The 6500/1 (marked as 252609-02) and the LC6554H are two microcontrollers inside the CD-1000 that perform several CDTV player hardware specific I/O functions. The ROM code that lives inside these controllers has now finally been dumped and preserved!
Now, just to manage some expectations, there’s not a lot you can do with these ROM dumps right now. This occurrence is mostly relevant from an archival and preservation standpoint. These are not the Kickstart or Extended ROMs, which you can use in emulators or write to physical ROMs for use inside a CDTV player. I dumped the ROM code of both of these ICs from a pre-production CD-1000 unit that I bought on eBay a few years ago. If you’re not interested in all the blah blah below and just want to get the ROM images, just scroll down to the end of the page for the download link.
6500/1 and LC6554H
So what do these microcontrollers actually do? In a nut shell: the LC6554H controls the front panel display of the CD-1000. It also reads the infrared sensor and front panel button presses and passes these input events to the 6500/1. The 6500/1’s primary function is to take all these input events and translate them into Amiga hardware input events like keyboard and mouse/joystick signals which are read by the CIA chips.
The 6500/1 microcontroller inside the CD-1000 (252609-02)
Microcontrollers
Both the 6500/1 and the LC6554H are microcontrollers (or microcomputers depending on who you ask and what year it is). As the name already implies these ICs are not just ROM, CPU, RAM or I/O chips, but are in fact all of the above. They contain a processor, some I/O ports, a tiny amount of work RAM and of course the actual program code stored inside ROM. All this is housed in one single package. So as you can see, because these are not your regular memory chips, you can’t just hook them up to a programmer and read their contents. All those pins aren’t address and data lines, but most of them are the I/O ports of the microcontroller. This means that the program code that is stored inside the ROM is not exposed directly to the outside world.
The LC6554H microcontroller inside the CD-1000
So is it impossible to dump the ROM code then? Nothing is impossible, but it’s not always easy and sometimes it’s straight up hard. It just depends on how much effort and cost you want to throw at it. Some controllers can be put into a special test mode and will allow you to run your own code that proceeds to dump the ROM contents via their I/O port(s), which can (sometimes) be relatively easy to do. At the other end of the spectrum is the physical decapping of the chip which actually opens the IC package to identify the ROM inside and attempt to read it.
Luckily an even easier opportunity to dump the ROM code of these ICs presented itself to me!
CDTV prototype
A few years ago I bought a CD-1000 player that was clearly not a production unit. The back of the unit is missing all the silkscreen print text and symbols, there’s that famous red Commodore pre-FCC approval sticker on the underside which is usually a telltale sign this is a pre-production/prototype unit, and it has the pre-production 2.1 version motherboard.
The sticker on the CD-1000 pre-production unit
It also had some weird boards with EPROMs sticking out instead of the usual 6500/1 and the LC6544H ICs that are found in production units. Well, turns out these “weird boards” are special piggy back board packages of the 6500/1 and LC6554H. They are functionally identical to their production counterparts, but instead of a masked ROM they contain a 28-pin socket that fits an EPROM.
The 2.1 mainboard. Note the piggy back boards with EPROMs at the bottom.
This is how software engineers can quickly iterate new versions of their program code without having to go through the lengthy and costly process of creating ROMs. The engineers at Commodore wrote their code to the EPROM, put the EPROM in the piggy back board and tested their code directly inside the CDTV player hardware. If something needed to be changed they popped out the EPROM, modified the code and put the EPROM back in. Once the code was deemed production ready the code was made available to the chip fabrication plant (MOS/CSG for the 6500/1 and Sanyo for the LC6554H) and the code is embedded in the masked ROM inside the production microcontroller which is produced in higher quantities.
Piggy back board illustration from LC6554H datasheet
Dumping the EPROMs was easy as pie. I removed the EPROMs from the piggy back boards very carefully. Dumped them several times using a TL866II plus programmer, binary diff compared and verified them several times. The code looks legit and I even started disassembling some of the 6500/1 code to see what it does.
ROM code metadata
The EPROM stickers look like they are dated October 1st 1990 (the ink has faded in places and it’s hard to read). The LC6554H EPROM also carries “V12” on the sticker, which is corroborated by the ROM contents which contains the string “LC6554H VER 1.20 26-09-1990”. The 6500/1 EPROM has what looks like “V13” on the sticker, so I am assuming this will be the 1.3 version of the 6500/1 ROM code. There are no identifiable version numbers inside the 6500/1 code as far as I can tell. The actual LC6554H ROM code and the 6500/1 ROM code are each just 2K in size.
The 6500/1 piggy back board
The pre-production CD-1000 player that I dumped these EPROMs from contains 1.0 version EPROMs of the CDTV OS, which was built in March 1991. This suggests this unit was used by Commodore for development/testing, at the very least, until the actual release of the CDTV player in April 1991. So even though both ROM dumps are from a pre-production unit I am reasonably convinced these dumps contain the same version ROM code as the actual production units do, but of course we won’t know for sure until someone manages to dump those. There are ways to dump the production package of the 6500/1, but I am not aware of any method to do that for the LC6554H.
Why is this code important
Even though you can’t really use this code for anything right now, it is an important component of CDTV that needs to be preserved. Right now it’s mostly of interest to historians and techies who like to reverse engineer the code to see what it actually does. It could be used in the future to improve emulation software, but most importantly it will allow the CDTV and Amiga community at large to create replacements for the 6500/1 and LC6544H once these chips start to die off, so that we can keep our precious CDTV players fully functioning for many years to come! The code inside these chips is unique to the CDTV player and it would be very hard to create replacements for them without it. Once the LC6554H code is reverse engineered theoretically you could even create code that interfaces with replacement front panel displays/IR sensors or even much cooler stuff than I can think of right now off the top of my head. It’s still a lot of work, but a major stumbling block in achieving those goals in the future has now been removed!
The LC6554H piggy back board
Grab the zip file containing both ROM dumps here.
Note: I am hosting the ROM dumps here since they have virtually zero economic value and are not being sold commercially anywhere (contrary to the Kickstart and CDTV OS ROMs). This historically relevant software needs to be preserved before it is lost forever. If someone wants to upload the zip file to archive.org or other places for preservation purposes, be my guest!