Reverse engineering the Titan QX-PC
I recently managed to acquire a Titan QX-PC for the Epson QX-10 computer. This card contains a 8088 processor that will allow an Epson QX-10 to run DOS programs. It comes with a memory board supporting 256k of memory, though it was possible to purchase a second memory board that would allow for a total of 512k of DOS addressable memory.
I have begin an effort to reverse engineer this board. The first step in the process was to make a rough schematic of both boards using a multimeter to determine the connections between pins. This has allowed me to get a fairly decent understanding of how the boards work. Since the QX-10 Bus does not have provisions for bus sharing between CPUs, the 8088 communicates with the Z80 CPU via interrupts and IO ports allowing the Z80 to handle video and peripheral access.
The card provides the following four Z80 IO ports:
Port | Access | Desciption |
---|---|---|
0xD1 | R/W | Data Transfer Between Z80 and 8088 |
0xD7 | W | Trigger 8088 interrupt vector |
0xD3 | R | Read low byte of 8088 address bus |
0xD5 | R | Read high byte of 8088 address bus (bit 6 is /WR) |
The Epson QX-10 bus supports three interrupts (INTL, INTH1, and INTH2) all of which are used by the Titan QX-PC card.
- INTL - This is triggered when a write is performed by the 8088 to IO port 0x400
- INTH2 - This triggers when the 8088 does a read/write from/to an IO port (besides 0x400)
- INTH1 - This is used to emulate direct VRAM access on the 8088. Any acces to memory between 0xB0000-0xBFFFF will trigger it.
Synchronization between the Z80 and 8088 is done via the 8088’s ready line. As long as one of the three Z80 interrupts is active the ready line will be held low and the 8088 will generate wait states. The interrupt lines are all reset when a write occurs to port 0xD1, meaning the Z80 has finished processing a request.
The 8088 uses IO port 0x400 as a control port to send commands and data to the Z80 and receive data back.