diff --git a/src/emu/cpu/melps4/m58846.c b/src/emu/cpu/melps4/m58846.c
index 824969f8cd6..17161da2fb5 100644
--- a/src/emu/cpu/melps4/m58846.c
+++ b/src/emu/cpu/melps4/m58846.c
@@ -50,9 +50,7 @@ offs_t m58846_device::disasm_disassemble(char *buffer, offs_t pc, const UINT8 *o
 void m58846_device::device_start()
 {
 	melps4_cpu_device::device_start();
-	
-	m_timer[0] = timer_alloc(0);
-	m_timer[1] = timer_alloc(1);
+	m_timer = timer_alloc(0);
 }
 
 
@@ -66,7 +64,7 @@ void m58846_device::device_reset()
 	melps4_cpu_device::device_reset();
 	
 	// timer 1 runs continuously
-	reset_timer1();
+	reset_timer();
 }
 
 
@@ -75,37 +73,30 @@ void m58846_device::device_reset()
 //  timers
 //-------------------------------------------------
 
-void m58846_device::reset_timer1()
+void m58846_device::reset_timer()
 {
 	// reset 7-bit prescaler
 	attotime base = attotime::from_ticks(6 * 128, unscaled_clock());
-	m_timer[0]->adjust(base);
+	m_timer->adjust(base);
 }
 
 void m58846_device::device_timer(emu_timer &timer, device_timer_id id, int param, void *ptr)
 {
-	switch (id)
-	{
-		// timer 1
-		case 0:
-			m_irqflag[1] = true;
-			m_possible_irq = true;
-			reset_timer1();
-			break;
-
-		// timer 2
-		case 1:
-			break;
-
-		default:
-			assert_always(FALSE, "Unknown id in m58846_device::device_timer");
-			break;
-	}
+	if (id != 0)
+		return;
+	
+	// timer 1 overflow
+	m_irqflag[1] = true;
+	m_possible_irq = true;
+	reset_timer();
 }
 
 void m58846_device::write_v(UINT8 data)
 {
 	// d0: enable timer 1 irq
+	// d1: enable timer 2 irq? (TODO)
+	// d2: ?
+	// d3: timer 2 enable?
 	m_tmr_irq_enabled[0] = (data & 1) ? true : false;
 	m_possible_irq = true;
 	
@@ -121,7 +112,7 @@ void m58846_device::write_v(UINT8 data)
 void m58846_device::execute_one()
 {
 	// handle one opcode
-	switch (m_op & 0xf0)
+	switch (m_op & 0x1f0)
 	{
 		case 0x30: op_sey(); break;
 		case 0x70: op_sp(); break;
@@ -131,7 +122,7 @@ void m58846_device::execute_one()
 		case 0xc0: case 0xd0: case 0xe0: case 0xf0: op_lxy(); break;
 
 		default:
-			switch (m_op & 0xfc)
+			switch (m_op & 0x1fc)
 			{
 		case 0x20: op_szb(); break;
 		case 0x4c: op_sb(); break;
@@ -156,11 +147,11 @@ void m58846_device::execute_one()
 		case 0x03: op_dey(); break;
 		case 0x04: op_di(); break;
 		case 0x05: op_ei(); break;
+		case 0x09: op_tabe(); break; // undocumented
 		case 0x0a: op_am(); break;
 		case 0x0b: op_ose(); break;
 		case 0x0c: op_tya(); break;
 		case 0x0f: op_cma(); break;
-		// 0x18 RAR undocumented?
 
 		case 0x10: op_cls(); break;
 		case 0x11: op_clds(); break;
@@ -169,6 +160,8 @@ void m58846_device::execute_one()
 		case 0x15: op_sd(); break;
 		case 0x16: op_tepa(); break;
 		case 0x17: op_ospa(); break;
+		case 0x18: op_rl(); break; // undocumented
+		case 0x19: op_rr(); break; // undocumented
 		case 0x1a: op_teab(); break;
 		case 0x1b: op_osab(); break;
 		case 0x1c: op_tba(); break;
@@ -203,10 +196,10 @@ void m58846_device::execute_one()
 			break;
 
 			}
-			break; // 0xff
+			break; // 0x1ff
 
 			}
-			break; // 0xfc
+			break; // 0x1fc
 
 	} // big switch
 }
diff --git a/src/emu/cpu/melps4/m58846.h b/src/emu/cpu/melps4/m58846.h
index 458f649c4f0..72d8253dd23 100644
--- a/src/emu/cpu/melps4/m58846.h
+++ b/src/emu/cpu/melps4/m58846.h
@@ -34,8 +34,8 @@ protected:
 	virtual void device_timer(emu_timer &timer, device_timer_id id, int param, void *ptr);
 	virtual void write_v(UINT8 data);
 	
