Acorn Econet Bridge 1

Probes pages upward from &1800 by writing &AA and &55 patterns through mem_ptr_lo/mem_ptr_hi (&80/&81) and verifying each. The highest page that verifies is stored in top_ram_page (&82), used downstream by workspace initialisation. The Bridge can be built with either one 8 KiB 6264 chip or four 2 KiB 6116 chips (chosen by soldered links), so RAM size must be discovered at power-on.

The routine looks like a textbook two-pattern memory test but is considerably more robust than a naive STA/LDA/CMP would be. Three independent mechanisms have to fail simultaneously for it to report RAM where none exists:

  1. The INC on zero-page &00 between each write and its matching
     read is an anti-bus-residue defence. When the 6502 writes to
     an unmapped address, no chip latches the value, but the data
     bus capacitance can hold the written byte long enough for
     the subsequent LDA to sample its own ghost. INC $00 is a
     read-modify-write that drives the data bus three times with
     values unrelated to the test pattern (the cycle-4 dummy
     write is a classic NMOS 6502 quirk that is exploited here),
     clobbering any residue of &AA or &55.

  2. The choice of &00 specifically is an alias tripwire. If the
     address decoder is miswired and the target address aliases
     into zero page, the obvious alias landing point is &00 — so
     disturbing &00 between write and read forces any alias-based
     false-positive to fail the CMP.

  3. The two patterns &AA and &55 are bitwise complements: a
     stuck bit is detected on whichever pattern it contradicts,
     and a single-value bus residue cannot spoof both checks
     simultaneously.

See docs/analysis/ram-test-anti-aliasing.md for the full cycle-level analysis.

Second half of the reset handler. Clears announce_flag so the idle-path re-announcer starts quiescent, then builds a single BridgeReset template (ctrl=&80, port=&9C, payload=net_num_b) and transmits it twice: first on side A with net_num_b in the payload, then on side B after patching the payload to net_num_a. The two wait_adlc_?_idle calls gate each transmit on carrier-sense; either can escape to main_loop if the line never goes idle.

Falls through to main_loop on success. A clean reset therefore emits exactly two frames before steady-state polling begins. See two-broadcasts-one-template.md for why one template suffices.

The Bridge's continuous-operation entry point. Reached by fall- through from the reset handler once startup completes, and by JMP from fourteen other sites — every routine that takes an "escape to main" path (wait_adlc_a_idle, transmit_frame_a/b, etc.) lands here, so main_loop is the anchor of every packet-processing cycle.

The header (&E051-&E078) forces each ADLC into a known RX-listening state: if SR2 bit 0 or 7 (AP or RDA) is already set from a partial or aborted previous operation, CR1 is cycled through &C2 (reset TX, leave RX running) before setting it to &82 (TX in reset, RX IRQs enabled). CR2 is set to &67 — the standard listen-mode value used throughout the firmware.

The inner poll loop at main_loop_poll (&E079) tests SR1 bit 7 (IRQ summary) on each ADLC in turn, with side B checked first. If either chip has a pending IRQ, control jumps straight to the corresponding frame handler; otherwise the idle path at main_loop_idle (&E089) runs the periodic re-announcement.

The re-announce scheme uses three bytes of workspace:

  announce_flag   enables re-announce (bit 7 additionally selects
                  which side the re-announce goes out on)
  announce_tmr_   16-bit countdown, decremented every idle-path
    lo/hi         iteration; zero triggers the re-announce
  announce_count  remaining re-announce cycles; when this hits
                  zero, announce_flag is cleared and re-announce
                  stops until something else re-enables it

The re-announce path (&E098) rebuilds the announcement frame, sets tx_ctrl to &81 (distinguishing it from the reset-time &80 first announcement), then dispatches to side A or side B based on announce_flag bit 7. The timer is re-armed to &8000 (32768 idle iterations) after each announce, giving a roughly constant cadence regardless of how busy the ADLCs are with other traffic.

Reached from main_loop_idle once the 16-bit announce_tmr has ticked down to zero *and* announce_flag is non-zero. Both conditions are only met after rx_?_handle_80 has set the flag in response to a BridgeReset received from another bridge. This routine is the per-tick action of that response burst -- it is NOT a self-scheduled periodic announcement.

