ctk551.txt

CTK-551 ROM dump (little endian):
https://revenant1.net/ctk551.bin

CTK-541 service manual (identical PCBs to CTK-551):
https://www.synthxl.com/wp-content/uploads/2020/04/Casio-CTK-541-Service-Manual.pdf

CPU: "Casio GT913F", 20-bit address bus, 16-bit data bus
Similar CTK models feature a uPD913 or uPD914, i.e. the GT913F is apparently a rebranded NEC chip.
Instruction set seems to be based on Hitachi H8/300, but with opcodes 5xxx-7xxx rearranged.

Quote from service manual:
"The 16-bit CPU contains a 1k-byte RAM, three 8-bit I/O ports, two timers, a key controller and serial interfaces."
(The actual architecture / instruction set isn't mentioned, though.)

Instructions/opcodes seem to be (usually) word-sized, sometimes with word-sized operand(s)?
ROM has empty space from $00F308-00FFFF, registers and RAM may live in here somewhere.
(Some of the below example routines contain words in the $FF00-FFFF range which may be register or RAM addresses)

000000: vector table
    0302
    0302
    0302
    0302
    0300
    0656
    0700
    0854
    07A2
    07BC
    0814
    0300
    0300
    0300
    0300

000300: dummy/unused interrupts
    5980 - rte

000302:
    5F07 - mov.w #imm,r7
    FB7C
    0420
    07C0
    F821 - mov.b #$21,r0l
    7C08 - mov.b r0l,addr
    FFF5
    07C0
    0782
    F8FD - mov.b #$fd,r0l
    7C08 - mov.b r0l,addr
    FFF0
    F800 - mov.b #$00,r0l
    7C08 - mov.b r0l,addr
    FFF2
    F80D - mov.b #$0d,r0l
    7C08 - mov.b r0l,addr
    FFF1
    F800 - mov.b #$00,r0l
    7C08 - mov.b r0l,addr
    FFF3
    F800 - mov.b #$00,r0l
    7C08 - mov.b r0l,addr
    FFF4
    5C80 - jsr addr
    112A
    F83B - mov.b #$3b,r0l
    7C08 - mov.b r0l,addr
    FFE0
    F883 - mov.b #$83,r0l
    7C08 - mov.b r0l,addr
    FFE2
    6D00 - mov.w addr,r0
    FFD2
    5670 - btst #7,r0h
.-- 4704 - beq
|   6D00 - mov.w addr,r0
|   FFD0
`-> F049 - mov.b #$49,r0h
    F832 - mov.b #$32,r0l
    7D00 - mov.w r0,addr
    FFD2
    F096 - mov.b #$96,r0h
    F830 - mov.b #$30,r0l
    7D00 - mov.w r0,addr
    FFD4
    6D00 - mov.w addr,r0
    FFD2
    5670 - btst #7,r0h
.-- 4704 - beq
|   6D00 - mov.w addr,r0
|   FFD0
`-> F800 - mov.b #00,r0l
    5008
    5018
    7C08 - mov.b r0l,addr
    FDAE
    5A80 - jmp addr
    03A8
    40FE - infinite loop

0007A2:
    7B70 - push r0
    6C08 - mov.b addr,r0l
    FFE2
    E808 - and #$08,r0l
    F087 - mov.b #$87,r0h
    1408 - or r0h,r0l
    7C08 - mov.b r0l,addr
    FFE2
    F880 - mov.b #$80,r0l
    7C08 - mov.b r0l,addr
    FC6B
    6B70 - pop r0
    5980 - rte

0007BC:
    7B70 - push r0
    7B71 - push r1
    6C08 - mov.b addr,r0l
    FFE3
    6C00 - mov.b addr,r0h
    FFE2
    5260
    C0B0 - or #$b0,r0h
    7C00 - mov.b r0h,addr
    FFE2
    6C00 - mov.b addr,r0h
    FC2C
    5620 - btst #2,r0h
.-- 4636 - bne forward
|   6C00 - mov.b addr,r0h
|   FC1B
|   A003 - cmp #$03,r0h
|-- 472E - beq forward
|   A8F8 - cmp #$f8,r0l
|-- 442A - bcc forward
|   6C00 - mov.b addr,r0h
|   FC1B
|   A003 - cmp #$03,r0h
|-- 4722 - beq forward
|   6C09 - mov.b addr,r1l
|   FC6B
|-- 4B1C - bmi forward
|   F100 - mov.b #$00,r1h
|   7E18
|   FD14
|   0A09 - inc r1l
|   E93F - and #$3f,r1l
|   7C09 - mov.b r1l,addr
|   FC6B
|   6C01 - mov.b addr,r1h
|   FC6C
|   1C91 - cmp.b r1l,r1h
|-- 4606 - bne forward
|   C980 - or #$80,r1l
|   7C09 - mov.b r1l,addr
|   FC6B
`-> 6B71 - pop r1
    6B70 - pop r0
    5980 - rte

