83
edits
Changes
m
[Page under construction - as yet incomplete]
<br />
(that's right, I still haven't found Ghidra or Cutter yet)
<br />
→Repairs -
PCB photos, Pinouts, Pin header, Device operation, Connections between subsystems. Notes on firmware structure, Machine language monitor program, DFU, firmware extraction, firmware update script (python)
===Goals-===
#De-solder NOR Flash and read firmware.
I connected to the Xilinx XC95144 using Bluetag, OpenOCD and XC3SPROG (open source Xilinx CLI) and was eventually able to read back ID codes and find IR Len etc. I was happy it was responding. It was fun, confusing and difficult to set up all these tools. I set most of them up on a Raspberry Pi as dedicated hacking server so I can connect remotely to the hot mess setup with my laptop, somewhere more comfortable : )
It seems strange to me that, this is a 100 pin CPLD, and only 4 inputs and 4 outputs are used! (solely RBUS data, 8 channels L/R in/out). Counter output from H8300H goes to clock pin of the Xilinx, through an inverter.
<gallery>
File:XC3SPROG id read.png|alt=XC3SPROG id read|'''XC3SPROG id read'''
<br />
===TL48 T48 Programmer-===I used a TL48 T48 programmer with a 48pin TTSOP to read the NOR Flash firmware contents -
In the image below are the settings needed for a good read. The NOR flash is 16 bit wide, but the CPU is reading it in 8 bit mode (8 bit mode pin is tied low). SHARP LH28F400BVE Parallel NOR Flash 512kb. The chip is from the late 1990s as the device is also, turn of the century 2000s.
===High Performance Embedded Workshop -===
[[File:HEW.png|thumb|High Performance Embedded Workshop]]
I downloaded HEW from Renesas, which still keeps this available online. Superannuated Software, total 1998 vibes (though I think its 2003) I love that look though! I managed to load the firmware into it, and yes, it appears to be recognised and loads in just fine. This is a big step, its the first time I'm looking at the disassembly, and it seems like its not badly corrupted (it loads it in) I enter the RAM addresses and sizes and mess about with it for a bit. . .
==Roland RBUS==
Here I will refer to the excellent site of Chris Xiong who made a converter from RBUS>ADAT (but not bi-directional)
From the VS2480 service manual we can see this schematic about the RBUS connector - it is a bi-directional transfer (audio in and audio out) so it crosses over (like a null modem cable)
== Tascam T-DIF ==
I didn't go much into the TDIF as I don't have anything TDIF capable. Both RBUS and TDIF are long obsolete, but ADAT is still going strong. https://www.panix.com/~jens/da-88/tdif.html
However this is only between TDIF and ADAT.
Here are some general pinout notes on the DIF-AT RBUS and Digital Audio flow, and the connections to the Alesis Chip (which seems to do all the heavy lifting as regards audio and timing) All audio formats go directly into the Alesis chip. The Xilinx chip is handling RBUS only.
<br />
==Repairs -==
After confirming the firmware of the CPLD and the Flash seem intact. I flashed the firmware onto a new NOR flash chip. I also replaced the SRAM (these are almost a consumable, and I have had one of this range fail before, in a different package)
I replaced the other chips I had removed. I fixed the traces on the board with new pcb traces. I had to repair a leg of a custom Alesis IC (there are three, two small one large). The chip was bridged with a factory bodge of a capacitor. Removing that, broke the leg off the IC. I was able to grind away the epoxy and solder a new leg in place. Almost 20 traces have been repaired.
The LEDs had metal fatigued off with all the repairs. I ground away the solder resist and was able to solder them directly to the board again. (they are a custom design package. Also, I like to use the original. Only the legs were broken after all)<gallery>
File:Dif-at-tracerepair.png|alt=Traces replaced and connected.|Traces replaced and connected.
File:Dif-at-tracerepair2.png|traces tinned (way too much, I took some off with wick)
File:Dif-at-tracerepair3.png|placing component
File:Dif-at-tracerepair4.png|CPU traces repaired. Sorry, not a great shot
</gallery>
== To Do - ==
After some months working on this, and seeing the LEDs blink again (it took an embarrassingly long time to realise they were pulled high) I was satisfied I could take a short break from it. I will complete the repair by fully testing it and running the UART Monitor program.
I will update this when the device is fully tested. For now, be assured that it's back together, repaired, and starting to boot. There could be some small issues, which can be discovered and fixed with the UART function. I could only continue the marathon with a reboot myself.
Thanks for reading. I hope it's interesting and or useful! If you want the Cutter project file I can send it you, email me through the site.
==NOTES -==
Xilinx CPLD solely handles r-bus output signals, taking from Alexis, re-timing/re -serialising? then output - 4 in 4 out (stereo pairs 8 channel audio)
Alesis chip handles all format inputs and outputs them (retiming/prioritising?)
Cpu 8 - tif con pb / tp/ txd 2 CPU (seems to communicate with serial to TDIF board)
Cpu 9 - tif con pb / tp/ rxd2 CPU (seems to communicate with serial to TDIF board)
UART serial output -
From cpu 12 - txd0 - uart, midi baud
to Pin 13 ic 29 (inverter) 2a2 - output pin 7 2y2
Then via (not thru) diode/ resistor to
Pin 14 R-BUS CONN. RBUS_TX (MIDI transmit)
(In r-bus cable this crosses over to ARRIVE AT MIDI receive ON RECIPIENT DEVICE)
Cpu 13 out (txd1) ic 11 - sync signal?
Cpu 16 Sck0 irq4 or p94
Goes to T Dif con
Cpu 17 - sck1 irq5 p95
Goes to ic 29 pin 3 (2Y - output, inverted)
Input = 2a, pin 17 - ?????
