Vague description of the NUM pin quoted from the datasheet:
This terminal is not for user application. In case of the HD6305Y1 (featuring an internal ROM), this terminal should be connected to Vcc through 10 kΩ resistance. In case of the HD6305Y2 (without an internal ROM), this terminal should be connected to Vss.
It turned out that the HD6305Y1 chip with the NUM pin connected to Vss behaves like the HD6305Y2, i.e. it starts to execute code from an external memory instead of the internal one. Unfortunately, the program cannot gain access to the internal ROM by switching the NUM pin state (because it is only sampled at reset and ignored later), but reading an undocumented register at address $001F or writing anything to it does the trick as well.
The only information about the $001F register found so far:
Never access the $13 to $1F areas since they are used for IC testing. Accessing these areas (reading/writing) causes the MCU to burst.
The program stored in the EPROM transmits the internal ROM contents (address range $0140 to $1FFF) through a serial port. The timing critical parts are marked by the number of clock cycles in the comments. Any modification of them should preserve the execution time.
Serial port settings:
portc equ $02 ddrc equ $06 ram equ $40 ;RAM starting address ; bits of the port C TXD equ 0 ;serial output, do not change! org $1F00 reset: sei rsp ; the program is copied to RAM then executed clrx loop1: lda progr,x sta ram,x incx bpl loop1 ;128 bytes are copied jmp ram ; code copied to RAM progr: lda #$01 ;1<<TXD sta ddrc ;TXD = output sta portc ;TXD = high ; delay ca. 500 ms clrx loop2: deca bne loop2 decx bne loop2 ; switch the microprocessor mode clr $1F ; byte loop loop4: bclr TXD,portc ;start bit ldacmd: lda $0140 ;4 cycles, modified operand sec ;1 cycle, stop bit ; bit loop, required length = 2.4576MHz / 4 / 9600Hz = 64 cycles loop5: ldx #10 ;2 cycles loop6: dex ;2 cycles bne loop6 ;3 cycles rora ;2 cycles rol portc ;5 cycles, Carry goes to TXD cmp #0 ;2 cycles, clears Carry bne loop5 ;3 cycles, next bit ; stop bits, number of cycles not critical, but at least 59 from here to loop4 ldx #30 loop7: dex bne loop7 ; next address inc ldacmd+2+ram-progr bne loop4 inc ldacmd+1+ram-progr brclr 5,ldacmd+1+ram-progr,loop4 ; done bra * ; RESET vector org $1FFE db high reset, low reset