Intel MCS 4/40 ROM Monitor MON4 - dumps and disassembly

Preliminary work in progress Aug 2013 by Herb Johnson and Kyle Owen, corrected and last updated Mar 22 2016. Updated Sep 30 2023. This document (C) copyright 2023 Herb Johnson except for work done by others who hold their copyrights.

We own Intel MCS 4/40 systems with the 4040 processor from the early 1970's. This page discusses reading and interpreting the ROMS from those systems. My 4/40 system is described on the linked Web page. .

Please note that all ROM dumps may have errors. Some errors have been identified, follow this link. Some of these ROMs were damaged, some were patched, some were copied by eye and keyboard. Note the recovered MON4 listing for corrections and details. - Herb

MON4 source listing

In Sept 2023 I obtained an Intel document for the MON4 monitor V2.1 listing. OCR of the PDF does not yield useful text. This code to be reassembled will have to be hand-entered from the document. Simpler work, is to edit the most complete disassembly below to add comments and names (symbols). - regards Herb

Dump of ROMS from Kyle's MCS 4/40

Kyle contacted me in mid-Aug 2013, to describe his work to read the 1702A EPROMs in his Intellec 4/40 system. He wanted help because I had a 4/40 system and his ROM 0 was appaarently blank.

this is a photo of Kyle's CPU board with ROMs. Here's his ROM dumps:
ROM 0, labled MON 4 000 V2.1 (all FF's)
ROM 1, labled MON 4 100 V2.1
ROM 2, labled MON 4 200 V2.1
ROM 3, labled MON 4 300 V2.1

Kyle first noticed, his ROM 0 was "blank" or broken in some fashion - all FF data.

Kyle then noticed the data as read was "inverted", that is the data read from the ROMS would have to be inverted to be executable 4040 code. I confirmed this by inverting some of the data in ROM 1 and hand-disassembling it. Here's a partial result for ROM 1. I found a nice graph for the 4040 opcodes at pastraiser.com's site supporting the 4040.

Years later in Jan 2023, I was told by Sid Jones why the 4040 system ROMS were inverted:

Sid Jones: After a bit of experimentation with [my homemade] Mk I and Mk II 1702A readers, first using a patch board and then a bit of real leaded solder strip board, I've successfully read all four EPROMs from my intellec 4 mod 40. I am surprised that they've still got what appears to be valid code in them after all this time. The read back of the EPROMs from my [designed prototype 4040 based] Rainbow2 box was NOT inverted, but the Intel ROM monitor EPROM read back was ...

After 48 years the light bulb moment, was that the EPROMs that go into the intellec MUST be inverted to cope with the programme source multiplexing that occurs when running the box from monitor, RAM or the optional ROM board. I will dig into the circuit diagram to see if I can confirm this! Look later in this document for Sid Jones' 4/40 ROMs.

Dump of ROMS from Herb's MCS 4/40

I also have an Intel MCS 4/40 system. and so Kyle wanted me to dump my 1702A EPROMs to recover what he hoped would be a good copy of the ROM 0. I removed the cards from the 4/40 system (you can see photos on my 4/40 systems page). Here's a closeup of the 4/40 ROMs and CPU. Note the hand-written lables on the ROMs. It's likely this code is modified from Version 2.1.

I set up my 1702 programmer/reader, a Prolog series 90. As it only has a current-loop interface, which I've not adapted to a serial output/input, I simply read off the data manually, typing them into an adjacent Win95 laptop. Here's a photo of the Prolog series 90 and a Pentium 4 laptop - 35 years apart.

The Prolog 90 has a normal/inverted setting for data; but I chose to read the "normal" or noninverted output - that's what would be used to duplicate my PROMs and Kyle's as well. Here's Herb's ROM dumps:
ROM 0 of herb's Intellec 4040 - V2.1 errors fixed Dec 2014
ROM 1 of herb's Intellec 4040 - I40 MON 1
ROM 2 of herb's Intellec 4040 - I40 MON 2 error fixed Mar 2014
ROM 3 of herb's Intellec 4040 - 1200 baud I40 MON F3

Turns out, some of MY data bytes seem to be lost, as FF's. Compare my ROM 1 to Kyle's ROM 1, I have a bunch of FF's. But these are INVERTED bytes, so they are actually 00's - the 4040 NOP no op instruction. My best guess, is that this code was hand patched in binary so some NOPs filled the empty space.

Here's some hand-disassembly of the beginning of my ROM 0, after inverting the bytes:

    inverted
2B D4 LDM 4
4F B0 XCH 0
DE 21 SRC 0
27 D8 LDM 8
1D E2 WRR
BE 41 JUN 1, 062H
9D 62 
AF 50 JMS 056H
A9 56
DD 22 SRC 0 
D1 2E FIM 7, 050H
AF 50 JMS 081H
7E 81
AF 50 JMS 09CH
63 9C 
D3 2C FIM 6, 0D0H
2F D0

inverting back to 4040 codes

Now, hand-inverting hexadecimal numbers is tedious. So I tinkered with a C program I've used to read bytes and mess with them, to in this case compliment 0 thru 9 and A thru F, to the 1's compliment. 0 becomes F, 1, becomes E... and F becomes 0. Here's the simple, commmand line, MS-DOS like source for "hexinv.c" and here's the 32-bit MS-DOS executable.