Rebuilds the outbound template via build_announce_b and patches tx_ctrl from &80 (the BridgeReset value the builder writes) to &81 (BridgeReply), distinguishing the follow-up announcements from the initial one that triggered the burst.

Which side to transmit on is selected by announce_flag bit 7:

  bit 7 clear (flag = 1..&7F)  ->  transmit via ADLC A (side A)
  bit 7 set   (flag = &80..FF) ->  transmit via ADLC B, after
                                   patching tx_data0 with
                                   net_num_a, mirroring the
                                   reset-time dual-broadcast.

Each invocation decrements announce_count. When it hits zero, announce_flag is cleared (re_announce_done); the burst is complete and the idle path goes quiet until another BridgeReset arrives. Otherwise the timer is re-armed to &8000 and control returns to main_loop (re_announce_rearm).

Before transmitting on one side, the routine resets the OTHER ADLC's TX path (CR1 = &C2) to prevent the opposite side from inadvertently transmitting a colliding frame while we're busy.

Reached from main_loop_poll when ADLC A raises SR1 bit 7. Drains the incoming scout frame from the RX FIFO into the rx_* buffer at &023C-&024F, runs two levels of filtering, and then dispatches on the control byte to per-message handlers.

Filtering stage 1 — addressing:

  Expect SR2 bit 0 (AP: Address Present) -- if missing, bail to
  main_loop (spurious IRQ).

  Read byte 0 (rx_dst_stn) and byte 1 (rx_dst_net). If rx_dst_net
  is zero (local net) or reachable_via_b[rx_dst_net] is zero (unknown
  network), jump to rx_a_not_for_us (&E13F): ignore the frame,
  re-listen, drop back to main_loop_poll without a full main_loop
  re-init.

Draining:

  Read the rest of the frame in byte-pairs into &023C+Y up to Y=20
  (the Bridge only keeps the first 20 bytes). After the drain,
  force CR1=0 and CR2=&84 to halt the chip and test SR2 bit 1
  (FV, Frame Valid). If FV is clear, the frame was corrupt or
  short -- bail to main_loop. If SR2 bit 7 (RDA) is also set,
  read one trailing byte.

Filtering stage 2 — broadcast check:

  Only frames with dst_stn == dst_net == &FF (full broadcast)
  proceed to the bridge-protocol dispatcher. Everything else
  falls to rx_a_forward (&E208), the cross-network forwarding
  path (not yet analysed).

Dispatch on rx_ctrl (after verifying rx_port == &9C = bridge protocol):

  &80  ->  rx_a_handle_80  (&E1D6) - initial bridge announcement
  &81  ->  rx_a_handle_81  (&E1EE) - re-announcement
  &82  ->  rx_a_handle_82  (&E19D) - bridge query (tentative)
  &83  ->  rx_a_handle_83  (&E195) - bridge query, known-station
  other ->  rx_a_forward   (&E208) - forward or discard

The side-B handler at &E263 is the mirror of this routine.

Called when a received frame on side A is broadcast + port=&9C + ctrl=&83. In JGH's BRIDGE.SRC this query type is named "IsNet" — the querier is asking "can you reach network X?", where X is the byte at offset 13 of the payload (rx_query_net).

Consults reachable_via_b[rx_query_net]. If the entry is zero, we have no route to that network so the query is silently dropped (JMP main_loop via &E1D3). If non-zero, falls through to the shared response body at rx_a_handle_82 to transmit the reply -- so IsNet is effectively WhatNet with an up-front routing filter.

Called when a received frame on side A is broadcast + port=&9C + ctrl=&82 (named "WhatNet" in JGH's BRIDGE.SRC — a general bridge query asking "which networks do you reach?"), or when rx_a_handle_83 has verified that a specific IsNet queried network is in fact reachable via side B and is re-using this response path.

The response is a complete four-way handshake transaction, which the Bridge drives from the responder side as two transmissions (scout, then data) with an inbound ACK after each:

  1. Build a reply-scout template via build_query_response,
     addressed back to the querier on its local network with
     tx_src_net patched to our net_num_b.

  2. Stagger the scout transmission via stagger_delay, seeded
     from net_num_b. Multiple bridges on the same segment will
     all react to a broadcast query, and without the stagger
     their responses would overlap on the wire; seeding from the
     network number gives each bridge a deterministic but
     distinct delay.

