VECTOR 4/8086 - Winchester / Hard-Drive Parameters in the Boot ROMFrom Inside a Vector Graphic SX/5000 (Vector 4/8086 variant)

Image: V2_AC_Interleaved_XHE_XHO.bin (Executive 2.00 AC)
Scope: Full 8 KB scan for cylinder/head/sector counts, geometry tables, drive/media keys, and constants used by the Winchester path (1066 / 1072) and geometry helper (1434).

Executive summary

Question Answer for this ROM
Fixed Winchester CHS (cylinders × heads × sectors)? Not present
Winchester geometry table in ROM? No — only a floppy media table @0831
Where does Winchester geometry come from? SYSTEM header on the drive (LBA 0 @ RAM 2410–2414) via 1434 with A < 3
Drive / media keys in ROM? Yes — config id, slot list, media-key list, two 12-byte templates
Unit-0 hardware constants? Yes — ready mask, timeouts, OUT (A6) encoding

Bottom line: This firmware does not hard-code a Winchester model (e.g. “306 cyl / 4 heads / 17 spt”). It treats unit 0 as a fixed disk, reads LBA 0 without prior geometry, then programs the driver from fields on that sector. To recover real CHS numbers you need a disk image (or a dump of sector 0), not more ROM bytes.

1. What was searched

Target Method Result
Cylinder / head / SPT constants Binary scan for plausible CHS triples (heads 1–16, spt 8–64, cyl 100–2000 in several byte orders) Many false positives inside instruction streams; no coherent HD parameter block
Geometry tables Linear dump + known 1434 consumers One table: floppy keys FA–FF @ 0831
Drive type / media keys Config region @09AA, 12B1 / 12FB Config id, 8 drive slots, FA–FF key list, templates @09B9 / @09C6
Path 1066 / 1072 Disassembly Unit 0 select, restore, direct 1638 read, format/config checks, then 1434 A=0
Helper 1434 Disassembly A≥3 → table @0831; A<3 → header @ HL (Winchester)
Unit 0 1600, 1638, 168B Distinct ready mask, timeout, and A6 unit encoding

Related: Winchester load path · Data tables · 05-helpers-disk.asm · 06-winchester-load.asm

2. Negative result: no fixed Winchester geometry

There is no ROM-resident record of the form:

cylinders = NNN
heads     = H
sectors   = S

used by menu [W] or auto-boot.

Evidence:

  1. 1072 does not call 1434 before the first read.
    First sector uses raw 1638 with DE=0000, B=01, unit A=0 — no CHS conversion.
  2. After validate, 1434 with A=0 jumps to 1481, which reads geometry from the loaded header (HL near 240B), not from @0831.
  3. Table @0831 is only walked when A ≥ 3 (CP 03h / JR C,1481). Unit 0 never takes that branch for geometry fill.
  4. Binary CHS pattern search across the full 8192 bytes found only coincidental bytes inside opcodes and string/control data — nothing referenced as a Winchester param block.

If a real drive uses e.g. 17 sectors/track or 615 cylinders, those numbers live on media (or in OS config after boot), not in this Executive image.

3. Floppy geometry table @0831 (not Winchester)

Only media-parameter table in the ROM. Used exclusively by 1434 when unit ≥ 3 (floppy path).

Raw bytes (xxd @ 0831):

FA 09 04 50
FB 08 04 50
FC 09 03 28
FD 09 05 28
FE 08 03 28   ← default B=FEh at floppy entry 1009
FF 08 05 28

Record format: 4 bytes = key, p0, p1, p2

Key p0 → (2006) p1 (packed) → (2005) bit0 → (2008) = (p1≫1)&3 p2 → (2003) lo; (2004)=0
FA 09 (9) 04 0 2 50h (80)
FB 08 (8) 04 0 2 50h (80)
FC 09 (9) 03 1 1 28h (40)
FD 09 (9) 05 1 2 28h (40)
FE 08 (8) 03 1 1 28h (40)
FF 08 (8) 05 1 2 28h (40)

Also on floppy fill path: (2007)=01h, then JP 15DE restore.

Interpretation (floppy-oriented, not proven vendor names):

Field Likely meaning
p0 (2006) Sectors-per-track class / shift divisor input to 1520 (8 or 9)
p1 packed Side / density / head packing bits
p2 (2003) Track count class: 40 (28h) or 80 (50h)

These keys also appear as the media-key list at 09B2–09B7 (FA FB FC FD FE FF) for OS config table build — still floppy media codes, not HD CHS.

If key not found: 1434 returns A=08h, B=00 (error class).

