By Sylvain Glaize. Translation by Sébastien Marty.

It is on April 5, 2021 that the very important dump session, i.e. the reading and saving of the Micral N's ROMs, took place.

Detail of one of the MO5 Association's Micral N's monitor ROMs

These EPROMs are so old and the manufacturing density so low that it is possible to make out the individual storage transistors. Looking into their technology, we learn that the electrical voltage needed to program these EPROM chips is 47 volts, which is huge compared to today's standards. This very large potential difference may have protected the contents of the chips, and we will make sure of this right away.

Note that these EPROMs are NMOS components (https://en.wikipedia.org/wiki/NMOS_logic), same as the 8008 and some of the machine's SRAM chips. These components require a dual voltage supply (+5V and -9V) – i.e. different logic levels than typical TTL levels.

ROM dumper specially designed by Jean-François Del Nero for the Micral N

Jean-François Del Nero prepared a specific device beforehand which, being adapted to these levels, will allow us to read these EPROMs. In addition, it also allows us to test all the RAM chips in the machine. These RAMs (2102 and 4007 SRAM chips) turn out to be in good working order, except for one that we replaced with a 2102A chip.

The sources and schematics for this tool are available on this Github repository
>>>Sources here

Jean-François at work on a workbench equipped with measuring instruments, at Viveris Technologies' premises

Result of the dumping of one of the EPROMs

Everything is going wonderfully. The contents of the EPROMs are saved! Jean-François and Philippe immediately send me the contents fresh out of the “dumper”. The first step is to verify that the contents is correct. Indeed, those bytes have been stored for years on EPROMs. They may have been altered.

There are two different ROMs, one is 256 bytes, the other 2 kilobytes. Might as well start with the shortest. 256 bytes is not very long to look over.

The First ROM

Straight away, hope for executable data is allowed. Indeed, the first two decoded instructions are LAA and JMP $0048.

These mnemonics hide an 8008 processor startup sequence, which is a very good sign!

LAA stands for "Load from register A to register A", in other words, "load the contents of register (a piece of processor memory) A to register A". This has no visible effect on the state of the processor and is the convention for telling the 8008 to... do nothing interesting. An equivalent mnemonic on other processors is NOP, for "No OPeration".

This instruction is usually the first one fed to an 8008 which has just started. Indeed, due to the way it operates, the processor will execute this instruction twice. Conventionally, the choice falls on an instruction which has no visible effect.

The second instruction, JMP $0048, is a jump to the specified address which is located further away, after a set of reserved addresses.

This too is a classic instruction, also found on Z80-based machines – a processor with the same first reserved addresses, showing therefore a direct line of descent.

What's next ?

From address `$0048` onwards, we find what looks like a program. After a bit of work and jotting down some first notes, I'm pretty confident this program hasn't been damaged. It seems to form a coherent whole.

However, a small detail deserves attention. Among the reserved addresses mentioned above (the "Restart" addresses, used by the RST instruction and, on the Micral N, by interrupts), only two contain anything coherent.

The rest form an incoherent set, and looks more like a series of random bits.

A boot ROM

This detail is linked to another one: towards the end of the ROM, an instruction requests the processor to restart from address 0.

Intuition tells us then that this ROM performs a start-up operation, after which it “disappears”, in the sense that it hides itself to make room for something else.

What tends to confirm this intuition is that the ROM makes requests through its input/output pins to acquire data from a peripheral device. These data are then stored in memory, after checksum verification, starting from address 0.

What we have here is therefore probably a boot program that reads a second program from an external source. A "boot loader".

These intuitions will be confirmed later.

The second ROM

The second ROM is larger. 2048 bytes may seem small, and it is certainly not very big. Translating this contents to get a fairly precise idea of how it works is still a bit of a tedious task.

Nonetheless, it's an exercise that I find enjoyable.

The first step is to find out where this ROM is located in memory. Here, the simplicity of the 8008 helps. All jump instructions specify absolute addresses. One technique is then to find a small loop of instructions and deduce a probable location.

Indeed, a loop will refer to an address close to the jump instruction itself. After choosing a probable address, we only need to confirm it with a pair of other loops.

This ROM is therefore located at $3800, i.e. at the very end of the addressable memory space of the 8008, which is a range of 16 KB between addresses $0000 and $3FFF.

Initial mess

When you perform these exercises, you are a bit lost at first. You need to find thread ends, pull on them, and see how the whole ball can be untangled.

The ROM starts by saving the context of the 8008 in fixed addresses.

Then it sends the ASCII code for a question mark to an external device. This doesn't look like a coincidence... could there be a dialogue with the outside world?

So I looked to see if there is any data retrieval process taking place. Indeed, there is one.

The monitor ROM

It's time to open the Micral N manual and look at the part that describes the monitor – a program that allows you to perform generic operations, such as reading and displaying memory, loading data from a punched tape...

And the manual says that it displays a question mark while waiting for a command. And the commands, which are numerous, are all made up of a capital letter.

Now it turns out that in a piece of the ROM that does not look like instructions, these letters show up, separated by what could very well be valid addresses in this ROM.

Upon verification, these addresses are indeed entry points for routines.

Doubt is no longer allowed, and will be entirely cleared a few hours later: this is indeed the monitor as described in the manual.

Contribution of the ROMs

Studying the ROMs was a crucial step in understanding the machine. The manual is not always very clear on the way the Micral N operates. Moreover, it is a modular machine, which can have various configurations.

These two ROMs made it possible to opt for a specific configuration, deduced from the addresses at which they are stored, as well as the input/output ports used.

This is the information that I was missing to model, through the emulator, the beginnings of a functional and plausible configuration for the Micral N.

But we'll discuss that in a future article.

Meanwhile, remember to take part in the campaign to support our work! https://micral.mo5.com