In the late 1970s Texas Instruments made the TMS5100 for the Speak and Spell. This special purpose processor could quickly do math operations required for speech synthesis. This is an early form of Digital Signal Processing (DSP) where code creates signal digital filters instead of using discrete components like capacitors and resistors. Following the success of that project they looked into higher performance DSP architectures which resulted in the TMS320 family being released in the early 1980s.
This was welcome news to game designers of the 1980s. Arcade machines require a wide variety of high performance audio and video processing. Unfortunately CPUs of the day were relatively slow meaning cutting edge games required expensive custom logic made with large circuit boards or custom ASICs. DSPs introduced a new option by focusing on high performance math operations rather than traditional code execution.
More info can be found here. Anyway, here's a TMS320M10 die shot:
Close up of the logo:
The ROM is now way easier to read:
Now we can also see the contrast issue: the polysilicon and metal was mostly overlaid on the diffusion lines above, hiding most of the detail. Now that the polysilicon and metal is removed the bits can be resolved clearly.
Next the ROM photograph is converted into a 2D bit array so we can figure out the bit order. Usually bit order is very linear, such as grouping bits into columns with the least significant bit at the left and most significant bit at the right. Consider a 4 bit CPU with this ROM layout:
- B0 means bit 0, the least significant bit and B3 is the most significant bit
- Bits are grouped into columns
- Each bit column starts upper left, scans right, and then wraps around to the next row
Lets say your ROM is typed as:
01 10 10 10
00 10 01 11
- Reverse engineer logic and deduce the scheme from first principles
- Make educated guesses
000: f900 0010 b 0010h 002: f900 00af b 00AFh ... 010: 7f8a rovm 011: f500 0013 bv 0013h
000: f900 0004 b 0004h 002: f900 0d96 b 0D96h 004: 7f81 dint 005: 7f8a rovm
000: f900 00d7 b 00D7h 002: f900 0642 b 0642h ... 0d7: 7f8b sovm 0d8: 6e00 ldpk 0
Where bits are represented by contacts shown in bright white. But that's a problem: TMS32010C is a diffusion ROM while TMS320C15 is a contact ROM. This means it may not help decoding TMS32010C.
- 16 bit words
- Expect first word to be 0xf900
- Know possibly related memory layout
- Hint which side of the die is address 0
- Have several firmware files to try
000: f900 0019 b 0019h 002: f900 0020 b 0020h ... 020: 7f81 dint 021: 7000 lark AR0,00h