  3. CSMA, transmit the scout, then handshake_rx_a to receive
     the scout-ACK.

  4. Rebuild the frame via build_query_response again -- this
     time to be a *data* frame following the scout we just
     exchanged, not a new scout. The patches that follow populate
     the first two payload bytes of that data frame (at the byte
     positions labelled tx_ctrl and tx_port, but those names
     refer to scout semantics -- in a data frame those slots are
     payload, not header, and the bytes are:

        data0 = net_num_a        ... the Bridge's side-A network
        data1 = rx_query_net     ... echo of the queried network

     The answer thus consists of the dst/src quad plus two
     payload bytes, packed into the smallest Econet frame that
     can carry it.

  5. Transmit the data frame, then handshake_rx_a for the final
     data-ACK. JMP main_loop on completion.

Either handshake_rx_a call can escape to main_loop if the querier doesn't keep up the handshake, aborting the conversation cleanly.

Called when a received frame on side A is broadcast + port=&9C + ctrl=&80. In JGH's BRIDGE.SRC this control byte is named "BridgeReset" -- a bridge on the far side is advertising a fresh topology, likely because it has itself just come up. We:

  1. Wipe all learned routing state via init_reachable_nets. The
     topology may have changed non-monotonically, so accumulated
     reachable_via_? entries are suspect and the safe move is to
     discard them and relearn.

  2. Schedule a burst of our own re-announcements: ten cycles with
     a staggered initial timer value seeded from net_num_b. Using
     the local network number as the timer's phase means bridges
     on different segments aren't all re-announcing at the same
     millisecond. announce_flag is set to &40 (enable, bit 7
     clear = next outbound on side A).

  3. Fall through to rx_a_handle_81 (the same payload-processing
     loop runs for both BridgeReset and BridgeReply) to mark the
     sender's known networks as reachable-via-A.

This is one of only two places in the ROM that sets announce_flag non-zero (the other is the mirror rx_b_handle_80). Receiving a BridgeReply (ctrl=&81) does not trigger the burst; only receiving a BridgeReset does. A solo bridge therefore stays silent after its boot-time BridgeReset pair, because nothing comes back to trigger a response. See the event-driven-reannouncement writeup.

Reached either directly as the ctrl=&81 handler ("BridgeReply" / "ResetReply" in JGH's source — the re-announcement that follows a BridgeReset) or via fall-through from rx_a_handle_80 (which additionally wipes routing state before the learn loop).

Processes the announcement payload: each byte from offset 6 up to rx_len is a network number that the announcer says it can reach. Since the announcer is on side A, we can reach those networks via side A ourselves -- mark each in reachable_via_a.

After the learn loop, append our own net_num_a to the payload and bump rx_len. Falling through to rx_a_forward re-broadcasts the augmented frame out of ADLC B, so any bridges beyond us on that side hear about the announced networks plus us as one further hop along the route. This is classic distance-vector flooding.

A subtlety: JGH's BRIDGE.SRC memory-layout comments describe the payload as sometimes starting with the literal ASCII string "BRIDGE" at bytes 6-11 (in query frames). Our handler makes no such check -- it treats every byte from offset 6 up as a network number. A frame from a "newer" variant that prepended "BRIDGE" would have bytes &42 &52 &49 &44 &47 &45 erroneously marked as reachable network numbers. No evidence that any in-the-wild variant does this for ctrl=&80/&81; our own ROM doesn't emit the string in any outbound frame.

Entry point for cross-network forwarding of frames received on side A. Reached from three places:

  * rx_a_to_forward (&E147): the A-side frame is addressed to a
    remote station (not a full broadcast), and we have accepted
    it via the routing filter.
  * rx_frame_a ctrl dispatch fall-through (&E193): the frame is
    broadcast + port &9C but has a control byte outside the
    recognised bridge-protocol set (&80-&83).
  * Fall-through from rx_a_handle_81 (&E207): we've learned from
    the announcement and appended net_num_a to the payload; now
    propagate it onward.

The routine bridges the complete Econet four-way handshake by alternating direct-forward, receive-on-one-side, and re-transmit:

  Stage 1 (SCOUT, A -> B): the inbound scout already sits in the
  rx_* buffer (&023C..). Round rx_len down to even, wait for B
  to be idle, then push the bytes directly into adlc_b_tx in
  pairs (odd-length frames send the trailing byte as a single
  write). Terminate by writing CR2=&3F (end-of-burst).

