Roland DIF-AT - Revision history

RSS1: /* Repairs - */

2026-04-28T10:50:11Z

Repairs -

RSS1: /* Repairs - */

2026-04-28T10:49:14Z

Repairs -

RSS1: /* High Performance Embedded Workshop - */

2026-04-28T10:48:25Z

High Performance Embedded Workshop -

RSS1: layout

2026-04-28T10:46:59Z

layout

RSS1: /* Repairs - */

2026-04-28T10:45:14Z

Repairs -

RSS1: /* NOTES - */

2026-04-28T10:26:13Z

NOTES -

RSS1: /* Roland RBUS */ ad notes

2026-04-28T10:10:18Z

Roland RBUS: ad notes

Show changes

RSS1: /* Roland RBUS */

2026-04-28T09:59:28Z

Roland RBUS

RSS1: /* Extract Firmware - */ adjust layout

2026-04-28T09:44:24Z

Extract Firmware -: adjust layout

RSS1: /* Diagnostic Mode - */ add python script

2026-04-28T09:41:31Z

Diagnostic Mode -: add python script

← Older revision		Revision as of 10:50, 28 April 2026
Line 572:		Line 572:
	File:Dif-at-tracerepair4.png\|CPU traces repaired. Sorry, not a great shot		File:Dif-at-tracerepair4.png\|CPU traces repaired. Sorry, not a great shot
	</gallery>		</gallery>
		+
		+	== To Do - ==

@@ Line 578: / Line 578: @@
 I will update this when the device is fully tested.  For now, be assured that it's back together, repaired, and starting to boot.  There could be some small issues, which can be discovered and fixed with the UART function.  I could only continue the marathon with a reboot myself.
-Thanks for reading.  I hope it's interesting and or useful!
+Thanks for reading.  I hope it's interesting and or useful!  If you want the Cutter project file I can send it you, email me through the site.
 ==NOTES -==

@@ Line 13: / Line 13: @@
 Given the device was already non-responsive (and now damaged further) -
-===Goals- ===
+===Goals-===
 #De-solder NOR Flash and read firmware.
@@ Line 259: / Line 259: @@
 ===High Performance Embedded Workshop -===
 [[File:HEW.png|thumb|High Performance Embedded Workshop]]
 I downloaded HEW from Renesas, which still keeps this available online.  Superannuated Software, total 1998 vibes (though I think its 2003) I love that look though!  I managed to load the firmware into it, and yes, it appears to be recognised and loads in just fine.  This is a big step, its the first time I'm looking at the disassembly, and it seems like its not badly corrupted (it loads it in)  I enter the RAM addresses and sizes and mess about with it for a bit. . .

@@ Line 1: / Line 1: @@
 PCB photos, Pinouts, Pin header, Device operation, Connections between subsystems. Notes on firmware structure, Machine language monitor program, DFU, firmware extraction, firmware update script (python)
@@ Line 16: / Line 13: @@
 Given the device was already non-responsive (and now damaged further) -
-===Goals-===
+===Goals- ===
 #De-solder NOR Flash and read firmware.
@@ Line 71: / Line 67: @@
 I connected to the Xilinx XC95144 using Bluetag, OpenOCD and XC3SPROG (open source Xilinx CLI) and was eventually able to read back ID codes and find IR Len etc.  I was happy it was responding.  It was fun, confusing and difficult to set up all these tools.  I set most of them up on a Raspberry Pi as dedicated hacking server so I can connect remotely to the hot mess setup with my laptop, somewhere more comfortable : )
 It seems strange to me that, this is a 100 pin CPLD, and only 4 inputs and 4 outputs are used!  (solely RBUS data, 8 channels L/R in/out). Counter output from H8300H goes to clock pin of the Xilinx, through an inverter.
 <gallery>
 File:XC3SPROG id read.png|alt=XC3SPROG id read|'''XC3SPROG id read'''
@@ Line 100: / Line 97: @@
 <br />
-===TL48 Programmer-===
+===T48 Programmer-===
-I used a TL48 programmer with a 48pin TTSOP to read the NOR Flash firmware contents -
+I used a T48 programmer with a 48pin TTSOP to read the NOR Flash firmware contents -
 In the image below are the settings needed for a good read.  The NOR flash is 16 bit wide, but the CPU is reading it in 8 bit mode (8 bit mode pin is tied low).   SHARP LH28F400BVE Parallel NOR Flash 512kb.  The chip is from the late 1990s as the device is also, turn of the century 2000s.

