000`	`0000`	Z80	After `OUT (02)` / remap
8086	not in this ROM	reset vector / far jump	8086	SYSTEM / hardware reset path

Primary dual-CPU-oriented transfer in this firmware:
Z80 JP FF4Ch after mapper rebuild, with 8086 start only prepared (port-02 stub + EA image), not performed as an 8086 opcode fetch from this ROM.

7. Parameter block as dual-CPU interface (`67E0`)

Offset	Content	Dual-CPU reading
`+00` (`67E0`)	`FE00`	High workspace / possible 8086-visible region
`+04` (`67E4`)	`FE60`	Secondary high pointer
`+02`/`+06`	`1000`/`3000`	Z80 RAM floor by size
`+10` (`67F0`)	`EA oo oo ss ss`	8086 JMP FAR built from SYSTEM header words
`+15` (`67F5`)	`5FDD`	Memory configuration
`674C`	Z80 stub	Explicit port 02 handshake

The SYSTEM file fields at header structure offsets used for (2227)/(2229) are therefore part of the cross-CPU contract: the disk image supplies the far-jump target the 8086 is expected to use.

8. Open hardware questions

Exact electrical meaning of OUT (02),01 (8086 RESET#, HOLD/HLDA, bus grant, NMI, …).
Meaning of IN A,(0C) after that write.
Whether FF4C code is pure Z80 that later hits 674C, or mixed.
8086 physical reset vector location on the Vector 4-8086 board (not in this ROM dump).
Shared RAM map: which mapper banks the 8086 decodes as its low megabyte.

9. Summary

Question	Answer from this ROM
Who boots first?	Z80 from `0000`
Is 8086 code in XHE/XHO?	No
How is 8086 prepared?	RAM load, mapper, `EA` trampoline @67F0, stub with `OUT (02),1` @674C
Who is released via I/O?	Only candidate: port `02` ← `01` in the stub (not auto-run by `13A9`)
Where does Z80 go?	`JP FF4C` (type 21h) or `JP/CALL 2400` (simple/Winchester)
Who starts the 8086?	Not shown as a direct far jump in this ROM — likely SYSTEM at `FF4C` and/or stub + hardware

Cross-references

Doc	Topic
Handoff 13A9 → FF4C	Line-level handoff / mapper
Type 21h SYSTEM FILE	Load that leads to `13A9`
Reset / entry path	Z80 cold start / mapper probe
Memory map	Ports and RAM
08-handoff-13A9.asm	Assembly language code listing

If anyone has additional information, manuals, schematics, or software for this Vector 4/8086 CPU variant (Vector Graphic SX/5000), please contact me.

VECTOR 4/8086 - Dual-CPU Architecture (Z80B + 8086)From Inside a Vector Graphic SX/5000 (Vector 4/8086 variant)