I bought a Milton Bradley Simon off ebay to decap the chip. The patent shows it uses a TI TMS-1000, but the chip in the game is a standard 16-pin DIP. I assumed that they just put the TMS-1000 die into a smaller package and didn't bring out all the pads, but the die shots (top metal, top metal removed) show it is not a TMS-1000. It looks like they had the functionality recreated in an ASIC to cut costs, since they sold so many games.
The chip package is marked "MB4850 SCUSO640 .3 H 8235". The Milton Bradley catalog number for Simon is MB4850, and the die is labeled 640. I don't know what SCUSO stands for "semi-custom" maybe? I'm not sure who the manufacturer is.
Simon at Waiting For Friday sent me a TMS-1000 from an earlier revision of Simon. I decapped it and dumped the ROM contents. Here's the instruction decode PLA (flipped to match the diagram in the Programmer's Reference Manual) and o-output PLA. The opcodes in the instruction decode PLA are in a different order than in the manual, but the opcodes all map to the same microinstructions.
I bought a Simon PCB off ebay that had a TMS1000 labeled MP3300. It's wired the same as the REV A PCB that Simon drew up
ROM array with top metal removed
output PLA with top metal removed
instruction PLA with top metal removed
Simon code disassembly and emulation