@@ Line 566: / Line 566: @@
 <br />
-== Repairs - ==
+==Repairs -==
 After confirming the firmware of the CPLD and the Flash seem intact.  I flashed the firmware onto a new NOR flash chip.  I also replaced the SRAM (these are almost a consumable, and I have had one of this range fail before, in a different package)
-I replaced the other chips I had removed.  I fixed the traces on the board with new pcb traces.  I had to repair a leg of a custom Alesis IC (there are three, two small one large). The chip was bridged with a factory bodge of a capacitor.  Removing that, broke the leg off the IC.  I was able to grind away the epoxy and solder a new leg in place.
+I replaced the other chips I had removed.  I fixed the traces on the board with new pcb traces.  I had to repair a leg of a custom Alesis IC (there are three, two small one large). The chip was bridged with a factory bodge of a capacitor.  Removing that, broke the leg off the IC.  I was able to grind away the epoxy and solder a new leg in place.  Almost 20 traces have been repaired.
-The LEDs had metal fatigued off with all the repairs.  I ground away the solder resist and was able to solder them directly to the board again. (they are a custom design package. Also, I like to use the original.  Only the legs were broken after all)
+The LEDs had metal fatigued off with all the repairs.  I ground away the solder resist and was able to solder them directly to the board again. (they are a custom design package. Also, I like to use the original.  Only the legs were broken after all)<gallery>
 ==NOTES -==
@@ Line 721: / Line 731: @@
 Ic 18 (opto-isolator) -
-Ic 16 (opto-isolator) - to Ic 28 (multiple pins, bridged) (mux)''''<nowiki>'''''</nowiki>'''''<nowiki>'''''</nowiki>'''''
+Ic 16 (opto-isolator) - to Ic 28 (multiple pins, bridged) (mux)'<nowiki/>'''<nowiki>'''''</nowiki>'''''<nowiki>'''''</nowiki>''
 Ic 14 (opto-isolator) - to Alesis cpld pin 58

@@ Line 564: / Line 564: @@
 Here are some general pinout notes on the DIF-AT RBUS and Digital Audio flow, and the connections to the Alesis Chip (which seems to do all the heavy lifting as regards audio and timing)  All audio formats go directly into the Alesis chip.  The Xilinx chip is handling RBUS only.
-=== NOTES - ===
+<br />
 Xilinx CPLD solely handles r-bus output signals, taking from Alexis, re-timing/re -serialising? then output - 4 in 4 out (stereo pairs 8 channel audio)
@@ Line 709: / Line 721: @@
 Ic 18 (opto-isolator) -
-Ic 16 (opto-isolator) - to Ic 28 (multiple pins, bridged) (mux)''''''''''''''<nowiki>'''''</nowiki>
+Ic 16 (opto-isolator) - to Ic 28 (multiple pins, bridged) (mux)''''<nowiki>'''''</nowiki>'''''<nowiki>'''''</nowiki>'''''
 Ic 14 (opto-isolator) - to Alesis cpld pin 58

@@ Line 135: / Line 135: @@
 As this device has no screen, a low level diagnostic routine is inferred from their discovery.  Looking closely at the last string or two, I was worried that it might be corrupted as there are some missing letters in the string - (ADAT Sync   port di  onnected and Dectected rather than Detected).
-== Examine Firmware - ==
+==Examine Firmware -==
 [[File:DIF AT FLASH SETTINGS.png|thumb|T48 programmer settings and dump - note the very interesting strings!]]
@@ Line 540: / Line 540: @@
 ==Roland RBUS==
-Here I will refer to the excellent site of Chris Xiong who made a converter from RBUS>ADAT (but not bi-directional)  I bought two from him (though I have been too busy with reversing the official one to use them much).
+Here I will refer to the excellent site of Chris Xiong who made a converter from RBUS>ADAT (but not bi-directional)
 https://chrisoft.org/blog/post/2024-02-02.html (RBUS technical information)
 https://chrisoft.org/blog/post/rbus-adat-m.html (Project page)

@@ Line 91: / Line 91: @@
 [[File:VIVERIS BOUNDARY SCANNER.png|thumb|Viveris JTAG Boundary Scanner]]
-==Extract Firmware -==
+==Extract Flash Firmware -==
@@ Line 135: / Line 135: @@
 As this device has no screen, a low level diagnostic routine is inferred from their discovery.  Looking closely at the last string or two, I was worried that it might be corrupted as there are some missing letters in the string - (ADAT Sync   port di  onnected and Dectected rather than Detected).
 [[File:DIF AT FLASH SETTINGS.png|thumb|T48 programmer settings and dump - note the very interesting strings!]]
@@ Line 271: / Line 272: @@
 There was actually some DOS software that I had a crack at too which apparently loaded H8 firmware but I never got it to open the file.
-==Ghidra -==
+===Ghidra -===
 I find Ghidra and compile Dev version for some reason I can't recall.  I think so I could load third party CPUs.
 '''H8300H is not supported in Ghidra'''.  I find a plugin, https://github.com/shizmob/ghidra-h8-300 and try to compile that and load in Ghidra.  It won't compile though -                                Later I also tried https://github.com/carllom/sleigh-h8 which I also don't get running in Ghidra -
-==Cutter -==
+===Cutter -===
 [[File:DIFAT CUTTER SSHOT.png|thumb|DIF-AT firmware loaded into Cutter]]

@@ Line 283: / Line 283: @@
 ===Diagnostic Mode -===
-Firmware checks for input (button push) in early boot.  This branches into and launches diagnostic (Monitor) mode.  Run Commands not yet discovered.
+Firmware checks for input (button push) in early boot.  This branches into and launches diagnostic (Monitor) mode.  Diag. Commands not yet fully discovered/mapped - some notes from gpt - I don't know if these are correct, when I have the device under test I will try them
 ===DFU Routine -===
@@ Line 369: / Line 397: @@
 ===DFU Python Script===
-With more help from LLM I made a DFU Update python script which first sends the (probable) DFU command, and then sends sequentially all midi files over serial (at midi baud)  I compared the received payload to the sent, and it is correct.  I have yet to test on the device.
+With more help from LLM I made a DFU Update python script which first sends the (probable) DFU command, and then sends sequentially all midi files over serial (at midi baud)  I compared the received payload to the sent, and it is correct.  I have yet to test on the device.<syntaxhighlight lang="python3">