Pin 25 R-BUS CONN. RBUS_RX (MIDI receive)
via (not thru) diode/ resistor TO pin 13 a6 ic 27 (INVERTER input)
Output pin 12 y6 - to pin 14 cpu RX0 UART RECEIVE SIGNAL -
PIN 13 R-BUS CONN. Power reception for bus-powered devices
This is where power comes into the Dif at - directly into the large filter capacitor.
(Routed from pin 5 of the r-bus connector via crossover cable)
Pin 21 R-BUS CONN. Frame sync (word clock) input
to Pin 15 input (inverter) ic 29 2a3 - output 2y3 pin 5-
then to pin 6,10,11,12 on ic 28 (muxer)
(Investigate further where does it leave MUXER?) cpu or cpld?'
Pin 18 R-BUS CONN. Frame sync (word clock) output
to Pin 11 input (inverter) ic 29 2a1 - output 2y1 pin 9 -
then to pin 7 on ic 28 (muxer) also pin 93 tp0 cpu (programmable timer, like tp3)
and last pin on cn6 to tif board (not pin1!)
R-bus inputs -
Pin 12 R-BUS CONN. Channel 1/2 input (SDIN1)
Via resistor + via diode to Pin 11 a5 (input inverter) ic 27 - output pin 10 y5
To pin 49 Alexis cpld (data input)
Pin 11 R-BUS CONN. Channel 3/4 input (SDIN2)
Via resistor + via diode to Pin 9 a4 (input inverter) ic 27 - output pin 8 y4
To pin 48 Alexis cpld (data input)
Pin 10 R-BUS CONN. Channel 5/6 input (SDIN3)
Via resistor + via diode to Pin 5 a3 (input inverter) ic 27 - output pin 6 y3
To pin 47 Alexis cpld (data input)
Pin 8 R-BUS CONN. Channel 7/8 input (SDIN4)
Via resistor + via diode to Pin 3 a2 (input inverter) ic 27 - output pin 4 y2
To pin 46 Alexis cpld (data input)
[R-Bus is then internal, along with a-dat and t-dif, they are translated into each other by the cpld]
Internal r-bus -
Alesis cpld pin 57 (data output) to Xilinx pin 45 (data input)
Alesis cpld pin 56 (data output) to Xilinx pin 44 (data input)
Alesis cpld pin 55 (data output) to Xilinx pin 43 (data input)
Alesis cpld pin 52 (data output) to Xilinx pin 42 (data input)
(three pins are consecutive, then a gap)
Flows to -
R-bus outputs -
Pin 55 Xilinx - (data output)
To pin 8 ic 29 (1a4) inverter / output pin 12 (1y4) then
thru ESD diode + resistor path to Pin 2 R-BUS CONN. Channel 1/2 output (SDOUT1)
Pin 56 Xilinx - (data output)
To pin 6 ic 29 (1a3) inverter / output pin 14 (1y3) then
thru ESD diode + resistor path to Pin 3 R-BUS CONN. Channel 3/4 output (SDOUT2)
Pin 57 Xilinx - (data output)
To pin 4 ic 29 (1a2) inverter / output pin 16 (1y2)
thru ESD diode + resistor path
to Pin 4 R-BUS CONN. Channel 5/6 output (SDOUT3)
Pin - 58 Xilinx - (data output)
to pin 2 ic 29 (1a1) (inverter) output Pin 18 -(1y1)
thru ESD diode + resistor path to pin 6 R-BUS CONN. Channel 7/8 output (SDOUT4)
Alesis pin 63 (input) = adat optical input (from Torx conn)
Alesis pin 62 (output) = adat optical output (from Torx conn)
Alesis pin 64 (input) = adat sync chip ic8 pin 7 (output?)
Alesis pin 60 (input) = adat sync chip ic10 pin 7 (output?)
<nowiki>'''''''''''''''''''''''''''''''</nowiki>
Ic 18 (opto-isolator) -
Ic 16 (opto-isolator) - to Ic 28 (multiple pins, bridged) (mux)'<nowiki/>'''<nowiki>'''''</nowiki>'''''<nowiki>'''''</nowiki>''
Ic 14 (opto-isolator) - to Alesis cpld pin 58
Ic 12 (opto-isolator) - to cpu pin 15 (rx1 SERIALinput)
Pin 1 - t Dif = pin 18 ya1 buffer = - input 1a1 pin 2 - pin 6 ff conn (t Dif pcb) - pin 6 cn6 main board.
Ic 9 pin 1 1a (inverter input) x2 (crystal) output via r63
Clock pin Alesis cpld pin 75 - ic 9 pin pin 7 1y (inverted output) + ic 15 pin 13
<nowiki>''''''''''''''''''</nowiki>
Ic 9 pin 3 2a (inverter input) to ic 13 (4066) pin 12 (ctl-d - d-11/10) ALSO to BREQ CPU 59 (PULLED HIGH ALSO)
+ ic 17 (dual bus buffer) pin 1, 7 (high impedance state [input] control pins)
Ic 9 pin 5 2y (inverter output) to ic 11 (octal Buffer) pins 1, 19 (TRI_STATE ENABLE, A+B) + ic 13 (4066), pins 5,6,13 (control pins b,C,A)
Ic 9 pin 6 3a (inverter input) to
Ic 9 pin 2 3y (inverter output) to ???? Can't find yet!!!!! (INPUT not tied to gnd or high so must be valid input)
Breq seems to be tied into the sync master ports, which system is syncing - tsdif adat.
Alesis pin 1 to 24 connects to flash + sram.