  Stage 2 (ACK1, B -> A): handshake_rx_b drains the receiver's
  ACK from ADLC B into the &045A staging buffer. transmit_frame_a
  forwards it to the originator.

  Stage 3 (DATA, A -> B): handshake_rx_a drains the sender's
  data frame from ADLC A into &045A. transmit_frame_b forwards
  it to the destination.

  Stage 4 (ACK2, B -> A): handshake_rx_b drains the receiver's
  final ACK. transmit_frame_a forwards it to the originator.

Each handshake_rx_? call can escape to main_loop (PLA/PLA/JMP) if the expected frame doesn't arrive, cleanly aborting the bridged conversation without further work on either side.

The A-B-A transmit pattern that appears at the routine's tail is therefore the natural shape of a bridged four-way handshake when the initial scout came from side A: two frames travel A -> B (scout and data) and two travel B -> A (two ACKs).

Byte-for-byte mirror of rx_frame_a (&E0E2): same three-stage structure (addressing filter, drain, broadcast + bridge-protocol check), same control-byte dispatch, with `adlc_a_*` replaced by `adlc_b_*`, `reachable_via_b` by `reachable_via_a`, and the side-selector value swaps (`net_num_a` ↔ `net_num_b`) where appropriate.

Bridge-protocol dispatch for this side:

  &80  ->  rx_b_handle_80  (&E357) - initial bridge announcement
  &81  ->  rx_b_handle_81  (&E36F) - re-announcement
  &82  ->  rx_b_handle_82  (&E31E) - bridge query (shared &83 path)
  &83  ->  rx_b_handle_83  (&E316) - bridge query, known-station
  other ->  rx_b_forward   (&E389) - forward or discard

See rx_frame_a for the full per-instruction explanation.

Mirror of rx_a_handle_83 (&E195) with A/B swapped: consults reachable_via_a (not _b) because the frame arrived on side B. Falls through to rx_b_handle_82 when the queried network is known.

Mirror of rx_a_handle_82 (&E19D) with A/B swapped throughout: stagger seeded from net_num_a, transmit via ADLC B, tx_src_net patched to net_num_a, response-data's first payload byte (at the tx_ctrl slot) encodes net_num_b. See rx_a_handle_82 for the full protocol description.

Mirror of rx_a_handle_80 (&E1D6): wipe reachable_via_* via init_reachable_nets, seed the re-announce timer's high byte from net_num_a (mirror of A-side seeding from net_num_b), set announce_count = 10 and announce_flag = &80 (bit 7 set = next outbound on side B). Falls through to rx_b_handle_81.

The other of the two places in the ROM that sets announce_flag non-zero; all other writes to that byte clear it.

Mirror of rx_a_handle_81 (&E1EE): reads each payload byte from offset 6 onward as a network number reachable via side B, marks reachable_via_b[x] = &FF for each (mirror of the A-side writing reachable_via_a). Appends net_num_b to the payload and falls through to rx_b_forward for re-broadcast onto side A.

Byte-for-byte mirror of rx_a_forward (&E208) with A and B swapped throughout: the inbound scout is pushed via adlc_a_tx, and the B-A-B tail bridges the four-way handshake the other direction.

Reached from rx_b_to_forward (&E2C8), from rx_frame_b's ctrl dispatch fall-through (&E314), and from rx_b_handle_81's fall-through at &E387.

See rx_a_forward for the full per-stage explanation.

Spin reading SR1 of ADLC A until the IRQ bit (bit 7) is set. Called from 19 sites where the code needs to wait for the ADLC to signal an event (frame complete, RX data available, TX ready, etc.).

The Bridge does not route the ADLC ~IRQ output to the 6502 ~IRQ line (that pin is used for the self-test push-button), so ADLC attention is obtained by polling.

As wait_adlc_a_irq but for ADLC B.

Aborts all ADLC A activity and returns it to idle RX listen mode. Falls through to adlc_a_listen. Called from the reset handler.

TX held in reset, RX active. IRQs are generated internally by the chip but the ~IRQ output is not wired; see wait_adlc_a_irq.

Byte-for-byte mirror of adlc_a_full_reset, targeting ADLC B's register set at &D800-&D803. Falls through to adlc_b_listen. CR3=&00 also puts the LOC/DTR pin high, so the front-panel LED is dark after this runs -- the distinguishing feature from self_test_reset_adlcs.

