The COP400 Family datasheets mention a "test mode": force SO high and then SI high for RAM and internal logic test mode or SI low for ROM test mode. There are app notes with more information; SI high lets you input instructions to set up the program counter and L outputs, then SI low will dump ROM contents out the L port. The timing for inputting instructions is a bit tight, so I've been foregoing that step and just dumping ROM out the L port. That means that I don't know where the dump begins, so I have to analyze the dump and figure that out myself. In practice it hasn't been too difficult; since the first byte has to be a 00, in the worst case I reorder the dump with each 00 at the front and disassemble the code, then check the jumps and jump to subroutines to see what percentage of them are consistent. Usually there are unused bytes at the end of many 64-byte pages that are 00, and aligning those reduces the number of starting locations that must be tested.
I tie SI low with a 1K resistor, tie SO to 1.5-3 volts through a 100 ohm resistor and clock the chip at a low rate (100KHz or so), capturing the L port with a logic analyzer. Unfortunately, reset tristates the L port, so no bytes can be output. Luckily, every COP I've tried to dump uses the L port for output, so the code sets that pretty early on. So I leave SI disconnected right after power up, then connect it- that way the chip's code initializes the L port so the ROM contents can be dumped. On reset SK is an instruction sync output, but unfortunately most programs configure it as an output, which disables the instruction sync signal. But it's usually easy enough to figure out the timing. I did come across one COP where the falling edges weren't aligned with the rising edges, which made syncing more difficult. I found that reducing the clock speed brought them closer together. Surprisingly, that chip also kept SK as an instruction sync, which made it simple to lock onto the bytes.
COPSreader code to insert instructions and read ROM contents