The IBM 5100/5110 systems contain “ROS” (Read Only Storage) modules that are an early kind of ROM chip. ROM TTL chips had existed for a while, a typical example would be as a chip used to store the font set used for CRT displays (where that is “baked” into the chip and cannot be altered). An example of the IBM 5100 text-display font can be seen here.
The ROS chips used in the IBM 5100 could hold several kilobytes. It is unclear about the performance of these ROS chips, in terms of access-time relative to other TTL options at the time. These chips were used to hold both Instructions (PALM machine code) and data (jump vectors, or also “non-executive” code from S/360 or S/3 systems).
Around 2004-2006, Christian Corti determined how to extract the APL Executive, BASIC Executive, and Common ROS of the IBM 5110, along with the “non-executive” BASIC and APL ROS. These are five (5x) support ROS stored in the MOSFET chips, with a sixth Executive ROS that coordinates the overall execution of the system (including, for example, blinking the cursor).
The process for extracting the 5x support ROS (read only storage) is as follows: Using the built-in DCP, a program could be written to transfer portions of the “Device ROS” over to RWS (RAM). The DCP then has utilities to dump regions of RWS to a tape or disk, which can then be communicated via KERMIT to another system (such as an IBM PC). That is, as long as the IBM 5110 still has a functional drive and the communication features to perform the digital data transfer — which C. Corti did, with the resources of the IBM museum near Stuttgart, Germany (in the southern corner towards Switzerland).
But how could such a program be written, without knowing the native instruction set of the IBM 5110 Processor? Corti first started with a brute force experiment, of entering instructions (using the DCP) and observing the effect on registers. But after pouring through the archives of the IBM museum and the available literature, Corti happened across a “Chapter 2” portion of what was once a larger manual. It looked like this:
NOTE: Turns out another version of this Instruction information also exist in the IBM 5100 MIM (Maintenance Information Manual) Appendix C, although with less detailed descriptions. That appendix was omitted in the IBM 5110 MIM. Corti wasn’t aware of this Appendix C at the time.
Chapter 2 was a complete description of the PALM instruction set. And it also confirmed what Corti had already started to reverse engineer manually. But in order to make a full emulation of the system, one more ROS was needed: the Executive ROS.
The key: Executive ROS
The main Executive ROS coordinates the overall execution of the system (including the BUP Boot Up Process, CRC checks, the DCP diagnostic and monitor code, and running the “language interpreter”). This Executive ROS is not registered as a Device, so there is no way to digitally copy this ROS over to the RWS, as had been done with all the other devices. Without this ROS, emulating the system was not possible.
But in an experience similar to the “BIOS extraction” scene in the first episode of the Halt and Catch Fire, although not quite as dramatic, a way was determined…
Between 2007-2012, Christian Corti determined a method for extracting the IBM 5110 Executive ROS. This method was followed again around January 2019, in a collaboration between Christian Corti and Tom Stepleton, to also extract the IBM 5100 Executive ROS. The details are here. The following is a summary that process:
- The IBM 5100-series has a peculiar feature during its very first cycle of operation, which is that the display shows whichever 512-bytes of the Executive ROS that the address lines are tied to (which defaults to 0x0000). It is like a 1-cycle opportunity to get a visual representation of the Executive ROS. After that one cycle, the system proceeds with the normal startup sequence.
- In addition, the system has an internal switch to be in RUN-MODE or STEP-MODE. In STEP-MODE, you can push a small white button to step to the next instruction. So, this allows for a pause and gives an opportunity to observe the display content of the Executive ROS (and using the pins on the A1 board, the address lines at startup can be altered to cycle through all 128 combinations of 512-bytes, where 128*512-bytes = 64KB).
- Each instruction is 2-bytes. The switch at the front control panel of the IBM 5100-series has an option to “show registers.” But this doesn’t apply during the very first cycle of startup. For that moment, the system shows a hex-dump of the Executive ROS at whatever the address lines are tied to.
- Like with registers, the display shows bytes “vertically.” So, the first instructions are as follows:
But how does one “extract the data” from the display? Well, it took some 21st century ingenuity to come up with a way. Similar to Corti’s original method, T. Stepleton used high resolution image capture. But now with higher resolution and improved multi-core processing, he then applied AI guided OCR to convert the image data into a complete IBM 5100 Executive ROS. The process was done twice, to ensure correctness. The resulting binaries are now archived here.
C. Corti followed a similar approach for the IBM 5110, using OCR, but states that much more manual correction was necessary. In addition, Corti suggest that now with inexpensive MCUs available, an even better approach would be to just digitally capture the state of the address lines.
A full emulator of the IBM 5110 is available (and was embedded into a website around 2017, see here). Because of addressing differences, a complete IBM 5100 emulator is not yet available. But the Executive ROS of the IBM 5100 has been executed, demonstrating its correctness of extraction.
While the IBM 5110 microcode extraction resulted in six ROS binaries, the IBM 5100 microcode is captured in only three ROS binaries. These three are arranged as follows:
IBM 5110 emulator integrated into a web page here.
And also integrated into a standalone Wintel executable located here.