000814:
    7B70 - push r0
    7B71 - push r1
    6C09 - mov.b addr,r1l
    FFE2
    6C08 - mov.b addr,r0l
    FC6E
    6C00 - mov.b addr,r0h
    FC6D
    1C08 - cmp.b r0h,r0l
.-- 4720 - beq ...
|   F000 - mov.b #$00,r0h
|   6E00
|   FC6F
|   7C00 - mov.b r0h,addr
|   FFE1
|   5279
|   C970 - or #$70,r1l
|   7C09 - mov.b r1l,addr
|   FFE2
|   0A08
|   E81F - and #$1f,r0l
|   7C08 - mov.b r0l,addr
|   FC6E
|   6B71 - pop r1
|   6B70 - pop r0
|   5980 - rte
|
`-> F9F7 - mov.b #$f7,r1l
    7C09 - mov.b r1l,addr
    FFE2
    6B71 - pop r1
    6B70 - pop r0
    5980 - rte

007080: table of test mode LCD strings (8 chars each)
007150: some related code
    5F02 - mov.w #imm,r2
    7080 - address of string table
    F000 - mov.b #$00,r0h
    0900 - add r0,r0
    0900 - add r0,r0
    0900 - add r0,r0
    0902 - add r0,r2
    F008 - mov.b #$08,r0h
    [...]

008F58: table of instrument names (8 chars each)
009288: table of rhythm names (8 chars each)
0095B8: table of song names (8 chars each)
0098E8: table of misc. LCD strings (8 chars each)
005120: some related code
    5F02 - mov.w #imm,r2
    8F58 - address of instrument names
.-> 6C0C - mov.b addr,r4l
|   FC34
|   F400 - mov.b #$00,r4h
|   0944 - add r4,r4
|   0944 - add r4,r4
|   0944 - add r4,r4
|   0942 - add r4,r2
|   40D8 - bra ...
|   
|   5F02 - mov.w #imm,r2
|   9288 - address of rhythm names
|-- 40EA - bra ...
|   
|   5F02 - mov.w #imm,r2
|   95B8 - address of song names
|-- 40E4 - bra ...
|   
|   5F02 - mov.w #imm,r2
|   98E8 - address of misc. strings
`-- 40DE - bra ...
    [...]
    

gt913.txt

GT913 | H8/300 | desc
------+--------+---------------------------------------------------------------
0000  | 0000   | NOP
09xy  | 09xy   | ADD Rx, Ry
14xy  | 14xy   | OR Rx, Ry
19xy  | 19xy   | SUB Rx, Ry
1Cxy  | 1Cxy   | CMP.B Rx, Ry
4xyy  | 4xyy   | Bxx PC+yy (branch)
50xy  | 70xy   | BSET #x,Ry (?)
51xy  | 60xy   | BSET Rx,Ry (?)
52xy  | 72xy   | BCLR #x,Ry (?)
53xy  | 62xy   | BCLR Rx,Ry (?)
56xy  | 73xy   | BTST #x,Ry
57xy  | 63xy   | BTST Rx,Ry
5800  | 5470   | RTS
5980  | 5670   | RTE
5A80  | 5A00   | JMP addr
5C80  | 5E00   | JSR addr
5F0x  | 790x   | MOV.W #imm, Rx
6Bxy  | 6Dxy   | MOV.W @Rx+, Ry (pop)
      | (b7=0) |
6C0x  | 6A0x   | MOV.B addr, Rx
6D0x  | 6B0x   | MOV.W addr, Rx
7Bxy  | 6Dxy   | MOV.W Ry, @Rx- (push)
      | (b7=1) |
7C0x  | 6A8x   | MOV.B Rx, addr
7D0x  | 6B8x   | MOV.W addr, Rx
Axyy  | Axyy   | CMP #$yy, Rx
Cxyy  | Cxyy   | OR #$yy, Rx
Exyy  | Exyy   | AND #$yy, Rx
Fxyy  | Fxyy   | MOV.B #$yy, Rx

50xx-57xx:
0101 0000 0 -> 0111 0000 0
0101 0001 0 -> 0110 0000 0
0101 0010 0 -> 0111 0010 0
0101 0011 0 -> 0110 0010 0
0101 0110 0 -> 0111 0011 0
0101 0111 0 -> 0110 0011 0
swap bits (15, 14, 13, 8, 11, 12, 9, 10, 7, 6, 5, 4, 3, 2, 1, 0), then xor 0x3400

58xx-5fxx:
0101 1000 0 -> 0101 0100 0
0101 1001 1 -> 0101 0110 0
0101 1010 1 -> 0101 1010 0
0101 1100 1 -> 0101 1110 0
0101 1111 0 -> 0111 1001 0 

6xxx-7xxx:
0110 1011 0 -> 0110 1101 0
0110 1100 0 -> 0110 1010 0
0110 1101 0 -> 0110 1011 0
0111 1011 0 -> 0110 1101 1
0111 1100 0 -> 0110 1010 1
0111 1101 0 -> 0110 1011 1
swap bits (15, 14, 13, 7, 11, 9, 10, 8, 12, 6, 5, 4, 3, 2, 1, 0)