After your LJMP MAIN insert an ORG 001Bh.

Currently, your interrupt routine is starting at 0003h, which is the External 0 Interrupt. The Timer 1 Interrupt starts at 001Bh. This means that when your timer 1 interrupt is triggered, it's executing bogus code starting at 001Bh.

Of course, the above shouldn't work in a simulator, either, so perhaps you just forgot to mention the ORG address in your post (?).

I would also either update P1 in your ISR or in the main code, but not both. This really shouldn't matter, but it'd be cleaner to update it in one place or the other.

Craig Steiner