Fixing a 30-year-old Roland synthesizer bug | Hacker News Reader

Fixing a 30-year-old Roland synthesizer bug

vogons.org

189 pointsmontag33 comments

Awesome work! I love the care and attention that people put into understanding these devices.

I'm currently in the middle of a vintage synthesiser hacking project as well. Last year I made a fully annotated disassembly of the Yamaha DX7 firmware, and did some other technical analysis of the synth. Since then, I've been waiting for a chance to put this knowledge to good use. I found a DX9 on a local trading site, and I'm in the process of hacking its firmware to remove the 4-operator restriction that made it such an unpopular synth.

I browsed through the repository as discovered by colejohnson66 downthread https://github.com/ajxs/yamaha_dx7_rom_disassembly. This is an example of superb, meticulous, lovingly documented work. The kind of thing you don't see every day, congratulations. The attention to detail is really just chef's kiss, starting with a really good repository name (a small thing, but still), continuing through clear and apparently comprehensive documentation of what you did and why, then on to beautifully formatted and commented assembly language (much better than the original source code I'd wager) with coherent and consistent paragraph commenting a particular delight, and finally (and very importantly) dedication to making sure others can reproduce your results and generate a matching binary too. There are likely to be other things of beauty in there I have forgotten to highlight, it's just that good. Oh the FAQ of course, what a great FAQ. Really I am being very wordy for someone that's lost for words.

BTW, I love retro computing too, this is my best attempt so far in the field https://github.com/billforsternz/retro-sargon. I aspire to similar standards to your good self, but I'm not there yet.

Thank you so much for your very kind words! I really appreciate them! It was indeed a labour of love. Being able to (re)create a matching binary was my benchmark for success, to prove the accuracy of the reverse-engineering.

Unfortunately it's impossible to know how well-documented the original assembly was. I've poked around in some of Yamaha's other synth firmware from the same era, and there's some reuse of code between them. That suggests there was some shared documentation, and tooling available between teams. Speaking of documentation, and naming: The placement of functions within the binary probably hints at the organisation of the project, and how things were named, however it's hard to tease out the abstractions they were working with after the fact.

This was my first project in 8-bit system programming. The Hitachi 6303 manual has some suggestions to use for project documentation that were even more comprehensive. I'd love to know more about how engineers worked in this era!

Also, your project looks amazing! I'll definitely give this a good look!

Are you familiar with Dexed[0]? It’s a free, open source DX7 emulator for most major DAWs. They’ve done similar work in figuring out how the device works internally.

[0] https://asb2m10.github.io/dexed/

Yes, both Dexed, and its authors were a great source of help and information for me in my research on the DX7!

Are you telling me the DX9, my first synth all those years ago, actually had more than 4 operators?

BTW, another thing that made it less popular: its keyboard. It didn't have velocity sensitity, nor aftertouch. Or is that also a ROM-upgrade away?

Yes, the "Worst FM Synth Ever[0] is actually a DX7 in disguise. Internally it uses the same sound generation hardware as the DX7. The internal circuitry is different overall, but the main sound generation chips, DAC, and output circuitry are identical. This means that by altering the firmware it's possible to turn the DX9 into a DX7, with a few differences. As you've noted, one of them is the non-velocity sensitive keyboard. You can make it respond to velocity, and aftertouch via MIDI, but making the keyboard itself velocity, or aftertouch sensitive isn't possible unfortunately.

[0] https://yamahadx9.com/DX9Worst.html

You'll probably love this - a complete reverse engineering of the Virus Synthesizer DSP code, which now runs extremely well in a DSP56400 emulator .. meaning you can run the Virus code directly on your PC and get the same audio as you'd get from real hardware:

https://dsp56300.wordpress.com

Pretty astonishing bit of reverse engineering there ..

Such clean and well organized work I rarely see. Painfully, I have to switch back now to my dayjob IDE.

Thank you! I try to put the same level of care into the professional work that I do, when the company allows me to do so. It's very rarely as fun and engaging as this project is though!

> Last year I made a fully annotated disassembly of the Yamaha DX7 firmware

You beast!

Found it: https://github.com/ajxs/yamaha_dx7_rom_disassembly

It’s extremely documented. More than I was expecting.

Thank you for putting the link here! I really appreciate everyone's kind words.

Outstanding! Super good commenting.

Last year I made a fully annotated disassembly of the Yamaha DX7 firmware

Jesus.

I wonder if DX100 firmware could be hacked like that as well, it being another of the 4-op beasts too

Unfortunately you can't add any more operators to the DX10, however you could probably add multitimbrality! Yamaha's YM2164 sound chip at the heart of the DX100 is pretty well understood, and very similar to the later YM2414 used in the multitimbral TX81Z.

This is cool, so TL;DR: The 3rd gen run of a Roland early digital synth product had an unresolved timing issue causing pitch playback problems. Recently, investigation revealed they hadn’t accounted for an Intel MCU part sub. The spec indicated the sub part was running too fast. They downclocked it via crystal swap which destroyed the unit’s MIDI timing. So they located the control ROM instructions to modify to fix the resulting MIDI sync issue and burned a new one:

  0x1A8D: 1D5Fh -> 1388h
  0x215C: 17h -> 0Fh
  0x216D: 1D5Fh -> 1388h

That’s it. Surgical.

I spent some time inside an early Roland sampler of this era during the pandemic. It’s really well engineered stuff that sounds great.

I guess it makes sense that it would be a common divider ratio (5000) but $1388 leapt out at me from disassembling the Ensoniq Mirage firmware.

It wasn't pitch playback problems it was vibrato rate.

I get what you mean, it was a temporal issue, but it’s a PCM synth. That’s sample playback, and vibrato in that context is a modulation of pitch of sample playback over time. It’s a pitch playback problem that was caused by too fast a clock causing too fast a pitch playback modulation. (The LFO being used to produce the vibrato effect being misclocked due to too-fast MCU, causing a pitch playback problem. The pitch playback modulation was at the wrong rate.)

Ah, relief. Big Roland fan but don’t have this particular piece of gear & had trouble following TFA

This reminds me of the binary patching done in The Martian film.

Yes, I love that the entire fix is a 5 byte change.

...plus the quartz crystal that you need to swap. And to get those 5 bytes into the ROM, you have to desolder that too unfortunately. But yeah, still cool.

There's also a cool story about somebody fixing some bugs on the Six~Trak and related synthesizers by Sequential that were among the first MIDI synthesizers:

http://www.tauntek.com/SixTrackBug.htm

Though some bugs are really part of the sound now in my opinion. I bought a DX11 to replace my DX27S but I discovered it doesn't glitch as nice and now I need to keep both.

If a person wanted to be able to play a little keyboard, would they start with piano lessons or is synthesizer a unique enough instrument that you would start with a synthesizer teacher? Does the world of piano have somebody like Justin Sandercoe from the world of guitar?

The Kawai K5 I used to have was also 8096 based.

Didn’t know that: hard to believe they managed to pull off additive synthesis on an 8096. That’s impressive

I had a later Kawai K5000 which added short PCM samples for attack transients. That thing was crazy, foolishly gave it away more than a decade ago

I received a final software update from Kawai and had to open it to install the EPROMs, which is how I saw it. It was a very cool synth - very high quality feeling.

I also had a K5000 and was so stupid to sell it over a decade ago; no way to find one again now at less than 5 times that money.

Intel 8097 in the Roland W30, and I think also the S50.

The later S550 is the unit I was fixing mentioned in another comment, that one was a 8095

Reply on news.ycombinator.com