-	emu_timer *m_timer[2];
-	void reset_timer1();
+	emu_timer *m_timer;
+	void reset_timer();
 };
 
 
diff --git a/src/emu/cpu/melps4/melps4.c b/src/emu/cpu/melps4/melps4.c
index c4309c6a3b9..e6291a485da 100644
--- a/src/emu/cpu/melps4/melps4.c
+++ b/src/emu/cpu/melps4/melps4.c
@@ -117,6 +117,7 @@ void melps4_cpu_device::device_start()
 	m_irqflag[0] = m_irqflag[1] = m_irqflag[2] = false;
 	m_tmr_irq_enabled[0] = m_tmr_irq_enabled[1] = false;
 	m_int_state = 0;
+	m_t_state = 0;
 	m_prohibit_irq = false;
 	m_possible_irq = false;
 
@@ -157,6 +158,7 @@ void melps4_cpu_device::device_start()
 	save_item(NAME(m_irqflag));
 	save_item(NAME(m_tmr_irq_enabled));
 	save_item(NAME(m_int_state));
+	save_item(NAME(m_t_state));
 	save_item(NAME(m_prohibit_irq));
 	save_item(NAME(m_possible_irq));
 
@@ -327,6 +329,7 @@ void melps4_cpu_device::execute_set_input(int line, int state)
 		
 		// timer input pin
 		case MELPS4_INPUT_LINE_T:
+			write_t_in(state);
 			break;
 
 		default:
diff --git a/src/emu/cpu/melps4/melps4.h b/src/emu/cpu/melps4/melps4.h
index e4110dd07e7..5a7d2327198 100644
--- a/src/emu/cpu/melps4/melps4.h
+++ b/src/emu/cpu/melps4/melps4.h
@@ -206,6 +206,7 @@ protected:
 	bool m_irqflag[3];      // irq flags: exf, 1f, 2f (external, timer 1, timer 2)
 	bool m_tmr_irq_enabled[2];
 	int m_int_state;        // INT pin state
+	int m_t_state;          // T input pin state
 	bool m_prohibit_irq;    // interrupt is prohibited during certain opcodes
 	bool m_possible_irq;    // indicate that irq needs to be rechecked
 
@@ -237,6 +238,7 @@ protected:
 	devcb_write8 m_write_u;
 	devcb_write_line m_write_t;
 	
+	virtual void write_t_in(int state) { m_t_state = state; }
 	virtual void write_v(UINT8 data) { m_v = data; }
 	virtual void write_w(UINT8 data) { m_w = data; }
 	virtual void do_interrupt(int which);
@@ -259,6 +261,7 @@ protected:
 	void op_tay();
 	void op_tya();
 	void op_teab();
+	void op_tabe();
 	void op_tepa();
 	void op_txa();
 	void op_tax();
@@ -284,6 +287,8 @@ protected:
 	void op_rc();
 	void op_szc();
 	void op_cma();
+	void op_rl();
+	void op_rr();
 
