Advice on Kurzweil SP2X digital piano DSP issues and flash Eeprom recovery

[alfredokiwi]

Hi Folks, here with a question about firmware recovery. I have a strange issue with a Kurzweil SP2X digital piano. The main question is how to connect a TL866 programmer to flash the mainboard soldered TSOP48 Eeprom chip using the 50 pins connect_boot on schematics.



The equipment is a dead non working unit that came years ago for repair from other service center. Unfortunately the DSP unit is partially damaged with random issues caused by the extreme working temperature of the ASIC sound DSP array. At the beginning the main problem was a faulty capacitor that entered in short circuit fusing a protection +Vcc resistor on the display and switches panel board. I replaced that and the unit started to turn on again supposedly without issues. I also checked voltage regulators replacing the 7805 and 7812 on the MIDI and 88 keys Fatar scanner board with new ones and tested the 3,3V and 2,5 and 1,8 volts SMD regulator on the main board, everything was fine. But after 1 hour of usage the sound started to distort with a white noise like a FM weak radio station. Sometimes the noise affected only the left channel, then the right channel or both in an randomly way. I suspected first a clock frequency drift on main Xtal 24,576 Mhz but with the oscilloscope the frequency is 100% accurate without drift issues, also checked the 12,288 Mhz Kurzweil MARA proprietary DSP clock out. Also checked the 6 Mhz secondary Xtal for the USB and 4Mhz clock fot the MIDI RS232 serial to parallel transceiver. Because everything was fine I suspected data corruption in the mask ROM chip were samples are stored or issues on the DRAM for the effects unit. With the heat station I reflow the DSP chip and figured out that heating the mask ROM or DSP the white noise disappears for moments and came back. But the strange of all was that lowering the 3,3 volts for the DSP chip to 2,15 volt the noise goes of totally. The sweet spot was around 2,3 volts and 2,8 volts for the DSP unit. It seems that the high temperature of the MARA DSP chip approx. at 80 grad Celsius over the years of usage affected the ASIC core on the I/O bus. Lowering the DSP voltage requires less I/O current on the data and address bus so the point here is that the high temperature operation on MARA DSP chip wear out the ASIC core after 5 years of usage.



The MARA DSP chip is the big one, on the corner right side are the 3,3 and 1,8 volts regulators. I have in my room another SP2X that I buy used in 2013 replacing the potentiometers on the pitch and modulation wheels. Also I have soldered heatsinks on the 3,3 V and 1,8 regulators installing also a PC mainboard southbridge heatsink on the DSP MARA chip because the DSP working operation of 70 grads Celsius is unacceptable. No issues after 15 years of usage thanks to the heatsink lowering DSP operating temperature at 35 grads because I was aware that a DSP will not survive for many years working at 70 Celsius on plastic case cover, inside the ASIC core the hot spot runs higher at 100 Celsius or more. There are a lot of videos on youtube about the failures on dead Kurzweil's affecting the SP4, SP5, PC3Le because use the same DSP architecture running to hot.

The main question is if I can connect a TL866 programmer on connect_boot 50 pins to flash the AM29F160 Eeprom without unsoldering the chip from the mainboard. Why, because the only way to have the firmware binary file seems to be reading from my former 2013 SP2X the flash Eeprom data. But first I will check if the TL866 works properly in the dead mainboard detecting the AMD29F160 device. The corrupted firmware seems to run something because are active signals on data and address bus, but the communication to the panel display board is missing. And the proprietary Kurzweil way to update the firmware is through a MIDI file playback a file not in binary format at all. Because MIDI files are also binaries I expected that renaming to .bin would suffice but on Hex editor the format is Kurzweil proprietary. Here the link about the firmware files https://kurzweil.com/wp-content/uploads/2019/10/SP2X_COMBV110.zip if someone want to investigate, there are two MIDI files and how-to tutorial. I would be nice if the data can be extracted from the MIDI files, also the another question is where the bootloader information is stored, inside the AM29F160 chip?. In the TL866 application there is no way to select the bootloader Eeprom zone.



Any ideas on how to proceed using the boot connect port the 50 pin connector on left side same as a SCSI hard drive cable and if is possible to extract the Eeprom data in binary format from the zip MIDI files? Tanks a lot for any suggestions.

