Disassemble TI ROMs for Fun and Profit

[+FarmerPotato]

I'm gathering ROMs from TI products with 9900s.  Disassembling them is fascinating and rewarding!

 

I am posting the ROMs, to get more eyes on them. 

The latest is what I'm calling "Industrial BASIC". This is from a PLC module 505-7102. It has a TMS9995, one EPROM (plus one expansion socket) and two TMS9902A and DB25 ports. It is an interactive BASIC interpreter with extensions for accessing the PLC.  I'm excited to find another TI BASIC interpreter-- if it has any family relationship.  The term "Industrial BASIC" I lifted from the Specification for TI BASIC. (It also describes Education, which we mostly got, and Business, which might correspond to POWER BASIC.) 
 

I posted the BASIC ROM, see thread link below. 

 

However my workflow so far is clumsy. I can't remember who had mentioned they write a multi-pass tool? @jedimatt42 or @retroclouds?

 

My workflow is: use xda99 from xdt99. Make some deductions about start address and re-run. Write small utilities to create DATA and TEXT sections. Use sed scripts. Copy, Paste. 
 

I've gotten the furthest on the XDS/22 32K ROM for TMS340. This is an emulator, debug, timing, trace system with a SE9996 and TMS340 on the Emulator card.  SE9996 is a 9995 with 16-bit external bus. 
 

There's a built-in assembler and disassembler for TMS340 and a fantastic set of XOPs.

Now for the XDS/22 Emulator for the TMS9995:  Colin sent me that version of the XDS/22. Has a SE9996 host and TMS9995 for the in-circuit  pod.  I'm intrigued about what utilities it might contain!  Perhaps a 9995 line-by-line assembler.

 

Both XDS/22 have a command line interface, operated by serial ports, maybe with full screen editor. 
 

The next is MAC and LLC driver code for Token Ring. It runs on a 9900 core inside TMS380 chips, in this case TMS380C30, which combines a TMS380C26 (9900 with memory mapper) and TMS38054 (Token Ring physical interface.)  There are some undocumented (not to say secret) instructions which are exciting.  0780 would be an LDS, but it's nearly always used just before a loop that moves memory. 

Finally, I now have many ROMs from industrial systems. 
 

PLC Series 500 controller is a 9995 with two ROMs with Rel 2.6 of TI's real-time executive. 
 

PLC Series 505, I dumped the 505-1102 controller, which is a 9995, and my EPROM says Rel 2.2.  I've got a little ways into this. It has a lot of subroutines that each return to a main event loop. 
 

Series PM550, I have 8 undumped EPROMs on one card and 3 more on the UART card.  This system had one memory bus for twin 9900s, one to interpret Ladder Logic, and the other running TI's real-time Executive. One of the 9900s is standard and the other had a custom mask MP9514. I have some manuals. 
 

I am looking for a PLC  TI530C (Not 530!) which possibly uses a 9995.

 

The TI500 and 505-7102 files are in the subforum here:

 

 

 

 

 

[+jedimatt42]

https://github.com/jedimatt42/9900dis

[Asmusr]

3 hours ago, jedimatt42 said:

https://github.com/jedimatt42/9900dis

That's clever. Maybe there should also be a way to mark up the end of a subroutine?

[+jedimatt42]

On 11/8/2024 at 11:05 AM, Asmusr said:

That's clever. Maybe there should also be a way to mark up the end of a subroutine?

The user can add a label to the next instruction denoting that it likely begins the next subroutine and a comment on known last instruction of a subroutine. 

 

I found it handy to commit each iteration of the listing to git, so I can easily diff and see how things change from one pass to the next.