Mirror of adlc_a_listen for ADLC B.

Zeroes the two 256-entry routing tables (reachable_via_a at &035A and reachable_via_b at &025A), then writes &FF to four slots that are true by virtue of the Bridge's immediate topology:

  reachable_via_a[net_num_a]  -- side A's own network is reachable
                                 via side A (trivially)
  reachable_via_b[net_num_b]  -- side B's own network is reachable
                                 via side B (trivially)
  reachable_via_a[255]        -- broadcast network reachable both
  reachable_via_b[255]           ways

Everything else starts at zero and is populated later by bridge- protocol announcements learned in the rx handlers (see rx_a_handle_80 / rx_b_handle_80).

Called from the reset handler and also re-invoked from the two rx_?_handle_80 paths -- receiving an initial bridge announcement indicates a topology change that invalidates the learned state, so the Bridge forgets everything and starts accumulating again.

A calibrated busy-wait used by the query-response paths to stagger their transmissions. Called from rx_a_handle_82 (&E1AC) and rx_b_handle_82 (&E32D), in each case with ctr24_lo pre-loaded with the bridge's opposite-side network number (net_num_b for A-side responses, net_num_a for B-side responses).

Two phases:

  Prelude (~&40 * (dey/bne) cycles): a fixed settling delay,
  the same regardless of caller. Roughly &40 * 5 = 320 cycles
  = ~160 us at 2 MHz.

  Per-count loop (ctr24_lo iterations * (&14 * (dey/bne) + dec/bne)
  cycles): roughly ctr24_lo * 110 cycles. For a typical network
  number of ~24, that's ~2600 cycles = ~1.3 ms.

For the range of network numbers permitted (1-127), the total delay runs from ~215 us to ~7 ms. This spread means multiple bridges on the same segment responding to a broadcast query (ctrl=&82) transmit their responses at measurably different times, reducing the chance of collisions on the shared medium. Bridges with higher network numbers back off longer -- a cheap deterministic priority scheme that requires no coordination.

Populates the outbound frame control block at &045A-&0460 with an all-broadcast "BridgeReset" scout (JGH's term) -- ctrl=&80, port=&9C, payload = net_num_b. At reset time this is transmitted via ADLC A first (announcing "network net_num_b is reachable through me" to side A's stations), then tx_data0 is patched to net_num_a and the same frame is re-transmitted via ADLC B.

  tx_dst_stn = &FF                    broadcast station
  tx_dst_net = &FF                    broadcast network
  tx_src_stn = &18                    firmware marker (see below)
  tx_src_net = &18                    firmware marker (see below)
  tx_ctrl    = &80                    initial-announcement ctrl
  tx_port    = &9C                    bridge-protocol port
  tx_data0   = net_num_b              network number on side B

The src_stn/src_net fields are both set to the constant &18. The Bridge has no station number of its own (only network numbers, per the Installation Guide) so these fields are not real addresses. Receivers do not use them for routing -- rx_a_handle_81 reads the payload starting at offset 6 and ignores bytes 2-3 entirely. The most plausible role for &18 is defensive redundancy: together with dst=(&FF,&FF), ctrl=&80/&81 and port=&9C it gives a receiver multiple ways to confirm that a received frame is a well-formed bridge announcement.

Also writes &06 to tx_end_lo and &04 to tx_end_hi (so the transmit routine sends bytes &045A..&0460 inclusive = 7 bytes when X=1), loads X=1 (trailing-byte flag for transmit_frame_a), and points mem_ptr at the frame block (&045A).

Called from the reset handler at &E038 and again from &E098 (the main-loop periodic re-announce path). A structurally identical cousin builder lives at sub_ce48d (&E48D) and is called from four sites; it populates the same fields with values drawn from RAM variables at rx_src_stn and rx_query_net rather than baked-in constants.

