Timex ROM

Many people know about the working TS2068 commands that aren't documented in your owner's manual. For example, OPEN# 2,"p" will redirect all output from a PRINT statement to your printer, rather than your screen. There are also commands that are only "half there". Turn on your TS2068, and type in the following "program":

10 LOAD *"m",3,"test"

20 CAT "d",3,4

30 FORMAT "m",1,2,3,"junk"

40 OPEN #3,"j",1,2,"moretrash"

50 MOVE "a","garbage",2,5

60 ERASE "b",1,"nonsense"

You may be surprised to find that every one of these commands can be entered into your machine, and it will accept them, but not one of them will actually RUN! (You'll get an error message, instead.) Furthermore, each one will take as long a list of string and numeric items as you'd like to given, provided you give at least one, following the single letter in quotes. (Except for the OPEN# command, witch normally needs no extra list following the letter.)
What gives? The Timex-Sinclair machines are supposed to do complete syntax checking when you type your lines in; how did it miss these? Well, there is a class of commands that only work when extra hardware is plugged into your machine. There are two ways these could have been implemented, and the TS 2068 designers seem to have left both options open. The first method is largely copied from the Sinclair Spectrum, ant it works like this. BASIC can do two things when it "sees" a program line. If you're typing the line in, it runs the Syntax Checker. If it's RUNning a program, it looks up the address of the routine that executes the command and runs it. (if you type in a line with no line number, it does both.)
This is also true for the above extended commands. We think we see a difference because the routine that runs the command is designed to end up with the printing of an error message. Thus, if you type in the proper syntax, the machine will properly accept the line, and when you RUN it, it "properly" prints an error code.
Whatever for? The program that prints error messages (for both the TS2068 and the Spectrum) is at location 0008. Those familiar with Sinclair's Interface One, for the Spectrum, know that it switches in it's "shadow ROM" whenever the instruction at 0008 is run. The shadow ROM then checks the cause of the error, scans the present BASIC line, determines if it's supposed to be running an extended command, and acts accordingly. While this might seem like an odd way to add commands, it contains a perverse sort of beauty. It makes it possible to design a computer and include all the ROM code necessary to run future add-ons, without really knowing what those add-ons will look like, or what real software is needed to run them. It's a great way to "buy time"
If this method were used, we can guess that the BEU would have extra hardware to switch in the "Superbank" mentioned in the past. This would be analagous to the shadow ROM. Since the Home ROM code contains nothing to link it to a bank switching interrupt handler, perhaps the "Superbank" may have switched in when the code at 0038 (the keyboard interrupt handler) was run.
There is a second option. In routines to "run" the extended commands, we tend to find a JUMP instruction to code to print the error message. But following that JUMP is usually found extra code that appears to look up an address in the SYSCON table and CALL the routine in its expansion bank. It also passes on whatever list of information was tacked onto the end of the statement. As such, if the JUMP is NOPed out, it appears that the system should find code in an expansion bank to actually handle the command. Furthe more, these extra blocks of code are not used anywhere in the ROM! They were almost certainly intended to link the extended commands to the expansion banks. Why were they blocked from that purpose?
Nothing is simple. Once again, there are two fairly reasonable options. In essentially every case, the little packet of code that's blocked off contains one or more fatal bugs that would have been fairly clear to the designers that new, bugless ROM would be needed for bank switching anyway, they could save debug time by simply hiding the code that the original ROMs would really not need.
The other option centers around the timing of separate Timex and Sinclair developments. The Sinclair Interface One was released around the same time as the TS2068 was, and its relative simplicity suggests that design on the TS2068 was begun a good deal before the Interface One. As such, the original TS2068 designs could not have considered it, and if Timex did eventually plan to copy the Interface One's mothod into its own microdrive interface, they would have had to make some changes.
While blocking off some of their code might seem a sloppy way to do this, it would have worked, and the rest od the Timex modifications to the Spectrum code aren't very neat, either. As a glaring example, we can find several routines in the ROM that were probably used by the programmers to debug the code, but aren't used by the ROM, itself. This method is fairly universal, but the comman practice is to remove your debug garbage before assembling the version that's to go into ROM.
It's a similar bit of sloppiness that makes this second option the most likely. You see, one of these "blocked off" bits of code seems to have quite a few instructions mising from it; it could never workd as is. Now, I know that some of you have bootleg copies of Timex's original source code listing for theROMs. If you'll look at the code following the JP at 25E1 in the Home ROM, you'll see that Timex "commented out" a full 28 lines of code, witch would have assembled into about 43 bytes. These would have restored the missing functions, but the Home ROM only has 36 spare bytes in it (3CDC, and folowing), so these extra bytes wouldn't have fir. Rather than to search for debug garbage to delete, they sinply hacked out some code that might otherwise have been funcional! Clearly, it wasn't too important to them. As such, they were probably oing to copy the method (ans as much software as possible!) from the Interface One.
While we can bounce these, and a whole lot of other bits of circumstantial evidence around, we can get no conclusive anwser. In the end, it doesn't matter. If we wish to restore the bank switching functions, we can use either option. But it does help to understand that both options are there. It's also worthwhile to note that restoring the blocked out code would make the hardware design somewhat simpler for us.