4. ROM config block @09AA (drive / media keys)

4.1 Raw dump (this revision)

09AA: C8 00 00 07 00 00 00 00   FA FB FC FD FE FF  00
09B9: 88 00 00 00 00 40 01 00 00 01 04 FE     ; 12-byte template A
09C6: 80 00 00 00 00 40 01 00 00 02 04 FE     ; 12-byte template B
09D3: FF FF …                               ; pad to end of config area

4.2 Field map

Addr Dump Role
09AA C8h Primary Winchester / system config id. Nonzero → menu shows [W], auto-boot may CALL 1072. Compared to disk header (240B) on Winchester load.
09AB 00 Drive-id slot (with 09AA… as 8-byte list)
09AC 00 slot
09AD 07h Floppy-related slot id (12FB treats ==07 specially)
09AE–09B1 00 Remaining slots (8 total starting at 09AA)
09B2–09B7 FA…FF Geometry/media key list (same keys as @0831)
09B8 00 Pad / separator
09B9 12 bytes Media template (default when (2442)&30h ≠ 10h)
09C6 12 bytes Media template when (2442)&30h == 10h

4.3 How 09AA is used on Winchester boot

1072 path:
  …
  LD A,(09AA)
  LD HL,240B
  CP (HL)          ; header +0B must equal ROM config id
  JR Z, ok
  LD A,05h / SCF   ; CONFIGURATION MISMATCH

This dump requires disk +0B = C8h. Another Executive burn may differ — always read ROM[0x9AA].

4.4 Eight drive-id slots (12B1)

12B1 (type-21h config builder, vector 0024):

  1. Zero 6600… for 60h bytes.
  2. IX = 09AA, B = 8.
  3. For each slot byte: search disk header records at 244C (12-byte stride) for matching id via 12E6.
  4. On match, LDIR 12 bytes into the 6600 table; on miss, clear the ROM slot byte and skip.

So 09AA…09B1 are configuration identity slots, not CHS. Only the first nonzero slot (C8) is meaningful for Winchester match on [W]; the full list matters when building the OS drive table after a type-21h floppy load.

4.5 Media templates (12FB)

12FB (vector 0027) builds media table at 6660:

  1. Zero 6660 for D0h bytes.
  2. Choose template:
    • if (2442) & 30h == 10h → HL=09C6
    • else → HL=09B9
  3. Walk three slots starting IX=09AD with C=3…; when slot value is 07h, write A = (HL)+C then copy 12 bytes from the template into the media table.
  4. If (09AA)≠0, call 12E6 / 1434 A=0 and optionally read Winchester LBA 0 → 2200, verify format 02 and eight config ids against 09AA…, then scan from LBA 36h.

Template payloads (not CHS tables):

Template Bytes (12)
@09B9 88 00 00 00 00 40 01 00 00 01 04 FE
@09C6 80 00 00 00 00 40 01 00 00 02 04 FE

Shared middle 40 01 and trailing 04 FE look like capacity / media-type / key fields for the OS table, not driver CHS. Exact OS-level meaning is outside this ROM’s boot path.

5. Winchester path constants (1066 / 1072)

5.1 Control flow (parameters only)

Step Code Parameter
Clear flag (67F6)=0 Load/status flag
Unit A=00h Unit 0 = Winchester
Select CALL 1600 Unit-dependent ready wait
Restore A=0, C=01h, CALL 15DE C bit0 selects restore variant
Buffer HL=2400h SYSTEM header destination
Address B=01h, DE=0000, C=00 Programmed to A3/A5/A4 via 168B
Read CALL 1638 512 bytes (INIR×2 from port A0)
Format (2402)==02h Else A=2, CF — UNRECOGNIZED MEDIA FORMAT
Config (240B)==(09AA) Else A=5, CF — CONFIGURATION MISMATCH
Geometry A=0, CALL 1434 Header path 1481
Success Menu: JP 2400; auto-boot: CALL 2400

5.2 Unit 0 vs unit ≥3 (hardware constants)

Item Unit 0 (Winchester) Unit ≥3 (floppy) Where
Ready mask on A7 D0h F0h 1600 @161B / @1616; also 1638 @1641/@163C
Select timeout DE 1388h (5000) 7530h (30000) 1600 @161D / @1611
Error H seed starts 2, INC → 3 on unit0 path stays 2 1600
OUT (A6) unit bits (A<<3) \| A0h \| (C&07h) ((A-3)<<1) \| 38h \| (C&01h) 168B @16AD vs @169F
First sector API 1638 direct 14A8 (uses geometry) 1072 vs 1000
Geometry source Header @2410+ Table @0831 or header key +15 1434

Timeout 1388h also used as the generic ready-wait budget in 16BC.

5.3 Controller ports (shared)

Port Role
A0 Data (512-byte INIR×2)
A1 Sense (probe / error class)
A2 Address (always written 01 then related)
A3 Address from B (first HD read uses B=01)
A4 Address from E (LBA low)
A5 Address from D (LBA high)
A6 Unit / control (see encoding above); probe uses B0h
A7 Command / status (20h = read cmd in 1638)
A8 Gate / probe (15AA)

5.4 Auto-boot gate

012B: if (09AA)==0 → skip to menu
      else print LOADING, CALL 15AA, CALL 1072, CALL 2400

No extra geometry constants on that path.

6. Geometry helper 1434 — Winchester branch (1481)

6.1 Entry

1434  CP  03h
      LD  (2009),A     ; unit
      JR  C,1481       ; ★ A < 3  → header geometry (Winchester)
      ; else floppy table @0831 …

Winchester load calls with A=0 and HL ≈ 240B (left from the config CP).