A second frame-builder (sibling of build_announce_b) used by the bridge-query response path. Called *twice* per response: once to build the reply scout (ctrl=&80 + reply_port as the port), then after the querier's scout-ACK has been received, called again to rebuild the buffer as a data frame -- the caller then patches bytes 4 and 5 (labelled tx_ctrl and tx_port but genuinely payload in a data frame) with the routing answer. Where build_announce_b writes a broadcast-addressed template, this one builds a unicast reply:

  tx_dst_stn = rx_src_stn          station that sent the query
  tx_dst_net = 0                   local network
  tx_src_stn = 0                   Bridge has no station
  tx_src_net = 0                   (caller patches to net_num_?)
  tx_ctrl    = &80                 scout control byte
  tx_port    = rx_query_port       response port from byte 12 of query
  X          = 0                   no trailing payload

Also writes tx_end_lo=&06 / tx_end_hi=&04 and points mem_ptr at &045A so a subsequent transmit_frame_? sends the 6-byte scout.

Called from the two query-response paths (&E1A0 and &E1B8 on side A; &E321 and &E339 on side B). Each caller then patches a subset of the fields before calling transmit_frame_? -- the idiomatic second call in particular overwrites tx_ctrl and tx_port to carry the bridge's routing answer.

Byte-for-byte mirror of transmit_frame_a (&E517) with adlc_a_* replaced by adlc_b_*. Everything there applies here — same entry conditions, same end-pointer semantics (tx_end_lo/hi), same X=0/1 trailing-byte flag, same escape-to-main-loop on unexpected SR1 state, same normal exit that resets mem_ptr to &045A.

Called from seven sites: reset (&E04E), &E0D8, &E257, &E333, &E34E, &E3D2, &E3DE.

Sends the frame starting at mem_ptr (&80/&81 — normally pointing at the outbound control block &045A) through ADLC A's TX FIFO. Termi- nation is controlled by the 16-bit pointer tx_end_lo/tx_end_hi (&0200/&0201): the loop sends byte pairs until mem_ptr + Y reaches or passes (tx_end_hi:tx_end_lo). X is a flag — non-zero means send one extra trailing byte after the terminator (used by builders that append a payload like build_announce_b's net_num_b at &0460).

On entry: mem_ptr_lo/hi start address of frame tx_end_lo/hi end address (exclusive pair) X 0 = no trailing byte, 1 = send one trailing byte ADLC A must already be primed by a frame builder

On exit (normal RTS): mem_ptr_lo/hi reset to &045A ready for next builder ADLC A's TX FIFO flushed, CR2 = &3F

Abnormal exit: if any of the three wait_adlc_a_irq polls returns with SR1's V-bit clear instead of set (meaning the ADLC didn't reach the expected TDRA state), the routine drops the caller's return address from the stack and JMP's into the main loop at &E051 — the same escape-to-main pattern used by wait_adlc_a_idle.

Called from seven sites: reset (&E03E), &E0AD, &E1B2, &E1CD, &E251, &E25D, &E3D8.

The receive half of four-way-handshake bridging for the A side. Enables RX on ADLC A, drains an inbound frame byte-by-byte into the outbound buffer starting at tx_dst_stn (&045A), then sets up tx_end_lo/hi so the next call to transmit_frame_b transmits the just-received frame out of the other port verbatim.

The drain is capped at `top_ram_page` (set by the boot RAM test) so very long frames fill available RAM and no further.

After the drain, does three pieces of address fix-up on the now-staged frame:

  * If tx_src_net (byte 3 of the frame) is zero, fill it with
    net_num_a. Many Econet senders leave src_net as zero to mean
    "my local network"; the Bridge makes that explicit before
    forwarding.

  * Reject the frame if tx_dst_net is zero (no destination
    network declared) or if reachable_via_b has no entry for
    that network (we don't know a route).

  * If tx_dst_net equals net_num_b (our own B-side network),
    normalise it to zero -- from side B's perspective the frame
    is now "local".

On any of the "reject" paths above, and on any sub-step that fails (no AP/RDA, no Frame Valid, no response at all), takes the standard escape-to-main-loop exit: PLA/PLA/JMP main_loop.

On success, return to the caller with mem_ptr / tx_end_lo / tx_end_hi ready for transmit_frame_b (or transmit_frame_a in the reverse direction for queries). Mirror of handshake_rx_b (&E5FF).

Called from five sites: &E1B5 and &E1D0 (rx_a_handle_82/83 query paths), &E254 and &E3DB (forward tails), and &E3CF (also a forward tail).

Byte-for-byte mirror of handshake_rx_a (&E56E) with adlc_a_* replaced by adlc_b_* and the A/B network-number swaps in the address normalisation: src_net defaults to net_num_b, and the forwardability check is against reachable_via_a.