Extracted from Time Design Magazine - Jan/Feb 1987

More things about TS2068 commands:
Timex Sinclair 2068 statement extensions:
CAT x$,[c...]
DELETE [m],[n]
ERASE x$,[c...]
FORMAT x$,[c...]
LOAD *x$,[c...]
MERGE *x$,[c...]
MOVE x$,[c...]
ON ERR {GOTO x|CONTINUE|RESET}
OPEN #m,x$,[c...]
SAVE *x$,[c...]
SOUND m,n[;p,q...]
RESET [{*|#n}]
VERIFY *x$,[c...]

TS2068 basic also doesn't accept incomplete syntax forms for:
ERASE x$
FORMAT x$
CAT
MOVE x$,y$.

The Timex Sinclair 2068 also introduces two new numerical functions:
STICK (m,n)
FREE

Here are the TS2068 commands and functions:
TS and TC2068 accept those commands and produces the J error:

J Invalid I/O device, 0:1

Note that some commands are almost the same in TOS!
For example the SAVE command:

In Timex 2068: SAVE *x$,[c...]
In TOS: SAVE *x$

This might be an attempt to put TOS internally in Timex 2068! Maybe the Timex Computer Corp. people didn't had enought time to finish TOS to put it in Timex 2068. In my TC2068 manual in the TC2068 BASIC revision apendix, Timex of Portugal didn't correct the errors and the manual was printed with the incorrect syntax of CAT, MOVE, ERASE and FORMAT.

Memory Bankswitch System

The Timex's system of memory bankswitching supports three internal 64 Kb memory banks called HOME, EXROM and DOCK. The HOME bank contains 16 Kb ROM (called HOME ROM) at addresses 0-16383, and the rest of the 48 Kb is filled with RAM. The EXROM bank initially contains only 8 Kb ROM (called EXROM ROM). This ROM is not fully decoded, so its image repeats itself 8 times (e.g. at addresses 0-8191, 8192-16383, 16384-24575 and so on). The DOCK bank is initially empty and connected via pull-up resistor (so reading from it will give #FF). Its purpose is memory expansions (ROM or RAM) using cartridges which you can plug into the cartridge dock on Timex computer. Although the EXROM bank is not designed for expansions, cartridges exist which are mapped into this bank.

ROM extensions mapped into the DOCK bank are mostly implemented as LROS (Language ROM Oriented Software) and AROS (Application ROM Oriented Software). LROS programs are mapped at address 0 in the DOCK bank and they must be written in machine code. AROS programs are mapped at address 32768 in the DOCK bank, and may be either in machine code or in BASIC (The Timex BASIC interpreter allows the running of BASIC programs from the DOCK bank). LROS programs always have autorun and they will be started after initialization of the Timex computer is finished (an example of such software is Zebra OS_64). AROS programs may be or may not to be autorun programs. Both type of programs have a short header at the beginning which contains the necessary informations (start address etc.) for their execution.