 	void op_sb();
 	void op_rb();
diff --git a/src/emu/cpu/melps4/melps4d.c b/src/emu/cpu/melps4/melps4d.c
index 01d9b51f5ce..4c2ca2fd9d4 100644
--- a/src/emu/cpu/melps4/melps4d.c
+++ b/src/emu/cpu/melps4/melps4d.c
@@ -18,10 +18,10 @@
 enum e_mnemonics
 {
 	em_ILL,
-	em_TAB, em_TBA, em_TAY, em_TYA, em_TEAB, em_TEPA, em_TXA, em_TAX,
+	em_TAB, em_TBA, em_TAY, em_TYA, em_TEAB, em_TABE, em_TEPA, em_TXA, em_TAX,
 	em_LXY, em_LZ, em_INY, em_DEY, em_LCPS, em_SADR,
 	em_TAM, em_XAM, em_XAMD, em_XAMI,
-	em_LA, em_AM, em_AMC, em_AMCS, em_A, em_SC, em_RC, em_SZC, em_CMA,
+	em_LA, em_AM, em_AMC, em_AMCS, em_A, em_SC, em_RC, em_SZC, em_CMA, em_RL, em_RR,
 	em_SB, em_RB, em_SZB, em_SEAM, em_SEY,
 	em_TLA, em_THA, em_TAJ, em_XAL, em_XAH, em_LC7, em_DEC, em_SHL, em_RHL, em_CPA, em_CPAS, em_CPAE, em_SZJ,
 	em_T1AB, em_TRAB, em_T2AB, em_TAB1, em_TABR, em_TAB2, em_TVA, em_TWA, em_SNZ1, em_SNZ2,
@@ -33,10 +33,10 @@ enum e_mnemonics
 static const char *const em_name[] =
 {
 	"?",
-	"TAB", "TBA", "TAY", "TYA", "TEAB", "TEPA", "TXA", "TAX",
+	"TAB", "TBA", "TAY", "TYA", "TEAB", "TABE", "TEPA", "TXA", "TAX",
 	"LXY", "LZ", "INY", "DEY", "LCPS", "SADR",
 	"TAM", "XAM", "XAMD", "XAMI",
-	"LA", "AM", "AMC", "AMCS", "A", "SC", "RC", "SZC", "CMA",
+	"LA", "AM", "AMC", "AMCS", "A", "SC", "RC", "SZC", "CMA", "RL", "RR",
 	"SB", "RB", "SZB", "SEAM", "SEY",
 	"TLA", "THA", "TAJ", "XAL", "XAH", "LC7", "DEC", "SHL", "RHL", "CPA", "CPAS", "CPAE", "SZJ",
 	"T1AB", "TRAB", "T2AB", "TAB1", "TABR", "TAB2", "TVA", "TWA", "SNZ1", "SNZ2",
@@ -49,10 +49,10 @@ static const char *const em_name[] =
 static const UINT8 em_bits[] =
 {
 	0,
-	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0, 0,
 	6, 1, 0, 0, 1, 2,
 	2, 2, 2, 2,
-	4, 0, 0, 0, 4, 0, 0, 0, 0,
+	4, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0,
 	2, 2, 2, 0, 4,
 	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
@@ -67,10 +67,10 @@ static const UINT8 em_bits[] =
 static const UINT32 em_flags[] =
 {
 	0,
-	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0, 0,
 	0, 0, 0, 0, 0, 0,
 	0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 	0, 0, 0, 0, 0,
 	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
@@ -86,8 +86,8 @@ static const UINT32 em_flags[] =
 static const UINT8 m58846_opmap[0xc0] =
 {
 //  0        1        2        3        4        5        6        7        8        9        A        B        C        D        E        F
-	em_NOP,  em_BA,   em_INY,  em_DEY,  em_DI,   em_EI,   em_RU,   em_SU,   0,       0,       em_AM,   em_OSE,  em_TYA,  0,       0,       em_CMA,  // 0x
-	em_CLS,  em_CLDS, 0,       em_CLD,  em_RD,   em_SD,   em_TEPA, em_OSPA, 0,       0,       em_TEAB, em_OSAB, em_TBA,  em_TAY,  em_TAB,  0,       // 1x
+	em_NOP,  em_BA,   em_INY,  em_DEY,  em_DI,   em_EI,   em_RU,   em_SU,   0,       em_TABE, em_AM,   em_OSE,  em_TYA,  0,       0,       em_CMA,  // 0x
+	em_CLS,  em_CLDS, 0,       em_CLD,  em_RD,   em_SD,   em_TEPA, em_OSPA, em_RL,   em_RR,   em_TEAB, em_OSAB, em_TBA,  em_TAY,  em_TAB,  0,       // 1x
 	em_SZB,  em_SZB,  em_SZB,  em_SZB,  0,       0,       em_SEAM, 0,       0,       0,       0,       em_SZD,  0,       0,       0,       em_SZC,  // 2x
 	em_SEY,  em_SEY,  em_SEY,  em_SEY,  em_SEY,  em_SEY,  em_SEY,  em_SEY,  em_SEY,  em_SEY,  em_SEY,  em_SEY,  em_SEY,  em_SEY,  em_SEY,  em_SEY,  // 3x
 	em_LCPS, em_LCPS, 0,       em_AMC,  em_RT,   em_RTS,  em_RTI,  0,       em_RC,   em_SC,   em_LZ,   em_LZ,   em_SB,   em_SB,   em_SB,   em_SB,   // 4x
diff --git a/src/emu/cpu/melps4/melps4op.inc b/src/emu/cpu/melps4/melps4op.inc
index 6640156b16b..1ac63b0f2a2 100644
--- a/src/emu/cpu/melps4/melps4op.inc
+++ b/src/emu/cpu/melps4/melps4op.inc
@@ -64,6 +64,13 @@ void melps4_cpu_device::op_teab()
 	m_e = m_b << 4 | m_a;
 }
 
+void melps4_cpu_device::op_tabe()
+{
+	// TABE(undocumented): transfer E to A and B
+	m_b = m_e >> 4;
+	m_a = m_e & 0xf;
+}
+
 void melps4_cpu_device::op_tepa()
 {
 	// TEPA: decode A by PLA and transfer to E
@@ -247,6 +254,22 @@ void melps4_cpu_device::op_cma()
 	m_a ^= 0xf;
 }
 
+void melps4_cpu_device::op_rl()
+{
+	// RL(undocumented): rotate A left through carry
+	UINT8 c = m_a >> 3 & 1;
+	m_a = (m_a << 1 | m_cy) & 0xf;
+	m_cy = c;
+}
+
+void melps4_cpu_device::op_rr()
+{
+	// RR(undocumented): rotate A right through carry
+	UINT8 c = m_a & 1;
+	m_a = m_a >> 1 | m_cy << 3;
+	m_cy = c;
+}
+
 
 // Bit operations
 
@@ -395,7 +418,7 @@ void melps4_cpu_device::op_trab()
 void melps4_cpu_device::op_t2ab()
 {
 	// T2AB: transfer A and B to timer 2 and timer 2 reload
-	op_illegal();
+	//op_illegal();
 }
 
 void melps4_cpu_device::op_tab1()