The QL's ROM Port was located at address $C000_hex or %1100 0000 0000 0000_bin or 49,152_dec and together with the ROMOEH line, any ROM in the slot would be enabled when A15, A14 and ROMOEH were all high. A15 and A14 are, of course, both high when addressing any byte in the ROM.

ROMs were up to 16Kb (16,384 bytes) in size so the ROM port allowed for addresses between $C000_hex and $FFFF_hex so any address in the ROM will have bits 15 and 14 set, thus, to read a byte from the ROM, simply (!) set up the desired address on the address lines, then take ROMOEH high. That will, with a bit of decoding, enable the ROM (usually an EPROM) output and the byte can be read from the data lines. Easy?

Dismantling a ROM cartridge shows that there are two chips and a couple of smoothing capacitors inside - one across the power lines of each chip.

One chip is the EPROM - in my case, a MBM27128-25, the other is a DM74LS10N which is a triple 3 input NAND gate.

Only one of the three NAND gates within the chip is used, and it is connected to A15, A14 and ROMOEH as inputs, and the output is connected to Q^bar (IE active low) which enables the EPROM to output it's data according to the actual address on the 16 address lines. When A15, A14 and ROMOEH are high, the NAND gate output goes low and that brings the EPROM's Q^bar low enabling the data to be read.

The ROM cartridge connector has tracks on both sides of the PCB to allow it to connect to the QL's ROM Port. These tracks are connected internally to the EPROM chip and the Address decoding logic in the NAND gate chip. The upper side of the PCB resembles this, and is the side without the two chips:

        +------------+
               1     | VDD
               2     | A14
               3     | A13
               4     | A8
               5     | A9
               6 ||||  SLOT
               7     | A11
               8     | ROMOEH
               9     | A10
              10     | A15
              11     | D7
              12     | D6
              13     | D5
              14     | D4
              15     | D3
        +------------+

The lower side of the PCB is the side containing the two chips, and the tracks are as follows:

        +--------------------------+
     NC |     1    o---v---o
    A12 |     2    o       o
     A7 |     3    o       o
     A6 |     4    o       o
     A5 |     5    o       o  o-v-o
   SLOT  |||| 6    o       o  o   o
     A4 |     7    o       o  o   o
     A3 |     8    o       o  o   o
     A2 |     9    o       o  o   o
     A1 |    10    o       o  o   o
     A0 |    11    o       o  o---o
     D0 |    12    o       o
     D1 |    13    o       o
     D2 |    14    o       o
    GND |    15    o-------o
        +--------------------------+

The numbering above refers to the tracks on the PCB and not to the pins on the EPROM.

On track 1, NC means Not Connected.

The functions of the tracks are as follows:

WARNING: Never plug or unplug a ROM cartridge while the QL power is on.

I'm unaware if the MBM27128-25 chip is the same EPROM used in every QL ROM cartridge, but just in case, here are some details about it, and how it needs to be set up to be read. Programming is not something I've ever done with EPROMs, so I leave those details to others.

        ------v------  
VPP   o|  1       28 |o   VCC
A12   o|  2       27 |o   Pbar
A7    o|  3       26 |o   A13
A6    o|  4       25 |o   A8
A5    o|  5       24 |o   A9
A4    o|  6       23 |o   A11
A3    o|  7       22 |o   Qbar
A2    o|  8       21 |o   A10
A1    o|  9       20 |o   Ebar
A0    o| 10       19 |o   D7
D0    o| 11       18 |o   D6
D1    o| 12       17 |o   D5
D2    o| 13       16 |o   D4
VSS   o| 14       15 |o   D3
        -------------
        
    PinOut for MBM27128-25

Notes:

• Qbar, Pbar and Ebar are active low.

• Qbar enables the data output. When pulled low, data can be read from the data lines D0-D7.
• Pbar controls the chip programming. You'll need an EPROM programmer to make use of this.
• Ebar enables the chip itself. When high, the chip is disabled, when low, the chip is enabled.

• VSS is ground.
• VCC is 5v nominal but never higher than 7v absolute maximum (above VSS).
• VPP should be the same as VSS when reading data. 5v.
• D0-D7 are referred to as Q0-Q7 on some data sheets. Q meaning output.

From the data sheet for a MBM27128-25, to read data, the following should be carried out:

Initially:

• Connect VSS to ground.
• Connect VPP, VCC and Pbar to +5v.

In a loop to read various addresses:

• Connect Ebar to +5v.
• Set up the required address to be read, on the address lines A0-A15.
• Connect Ebar to ground to enable data output.
• In the case of the MBM27128-25, data will be stable within 250 nano seconds, maximum. The MBM27128-20 is stable within 200 nano seconds and the MBM27128-30 within 300 nano seconds.
• Read the data byte from data lines D0-D7.

The data sheet does not state how long it takes for the address lines to become stable, there might need to be a delay, or maybe the time it takes to bring Qbar low is all the delay required.