[alfredokiwi]

I include the information from datasheet about the signals for the flash Eeprom programming



And the 2 Midi firmware files top sections the bootloader to start up the system and the main code





Any ideas to extract the firmware data and see if the connect_boot 50 pin port can be used with the TL866 programmer? Thanks a lot.

[alfredokiwi]

It seems that the extraction of the firmware from the MIDI files would be impossible, so the best is to read from the former working SP2X the firmware. Based on the information on schematics to avoid the possibility of an accidental erase of data I will force the set of the programmer rising with a pull up externally the #WE pin disconnecting on TL866 #WE to set the flash Eeprom into read mode. This will be the best way because I don't want to have caused by an error on the computer application an accidental write. On the flash procedure a write command should be sent before to initialize the write mode because the memory runs an internal manager to write the data. This means that is impossible to assert a command erasing accidentally the data inside the flash memory with a voltage fluctuation or power lost on a device. Sometimes an unexpected data lost disaster happens. For safety the idea to force the read mode pulling up #WE externally to avoid an unexpected data erase.



Inside the mainboard is a Schmitt trigger inverter 74HC14 connected between the CPU MC68331 and the flash memory to handle the #WE and #OE. Because the MCU68331 will not find the boot device removing the boot select J2 jumper on schematic all MCU inputs and outputs should be float in high impedance state. In the case of writing I will connect the #WE line to the TL866 programmer because the write procedure interchange handshake information to report the status, errors etc. Inside the memory is a factory AMD code that manages the initialization and write sector procedure. The boot sector is located on the bottom address on the AM29F160DB but I don't know is this is related to the bootloader or the internal write manager, In reading mode there is no need to send a command because works like a standard Eprom meaning that there is no way with a power spike to assert a write command interchange to initialize the write procedure erasing accidentally data.

For the programming I will use this setup soldering  on the top connectors a 50 pin SCSI parallel cable used in the old computers to the connect_boot  port. And with the tester I will check before the TSOP48 connections between the red PCB and the flash memory soldered on the mainboard.



The bottom adapter is needed to enable the write in 16 bits mode because is the way set by default on the mainboard with a pull up resistor on the flash memory, also is important to provide external 5 volts Vcc because of the current protection on TL866 and USB power limitation. I need to confirm that the adapter on TL866 works in 16 bits write mode.

Sounds good the idea exposed? Any suggestions corrections are welcome because is a complicated topic.

[alfredokiwi]

The adapter seems to use two 74HC373 latch address buffers expanding the bus lines to write the flash memory in 16 bits mode. And much better because the programming runs at lower speed enabling the use of a parallel SCSI cable.

This workaround forcing the memory setup only in read mode would not harm the working firmware in the reading process, but before opening the working SP2X I will test on failed mainboard if the flash memory is properly detected reading the entire code memory block to analyze what remains on data with an disassembler tool for the MC68331, family of the MC68000 Motorola processor.

I hope to have good news in the next days, please let me know for any suggestions if something is wrong.

Folks to make things more fun here a video about the working Kurzweil SP2X with me singing same as the broken unit, I am in the process of learning music.



An here the custom digital dashboard of my Kawasaki GPX600 a cool homemade idea


 

[fzabkar]

I wonder if the structure of the firmware update bears some similarity to Roland's?

https://forum.hddguru.com/viewtopic.php?p=249990#p249990

[alfredokiwi]

I wonder if the structure of the firmware update bears some similarity to Roland's?

https://forum.hddguru.com/viewtopic.php?p=249990#p249990

Many thanks for the information. It would be nice if you have available the .BAS files and the application for the Roland firmware extraction. Maybe if I modify the files adapting the extraction of MIDI data for Kurzweil format would be the best option. The firmware is running the panel communication and display OK because seems that the DSP is the culprit part and has no sense to open my former SP2X working unit to experiment. The risk are to high and I don't want to have a second dead SP2X.

