TI TMC0430 GROMs are serial ROMs with internal auto-incrementing address busses. These are similar to the VSMs that Speak and Spell uses, but output a full byte at a time. These were also used in the TI-99/4A computer. I was surprised that the Milton GROM internal address bus wraps at 8K- I read 128K from each chip, expecting to see 8K of data followed by 56K of FFs, then the same 8K again, etc. Instead, I got 16 copies of the 8K. That means a read of $1FFF results in the address wrapping to $0000 instead of accessing the other chip at address $2000.
dump of GROM 003 $0000-$17FF
dump of GROM 004 $2000-$37FF
I used a logic analyzer to capture the GROM signals after Milton was powered on, when he spoke the lines "You turn me on", "I'm Milton", "Who's out there?", "Hee hee hee, pick your play", "Hee hee hee, pick your play, press 1, 2 or 3". Here are the writes and reads- the writes set the address, and the reads return the data from the current address, then increment the address. You can see that there are pointers in low ROM to the data that are in high or low ROM. Also, high address bits seem to be used as flags.
logic analyzer screen cap Here's an annotated logic analyzer screen grab of the first several bytes being read.
a little progress towards decoding the GROM data
The following Saleae Logic captures can be viewed by downloading their software for Windows, Mac or Linux.
Note: the TI documentation uses the convention that D0 is the most significant bit and D7 is the least significant bit. That's backwards to me, so in these dumps, D0 is the lsb and D7 is the msb.
Milton - all TMC0430 signals captured from power on to "you turn me on"
TI 99/4A DOS Manager 2 cart CD2235 read address - dummy read, write address $482C, read byte, read address returns $482E, read address returns $2E2E, read address (one byte) returns $2E. Shows that reading the current address is destructive; the MSB gets overridden with the LSB.
TI 99/4A DOS Manager 2 cart CD2235 read address 2 - dummy read, write address $842C, read 16384 data bytes, read address returns $842D. Shows that the high 3 address bits (chip select bits) aren't incremented when reading.
TI 99/4A DOS Manager 2 cart CD2235 write address just MSB - dummy read, write address $842C, read 16 data bytes, write address $88 (just one byte), read 16 data bytes, read address returns $3D98. Shows that a write address shifts the LSB into the MSB, then loads the LSB.
TI 99/4A DOS Manager 2 cart CD2235 write address just MSB 2 - dummy read, write address $8470, read 16 data bytes, write address $88 (just one byte), read 16 data bytes, read address returns $8198