6.2 Header → driver RAM map

Starting HL = 240B:

Steps Source (header) Dest Notes
INC HL ×5 → 2410 Skips +0B…+0F
LD A,(HL) +10 (2410) (2006) Shift / block param (same role as floppy p0)
word (HL+) +11–+12 (2411) (2003) LE word Divisor / SPT-class for LBA math in 14A8
LD A,(HL) +13 (2413) (2008) Head-related packing (floppy uses packed bits here)
LD A,(HL); OR A +14 (2414) (2007) = 0 or 1 Density / restore flag → also C for 15DE
(2005) Not written on Winchester path
(2004) Not cleared on Winchester path (floppy sets 0)
JP 15DE Second restore with new geometry

6.3 How 14A8 uses these for unit < 3

When later multi-sector I/O runs with unit < 3 (e.g. type-21h finish reading the Winchester):

  1. (2006) fed to 1520 — shift/mask helper on the LBA.
  2. Branch 14DE: repeatedly SBC HL,DE with DE=(2003) to convert linear address → remainder/quotient (C = track-like quotient, DE = sector-in-track remainder).
  3. Skips loading head from (2005) (CP 03 / JR C → does not LD D,(2005)).
  4. Programs address regs and CALL 1638.

So the only “sectors per track / geometry word” the driver trusts for Winchester is whatever the disk header placed at +11. The ROM never supplies a default for that word on unit 0.

Off Size Boot check / use
+00 2 Entry (JP/CALL 2400); often 18 01 JR over format byte
+02 1 Must be 02h
+0B 1 Must equal (09AA) (C8h this dump)
+10 1 → 2006
+11 2 → 2003 (geometry word)
+13 1 → 2008
+14 1 → 2007 (0/1)
+15 1 Floppy geometry key only (ignored by pure [W] path)
+42 1 Flags/type (ignored by pure [W] path)

Zeros in +10…+14 may pass load if no further multi-sector I/O is required before your code at 2400 runs; a vendor OS image will carry real values.

7. Driver workspace (2000h) — Winchester-relevant

Addr Set by Winchester 1434? Role
2003–2004 Yes (word from +11) Geometry divisor / SPT-class
2005 No Side/head (floppy table only)
2006 Yes (+10) Shift / block
2007 Yes (+14 → 0/1) Restore / density flag
2008 Yes (+13) Head-related
2009 Yes (A) Unit = 0
200E Floppy only From C>>4 when A≥3

8. Strings (labels only)

Addr Text
05D2 [W] .. LOAD SYSTEM FROM WINCHESTER
0872 area UNRECOGNIZED MEDIA FORMAT (sys error #2)
config mismatch system error #5 text in error table

No string encodes CHS or a drive model name.

9. What is not in this ROM (open / needs media)

  1. Actual cylinder, head, and sector counts for any Winchester model.
  2. A second geometry table keyed by config id C8h.
  3. Interleave factors, landing zone, write-precomp cylinder.
  4. Meaning of address byte B=01 on first 1638 beyond “written to port A3” (controller-specific; not expanded in ROM).
  5. Whether vendor HD images use type-21h layout on fixed disk (menu [W] does not load type 21h).

To capture real geometry: dump LBA 0 from a working SX/5000 Winchester and read bytes at offsets +10…+14 (and any OS partition/superblock the Executive leaves for later).

Value Where Meaning
00h 1072, 1434 A Unit number (Winchester)
02h (2402) check Format id
05h error A CONFIGURATION MISMATCH
02h error A UNRECOGNIZED MEDIA FORMAT (Winchester format fail)
C8h 09AA Config id (this dump)
07h 09AD Floppy slot id in templates path
FA–FF 0831, 09B2 Floppy media keys only
D0h ready mask Unit 0 status mask
F0h ready mask Non-zero unit status mask
1388h timeout Unit 0 select / general ready wait
7530h timeout Non-zero unit select wait
A0h 168B Base bits in OUT (A6) for unit < 3
38h 168B Base bits for unit ≥ 3
20h 1638 Read command to A7
B0h 1600/15AA Control pulse to A6
01h first read B Address byte to A3
0000h first read DE LBA 0
2400h buffer Sector load address
512 INIR×2 Sector size in bytes
36h 12FB scan start LBA start when enriching type21 from HD
0Ch record size Drive/media records at 244C / templates

11. Conclusion

Useful parameters found: unit-0 encoding, ready/timeout constants, config id C8h, drive-id slots, floppy-only geometry table (for contrast), media templates, and the exact header offsets that define Winchester geometry at runtime.

Not found: any ROM-built-in Winchester cylinder/head/sector geometry.

The constants and the header contract are real and actionable; they simply are not a fixed CHS table.

← Back to Main Page ← ROM Files & Docs ← ROM Docs Home ← Section index

If anyone has additional information, manuals, schematics, or software for this Vector 4/8086 CPU variant (Vector Graphic SX/5000), please contact me.

email

Document generated: July 31,2026
Updated: July 31, 2026

© 2026 familybusinesssoftware.com