On last tests seems that the failure is on the DSP. I was able to start up again the Kurzweil, forcing a reset on the DSP. The main CPU 68331 is waiting for a response from the Kurzweil MARA chip. This is the reason why a hot reset on the DSP overrides the issue. On the previous hot reset days ago the DSP worked fine in the sound output and effects adjusting the DSP Vcore at 2,8 volts below the factory 3,3 volts. But now it was impossible to make it work again with sound output, only the display and buttons panel works properly. And every day that pass the DSP consumes less power running at cool temperature meaning that there are issues caused by the high DSP temperature on the past without factory heatsink. I have some pictures and a video here the display and push buttons panel started to work properly because of the forced reset lowering the Vcore on the Kurzweil MARA DSP core. In other words the main CPU received a DSP Ok message starting the normal operation, communicating the UART with the panel and display. The DSP reset works like a sort of DSP error override.

In the first picture is running the demo 2 a MIDI format song inside the flash Eeprom chip



Here is selected the piano sound  3



The selection of sound on the panel buttons working properly after DSP hot reset



To know if the system DSP started I soldered a red led on the coils of the mute relays, the red led means DAC sound output enabled. Kurzweil decided to use relays for the DAC output avoiding the pop noise on DAC initialization. With the blue trim potentiometer soldered on the 3,3 volts regulator I make the adjustments to lower the DSP voltage. This was the way at the beginning to eliminate the output white noises lowering the voltage on Kurzweil MARA DSP. But DSP degradation continues despite the lower Vcore voltage. The root cause is the inside silicon core deterioration caused by the past hot running temperature in the range of 70 celsius without heatsink. This is the reason why in year 2013 I installed on my former SP2X a passive southbridge heatsink on DSP, because inside the silicon ASIC hot spots are at 100 celsius or more.



The oscilloscope helped a lot to understand what really happens. Here the culprit part is the poor silicon quality of the MARA Kurzweil DSP ENGINE. Inside the DSP seems that a degradation caused by the hot running temperature exhausted the chip core. I don't know if the DSP runs a sort of microcode but in the case of the effects the allocation  of the algorithms is dynamic depending of the sounds in use and user patch configuration.



I will continue to investigate.

To have an idea about Kurzweil SP2X, SP3X, SP4X issues take a look here
https://forum.vintagesynth.com/viewtopic.php?t=110509

Another page reporting on PC3 issues on dual DSP MARA chips



https://gearspace.com/board/electronic-music-instruments-and-electronic-music-production/1223933-my-kurzweil-pc3-nothing-but-static.html

Thanks very much.

[fzabkar]

The .mid file consists of 8802 blocks of data of size 0x106 bytes beginning with ...

Code: [Select]

F7 13 F0 82 02 07 00 30 01 05 02 00 00 00 00 00 00

The blocks are contained within segments.

This is an example of a block that is filled with data. Many blocks are full of zeros.

Code: [Select]

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  F7 13 F0 82 02 07 00 30 01 05 02 00 00 00 00 00
00000010  00 01 18 00 00 29 34 00 00 00 06 20 00 00 00 00
00000020  00 00 00 00 00 00 74 40 60 0E 48 08 01 5B 00 00
00000030  00 0D 59 00 00 00 6E 00 07 00 04 65 20 00 4F 50
00000040  62 53 70 00 64 3E 4F 4F 60 09 52 64 28 3E 00 0D
00000050  04 09 79 28 2A 3E 04 66 29 50 04 7D 02 14 19 00
00000060  07 63 6C 7C 7C 01 4D 16 62 43 70 04 68 1F 4F 4B
00000070  42 53 70 26 3E 41 00 66 29 61 21 78 02 32 1E 67
00000080  68 00 04 69 34 14 1F 00 06 41 7C 7C 56 15 1F 02
00000090  53 14 68 02 3E 41 0A 4F 40 03 11 76 3E 3D 00 66
000000A0  4B 41 21 78 02 34 10 27 65 41 29 78 11 19 28 00
000000B0  13 74 18 54 7C 00 19 0F 53 73 78 02 34 59 0A 0F
000000C0  40 03 21 02 3E 2A 0A 4F 41 19 4A 34 01 1F 20 45
000000D0  06 20 01 78 7B 1F 1F 00 33 25 58 50 7C 01 1A 07
000000E0  73 72 70 54 7C 09 4F 50 20 19 4A 38 28 3E 00 4C
000000F0  47 59 7A 00 01 1A 2D 05 07 60 01 50 3F 1F 15 45
00000100  20 5E 41 2D 24 68

In Roland's case, 7-bit data is converted to 8-bit by unpacking the 8th byte of each octet. Kurzweil seems to do it differently.