Called from five sites: &E24E, &E25A, &E336, &E351, &E3D5. See handshake_rx_a for the per-instruction explanation.

Byte-for-byte mirror of wait_adlc_a_idle (&E6DC) with adlc_a_* replaced by adlc_b_*. Same pre-transmit carrier-sense semantics: wait for SR2 bit 2 (Rx Idle), back off on AP/RDA, escape to main loop on ~131K-iteration timeout.

Called from four sites: reset (&E04B), &E0D5, &E211, &E330.

Pre-transmit carrier-sense: polls ADLC A's SR2 until the Rx Idle bit goes high (SR2 bit 2 = 15+ consecutive 1s received, i.e. the line is quiet and it is safe to start a frame). A 24-bit timeout counter at ctr24_lo/mid/hi (&0214-&0216) starts at &00_00_FE and increments LSB-first; overflow takes ~131K iterations, a few seconds at typical bus speeds.

Each iteration re-primes CR2 with &67 (clear TX/RX status, FC_TDRA, 2/1-byte, PSE) then reads SR2. Three outcomes:

  * SR2 bit 2 set (Rx Idle): line is quiet. Arm CR2=&E7 and
    CR1=&44, RTS -- caller proceeds to transmit.

  * SR2 bit 0 or bit 7 set (AP or RDA): another station is
    sending into this ADLC. Back off by cycling CR1 through
    &C2 -> &82 (reset TX without touching RX) and keep polling.
    The Bridge is not the right place to assert on a busy line.

  * Timeout (counter overflows without ever seeing Rx Idle):
    PLA/PLA discards the caller's saved return address from the
    stack and JMP &E051 escapes into the main Bridge loop. The
    code between the caller's JSR and the main loop is skipped
    entirely. See docs/analysis/escape-to-main-control-flow.md.

Called from four sites, always immediately before a transmit: reset (&E03B, before transmit_frame_a), &E0AA, &E1AF, &E392.

Invoked by pressing the self-test push-button on the 6502 ~IRQ line (and, implicitly, by any BRK instruction in the ROM). Runs through a sequence of hardware checks, signalling any failure via self_test_fail at &F2C7 with an error code in A.

Not to be pressed while the Bridge is connected to a live network: the self-test reconfigures the ADLCs and drives their control registers in ways that will disturb any in-flight frames. Typical usage is with a loopback cable between the two Econet ports.

Byte-for-byte identical to the adlc_*_full_reset pair except for one crucial detail: CR3 is programmed to &80 (bit 7 set) instead of &00. CR3 bit 7 is the MC6854's LOC/DTR control bit — but the pin it drives is inverted: when the control bit is HIGH, the pin output goes LOW. On ADLC B (IC18) that pin sinks the low side of the front-panel status LED (which has its high side tied through a resistor to Vcc), so CR3 bit 7 = 1 pulls current through the LED and lights it. ADLC A's LOC/DTR pin is not wired and gets the same write for code symmetry only.

Re-entered at &F26C after certain test paths need to reset the chips again; the LED stays lit until a normal reset runs adlc_b_full_reset and clears CR3.

Writes &55 to &00, &01, &02 and reads them back; then &AA and reads back. Failure jumps to self_test_fail with A=1.

Tests only the three ZP bytes that are used as scratch by the later self-test stages (ROM checksum, RAM scan). A full ZP test isn't needed — the main reset handler has already exercised ZP indirectly via the RAM test.

Sums every byte of the 8 KiB ROM modulo 256 using a running A accumulator. Expected total is &55; on mismatch, jumps to self_test_fail with A=2.

Runtime pointer in &00/&01 starts at &E000; &02 holds the page counter (32 pages = 8 KiB).

Starting at address &0004 (skipping the three zero-page bytes reserved for the self-test workspace at &00/&01/&02), iterates through the full 8 KiB of RAM and checks that each byte can store both &55 and &AA. Pointer in (&00,&01) = &0000, Y starts at 4 and wraps, page count in &02 = &20 (32 pages = 8 KiB).

On mismatch, jumps to ram_test_fail at &F28C (note: a *different* failure handler from self_test_fail, because a broken RAM cannot use the normal blink-code loop which needs RAM workspace).