So, when I run rom0.txt, my hand-dumped ROM data, through it, I get all my hex digits inverted. It messes up some other text in the file of course - so I edited back in my commentary and such.
ROM 0 inverted from Herb's 4/40 error corrected Dec 2014
ROM 1 inverted from Herb's 4/40
ROM 2 inverted from Herb's 4/40error fixed Mar 2014
ROM 3 inverted from Herb's 4/40

The inverted data was helpful, in visually-confirming the data against the PROMs again. The Series 90 has an "invert" switch so I could look at the data in a different way. I caught two errors in ROM 0 data that way; the other three ROMS were OK. - Herb

Kyle successfully restores his 4/40; we disassemble our ROMs

I need to add our discussion of how Kyle got his 4/40 into operation. One consequence, is that he was able to operate the 4040 monitor code and determine how the monitor works. It turns out to be very similar to the Intel intellec 8 mod 80 ROM monitor. Here's Kyle's read of the 4040 ROM monitor command set.

Meanwhile, Kyle and I found a javascript disassembler/assembler online. It was able to accept my ROM dumps and produce simple 4040 code. Here's the 4040 disassmembly of my four ROMS with no comments or named labels. (This disassembly was corrected by Dec 2014, corrections as noted below.) There's also an emulator on the szyc.org site, which is beyond my capacity to understand (either its operation or Javascript).

Kyle used the same disassembler on his three ROMS (and my ROM 0). Here's Kyle's disassembly of his ROMS. (As of Dec 2 2014, Kyle's disassembly has an error at at 00CEH; look at Herb's disassembly for the correction. )

I have another Web page on Kyle Owen's work on his 4/40, which is a little redundant but has links back to his various work as represented on my site, and some other links and comments of his.

Other disassemblies

Disassembly by Paul Robson, corrections to ROM dumps, more analysis

Here's Paul's disassembly (with my corrections) of both Herb's and Kyle's ROM sets. Paul uses IF statements to provide both sets of disassembled code. He wrote a simple disassembler in the LUA language to produce the disassembly. Then he commented it and added lables, based on 4004 code from Intel's 4004 documentation of an earlier monitor. Paul noted the ROMs don't use the 4040 RPM instruction, so that suggested the code was 4004 code.

Paul's reference documents were Intel's documents: MCS-4 Users Manual, 4004 Manual, MCS/4 Datasheet, 4040 Preliminary Manual (?). All available from bitsavers.org. and their Intel MSC4 archive.

Dwight examines ROM changes

In March 2016, Dwight Elvey had reasons to look at some of the PROM code for baud rate. Here's what he said. - Herb

[Events] lead me to look at the listing you have for your Intellec 4/40. I started by looking at the TTY/serial section. It seems that who ever did the changes to your code wanted to do 1200 baud ( look at the calculations I did below ). He'd given up one of the commands to have two different delays one for serial and one for programming. Clearly not an Intel hack, as he didn't patch the command table.

I doubt it was a factory suggested change. I'd guess it was an attempt to make it work a little faster. Here are my calculations...[see link below].

Then I redid some of the calculations for baud rates. Kyle's comes out to 108.8 or 108.9 depending on input or output. That is close enough to 110 baud to not be an issue. Yours come out to 1382 and 1402.I suspect the fellow was trying to hit 1200 baud but didn't account for all the cycles in handling the data.

HEre's the details from Dwight, on counting 4040 instructions to derive a baud rate.

Sid Jones' 4/40 ROMs

In Dec 2022 - Jan 2023 Sid Jones started to revive his Intellec 4/40 system. He built some 1702A EPROM readers and read off the four ROMS. He said: "The 1702As in the CPU board have printed/hand written labels with 'MON 4 000 v 2.1', 'MON 4 100 v 2.1', 'MON 4 200 v 2.1', 'MON 4 300 v 2.1' as titles." He noted the ROM data was inverted, as previously described. He'll compare his ROMS to mine and to other ROMs. I'll update this reference accordingly.

Sid also found a MAME (emulator) supporting ROM set at the allmyroms.net Web site. MAME supports emulation of the 4/40 system.

Another 4004/4040 cross assembler

In 2014 I modified an 8085 assembler to process 4004 and 4040 assmembly language. "My" 4004/4040 cross assembler is available on this linked Web page. Here's an assembled version of the Java disassembled version of Herb's ROM monitor, with corrections to Dec 2014.

Notes: Pro-Log series 90 PROM reader/writer for 1702A's

Aug 16 2013: To dump my 4/40 system 1702 PROMS, I'm using a Prolog brand "series 90" EPROM reader and writer, which I acquired some years ago with a 4040 system. Here's a photo of the Prolog series 90 and a Pentium 4 laptop - 35 years apart. I transscribed ("typed in") the data from the Prolog display into a text document on the Windows XP laptop. That's because I've not worked with the serial and parallel interfaces on this programmer.

Here's a photo of the serial and parallel "ports". the DB-9 is serial current-loop, the DB-25 is parallel for a reader and punch. Note the paper lables showing pinouts and voltages. Of course these connectors are not "IBM PC compatible" as the Prolog predates the IBM PC by a decade or so. Here's the internal current loop circuits and suggested Teletype interface. The manual discusses how to connect the Model 33 ASR to the Prolog. Here's the parallel interface partial schematic from the manual. It shows the handshake pins and voltages, but not the data pins. Inspection with a voltmeter suggests the "early" pins are input to Prolog, the "late" pins are output from Prolog. Interestingly enough, the DB-25 pins show +5v on pin 1 but NOT -10V on pin 4 of the DB-25. Hmmmm.

There's included with my series 90, a DB-9 cable and a small two-transistor circuit board with wires to ground, +5 and -10. this may be a "RS-232 adapter". I'll have to draw out the schematic to see. - Herb

Copyright this Web page © 2023 Herb Johnson. Other content may have copyright to its creators. Some content here is from Intel's documents as noted. The current copyright holder for Intel's 4004 work is not clear to me. - Herb