[fzabkar]

Here are 5 consecutive blocks. The data payload appears to begin at offset 0x1C within each block. The last 6 bytes appear to be metadata of some kind.

Code: [Select]

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  F7 13 F0 82 02 07 00 30 01 05 02 00 00 00 00 00
00000010  00 00 10 00 00 08 4C 00 00 00 06 20 27 0D 09 63
00000020  42 38 78 4E 20 13 48 44 72 21 1C 4C 27 14 09 65
00000030  42 39 38 4E 30 13 4C 44 73 21 1C 6C 27 1C 09 67
00000040  22 39 78 4E 40 13 50 44 74 21 1D 0C 27 24 09 69
00000050  22 3A 30 4E 50 13 54 44 75 21 1D 2C 27 2C 09 6B
00000060  22 3A 70 4E 5E 13 58 44 76 21 1D 4C 27 34 09 6D
00000070  22 3B 30 4E 6E 13 5C 44 77 21 1D 6C 27 3C 09 6F
00000080  22 3B 70 4E 7E 13 60 44 78 21 1E 0C 27 44 09 71
00000090  22 3C 30 4F 0E 13 64 44 79 21 1E 2C 27 4C 09 73
000000A0  22 3C 70 4F 20 13 68 44 7A 21 1E 4C 27 54 09 75
000000B0  22 3D 38 4F 30 13 6C 44 7B 21 1E 6C 27 5C 09 77
000000C0  22 3D 78 4F 40 13 70 44 7C 21 1F 0C 27 64 09 79
000000D0  42 3E 38 4F 50 13 74 44 7D 21 1F 2C 27 6D 09 7B
000000E0  42 3E 78 4F 60 13 78 44 7E 31 1F 50 27 75 09 7D
000000F0  42 3F 38 4F 70 13 7D 04 7F 31 1F 70 27 7D 09 7F
00000100  40 73 68 0F 72 38

Code: [Select]

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  F7 13 F0 82 02 07 00 30 01 05 02 00 00 00 00 00
00000010  00 00 10 00 00 09 30 00 00 00 06 20 28 00 0A 00
00000020  02 40 08 50 02 14 01 05 00 21 20 0C 28 04 0A 01
00000030  02 40 28 50 0A 14 03 05 00 71 20 1C 28 08 0A 02
00000040  02 40 48 50 14 14 05 05 01 31 20 2C 28 0C 0A 03
00000050  22 40 68 50 1C 14 07 05 01 71 20 40 28 10 0A 04
00000060  22 41 08 50 24 14 09 45 02 31 20 50 28 14 0A 05
00000070  22 41 30 50 2C 14 0B 45 02 71 20 60 28 19 0A 06
00000080  22 41 50 50 34 14 0D 45 03 41 20 70 28 1D 0A 07
00000090  42 41 70 50 3E 14 0F 45 04 01 21 04 28 21 0A 08
000000A0  42 42 10 50 46 14 12 05 04 41 21 14 28 25 0A 09
000000B0  42 42 38 50 4E 14 14 05 05 11 21 24 28 2A 0A 0A
000000C0  42 42 58 50 58 14 16 05 05 51 21 34 28 2E 0A 0B
000000D0  62 42 78 50 60 14 18 45 06 11 21 48 28 32 0A 0C
000000E0  62 43 20 50 68 14 1A 45 06 61 21 58 28 37 0A 0D
000000F0  62 43 40 50 72 14 1C 45 07 21 21 6C 28 3B 0A 0F
00000100  00 3C 19 6C 70 58

Code: [Select]

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  F7 13 F0 82 02 07 00 30 01 05 02 00 00 00 00 00
00000010  00 00 10 00 00 0A 14 00 00 00 06 20 28 3C 0A 0F
00000020  22 43 70 50 7C 14 1F 45 08 01 22 00 28 41 0A 10
00000030  22 44 10 51 06 14 21 45 08 41 22 14 28 45 0A 11
00000040  42 44 30 51 0E 14 24 05 09 01 22 24 28 4A 0A 12
00000050  42 44 58 51 18 14 26 05 09 51 22 34 28 4E 0A 13
00000060  62 44 78 51 20 14 28 45 0A 11 22 48 28 53 0A 14
00000070  62 45 20 51 28 14 2A 45 0A 61 22 58 28 57 0A 16
00000080  02 45 40 51 32 14 2D 05 0B 21 22 6C 28 5C 0A 17
00000090  02 45 68 51 3A 14 2F 05 0B 71 22 7C 28 60 0A 18
000000A0  22 46 08 51 44 14 31 45 0C 31 23 10 28 65 0A 19
000000B0  22 46 30 51 4E 14 33 45 0D 01 23 24 28 69 0A 1A
000000C0  42 46 50 51 56 14 36 05 0D 41 23 34 28 6E 0A 1B
000000D0  42 46 78 51 60 14 38 05 0E 11 23 48 28 72 0A 1C
000000E0  62 47 20 51 68 14 3A 45 0E 61 23 58 28 77 0A 1E
000000F0  02 47 40 51 72 14 3D 05 0F 21 23 6C 28 7C 0A 1F
00000100  00 6F 57 43 18 40

Code: [Select]

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  F7 13 F0 82 02 07 00 30 01 05 02 00 00 00 00 00
00000010  00 00 10 00 00 0A 78 00 00 00 06 20 28 7D 0A 1F
00000020  42 47 70 51 7E 14 40 05 10 01 24 04 29 02 0A 20
00000030  42 48 18 52 08 14 42 05 10 51 24 18 29 06 0A 21
00000040  62 48 40 52 10 14 44 45 11 21 24 28 29 0B 0A 23
00000050  02 48 60 52 1A 14 47 05 11 61 24 3C 29 10 0A 24
00000060  02 49 08 52 24 14 49 05 12 31 24 50 29 14 0A 25
00000070  22 49 30 52 2C 14 4B 45 13 01 24 60 29 19 0A 26
00000080  42 49 50 52 36 14 4E 05 13 51 24 74 29 1E 0A 27
00000090  62 49 78 52 40 14 50 45 14 11 25 08 29 23 0A 28
000000A0  62 4A 20 52 4A 14 52 45 14 61 25 1C 29 27 0A 2A
000000B0  02 4A 48 52 54 14 55 05 15 31 25 30 29 2C 0A 2B
000000C0  22 4A 70 52 5C 14 57 45 16 01 25 40 29 31 0A 2C
000000D0  42 4B 18 52 66 14 5A 05 16 51 25 54 29 36 0A 2D
000000E0  62 4B 38 52 70 14 5C 45 17 21 25 68 29 3B 0A 2F
000000F0  02 4B 60 52 7A 14 5F 05 17 61 25 7C 29 40 0A 30
00000100  20 45 33 49 49 00

Code: [Select]

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  F7 13 F0 82 02 07 00 30 01 05 02 00 00 00 00 00
00000010  00 00 10 00 00 0B 5C 00 00 00 06 20 29 41 0A 30
00000020  42 4C 18 53 06 14 62 05 18 51 26 14 29 46 0A 31
00000030  62 4C 40 53 10 14 64 45 19 21 26 28 29 4B 0A 33
00000040  02 4C 68 53 1A 14 67 05 19 71 26 3C 29 50 0A 34
00000050  22 4D 10 53 24 14 69 45 1A 41 26 50 29 55 0A 35
00000060  42 4D 38 53 2E 14 6C 05 1B 11 26 64 29 5A 0A 36
00000070  62 4D 60 53 38 14 6E 45 1B 61 26 78 29 5F 0A 38
00000080  02 4E 08 53 42 14 71 05 1C 31 27 0C 29 64 0A 39
00000090  22 4E 30 53 4C 14 73 45 1D 01 27 24 29 69 0A 3A
000000A0  42 4E 58 53 56 14 76 05 1D 51 27 38 29 6E 0A 3B
000000B0  62 4F 00 53 62 14 78 45 1E 21 27 4C 29 73 0A 3D
000000C0  02 4F 28 53 6C 14 7B 05 1E 71 27 60 29 79 0A 3E
000000D0  22 4F 50 53 76 14 7E 05 1F 41 27 74 29 7E 0A 3F
000000E0  62 4F 78 54 00 15 00 45 20 11 28 08 2A 03 0A 41
000000F0  02 50 20 54 0A 15 03 05 20 71 28 1C 2A 08 0A 42
00000100  20 6C 7D 77 5F 30

[alfredokiwi]

The .mid file consists of 8802 blocks of data of size 0x106 bytes beginning with ...

Code: [Select]

F7 13 F0 82 02 07 00 30 01 05 02 00 00 00 00 00 00

The blocks are contained within segments.

This is an example of a block that is filled with data. Many blocks are full of zeros.

Code: [Select]

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  F7 13 F0 82 02 07 00 30 01 05 02 00 00 00 00 00
00000010  00 01 18 00 00 29 34 00 00 00 06 20 00 00 00 00
00000020  00 00 00 00 00 00 74 40 60 0E 48 08 01 5B 00 00
00000030  00 0D 59 00 00 00 6E 00 07 00 04 65 20 00 4F 50
00000040  62 53 70 00 64 3E 4F 4F 60 09 52 64 28 3E 00 0D
00000050  04 09 79 28 2A 3E 04 66 29 50 04 7D 02 14 19 00
00000060  07 63 6C 7C 7C 01 4D 16 62 43 70 04 68 1F 4F 4B
00000070  42 53 70 26 3E 41 00 66 29 61 21 78 02 32 1E 67
00000080  68 00 04 69 34 14 1F 00 06 41 7C 7C 56 15 1F 02
00000090  53 14 68 02 3E 41 0A 4F 40 03 11 76 3E 3D 00 66
000000A0  4B 41 21 78 02 34 10 27 65 41 29 78 11 19 28 00
000000B0  13 74 18 54 7C 00 19 0F 53 73 78 02 34 59 0A 0F
000000C0  40 03 21 02 3E 2A 0A 4F 41 19 4A 34 01 1F 20 45
000000D0  06 20 01 78 7B 1F 1F 00 33 25 58 50 7C 01 1A 07
000000E0  73 72 70 54 7C 09 4F 50 20 19 4A 38 28 3E 00 4C
000000F0  47 59 7A 00 01 1A 2D 05 07 60 01 50 3F 1F 15 45
00000100  20 5E 41 2D 24 68

In Roland's case, 7-bit data is converted to 8-bit by unpacking the 8th byte of each octet. Kurzweil seems to do it differently.

Thanks a lot here I share the only video that I have recorded, on which the output white noise can be heard. Is a fatal non working sound DSP scenario. Based on the information provided in forums the manufacturer recommendation is to disable the effects on internal Kurzweil MARA sound DSP chip.



The good news about the PC3 model dual DSP Kurzweil MARA engines one working as master and the other as slave is the possibility to interface a JTAG debugger to see the internal registers status and errors on each DSP. Despite that the manufacturer recommendation because there are no available software tools is to disable the output effects or replace the entire mainboard.



FYI there is also a special sound patch effect for downloading called "Noise killer" for the complete disabling of the MARA DSP turning the Kurzweil into a MIDI controller. After that you can use Kurzweil plug in VSTs in your PC as sound generator with no more issues.

[alfredokiwi]

I find a video about Kurzweil issues and how customer's are left without support any help. We are talking about the most expensive PC3X line of keyboards. The amount of dead Kurzweils rise every year.



I seems that a big ventilator runs below the keyboard to cool it down. The degradation inside the logic core destroyed the mainboard.

[Ailalola2023]

Hola Alfredo te consulto, tengo un kurzweil pc361 con ese problema de ruido blanco ya asumí que es el chip mara encargado de los efectos dsp, es en vano hacer un reballing para ver si se soluciona el problema? En el caso de hacerlo tenes idea si es complicado el proceso? Gracias saludos desde Rosario, santa fe, Argentina...