Advice on Kurzweil SP2X digital piano DSP issues and flash Eeprom recovery - Page 1
Forum section: electronics / repair

author: alfredokiwi
author_rank: Contributor
timestamp: September 29, 2023, 11:56:12 am
content: Hi Folks, here with a question about firmware recovery. I have a strange issue with a Kurzweil SP2X digital piano. The main question is how to connect a TL866 programmer to flash the mainboard soldered TSOP48 Eeprom chip using the 50 pins connect_boot on schematics.The equipment is a dead non working unit that came years ago for repair from other service center. Unfortunately the DSP unit is partially damaged with random issues caused by the extreme working temperature of the ASIC sound DSP array. At the beginning the main problem was a faulty capacitor that entered in short circuit fusing a protection +Vcc resistor on the display and switches panel board. I replaced that and the unit started to turn on again supposedly without issues. I also checked voltage regulators replacing the 7805 and 7812 on the MIDI and 88 keys Fatar scanner board with new ones and tested the 3,3V and 2,5 and 1,8 volts SMD regulator on the main board, everything was fine. But after 1 hour of usage the sound started to distort with a white noise like a FM weak radio station. Sometimes the noise affected only the left channel, then the right channel or both in an randomly way. I suspected first a clock frequency drift on main Xtal 24,576 Mhz but with the oscilloscope the frequency is 100% accurate without drift issues, also checked the 12,288 Mhz Kurzweil MARA proprietary DSP clock out. Also checked the 6 Mhz secondary Xtal for the USB and 4Mhz clock fot the MIDI RS232 serial to parallel transceiver. Because everything was fine I suspected data corruption in the mask ROM chip were samples are stored or issues on the DRAM for the effects unit. With the heat station I reflow the DSP chip and figured out that heating the mask ROM or DSP the white noise disappears for moments and came back. But the strange of all was that lowering the 3,3 volts for the DSP chip to 2,15 volt the noise goes of totally. The sweet spot was around 2,3 volts and 2,8 volts for the DSP unit. It seems that the high temperature of the MARA DSP chip approx. at 80 grad Celsius over the years of usage affected the ASIC core on the I/O bus. Lowering the DSP voltage requires less I/O current on the data and address bus so the point here is that the high temperature operation on MARA DSP chip wear out the ASIC core after 5 years of usage.The MARA DSP chip is the big one, on the corner right side are the 3,3 and 1,8 volts regulators. I have in my room another SP2X that I buy used in 2013 replacing the potentiometers on the pitch and modulation wheels. Also I have soldered heatsinks on the 3,3 V and 1,8 regulators installing also a PC mainboard southbridge heatsink on the DSP MARA chip because the DSP working operation of 70 grads Celsius is unacceptable. No issues after 15 years of usage thanks to the heatsink lowering DSP operating temperature at 35 grads because I was aware that a DSP will not survive for many years working at 70 Celsius on plastic case cover, inside the ASIC core the hot spot runs higher at 100 Celsius or more. There are a lot of videos on youtube about the failures on dead Kurzweil's affecting the SP4, SP5, PC3Le because use the same DSP architecture running to hot.The main question is if I can connect a TL866 programmer on connect_boot 50 pins to flash the AM29F160 Eeprom without unsoldering the chip from the mainboard. Why, because the only way to have the firmware binary file seems to be reading from my former 2013 SP2X the flash Eeprom data. But first I will check if the TL866 works properly in the dead mainboard detecting the AMD29F160 device. The corrupted firmware seems to run something because are active signals on data and address bus, but the communication to the panel display board is missing. And the proprietary Kurzweil way to update the firmware is through a MIDI file playback a file not in binary format at all. Because MIDI files are also binaries I expected that renaming to .bin would suffice but on Hex editor the format is Kurzweil proprietary. Here the link about the firmware fileshttps://kurzweil.com/wp-content/uploads/2019/10/SP2X_COMBV110.zipif someone want to investigate, there are two MIDI files and how-to tutorial. I would be nice if the data can be extracted from the MIDI files, also the another question is where the bootloader information is stored, inside the AM29F160 chip?. In the TL866 application there is no way to select the bootloader Eeprom zone.Any ideas on how to proceed using the boot connect port the 50 pin connector on left side same as a SCSI hard drive cable and if is possible to extract the Eeprom data in binary format from the zip MIDI files? Tanks a lot for any suggestions.

author: alfredokiwi
author_rank: Contributor
timestamp: September 29, 2023, 01:37:53 pm
content: I include the information from datasheet about the signals for the flash Eeprom programmingAnd the 2 Midi firmware files top sections the bootloader to start up the system and the main codeAny ideas to extract the firmware data and see if the connect_boot 50 pin port can be used with the TL866 programmer? Thanks a lot.

author: alfredokiwi
author_rank: Contributor
timestamp: September 30, 2023, 08:22:43 am
content: It seems that the extraction of the firmware from the MIDI files would be impossible, so the best is to read from the former working SP2X the firmware. Based on the information on schematics to avoid the possibility of an accidental erase of data I will force the set of the programmer rising with a pull up externally the #WE pin disconnecting on TL866 #WE to set the flash Eeprom into read mode. This will be the best way because I don't want to have caused by an error on the computer application an accidental write. On the flash procedure a write command should be sent before to initialize the write mode because the memory runs an internal manager to write the data. This means that is impossible to assert a command erasing accidentally the data inside the flash memory with a voltage fluctuation or power lost on a device. Sometimes an unexpected data lost disaster happens. For safety the idea to force the read mode pulling up #WE externally to avoid an unexpected data erase.Inside the mainboard is a Schmitt trigger inverter 74HC14 connected between the CPU MC68331 and the flash memory to handle the #WE and #OE. Because the MCU68331 will not find the boot device removing the boot select J2 jumper on schematic all MCU inputs and outputs should be float in high impedance state. In the case of writing I will connect the #WE line to the TL866 programmer because the write procedure interchange handshake information to report the status, errors etc. Inside the memory is a factory AMD code that manages the initialization and write sector procedure. The boot sector is located on the bottom address on the AM29F160DB but I don't know is this is related to the bootloader or the internal write manager, In reading mode there is no need to send a command because works like a standard Eprom meaning that there is no way with a power spike to assert a write command interchange to initialize the write procedure erasing accidentally data.For the programming I will use this setup soldering on the top connectors a 50 pin SCSI parallel cable used in the old computers to the connect_boot port. And with the tester I will check before the TSOP48 connections between the red PCB and the flash memory soldered on the mainboard.The bottom adapter is needed to enable the write in 16 bits mode because is the way set by default on the mainboard with a pull up resistor on the flash memory, also is important to provide external 5 volts Vcc because of the current protection on TL866 and USB power limitation. I need to confirm that the adapter on TL866 works in 16 bits write mode.Sounds good the idea exposed? Any suggestions corrections are welcome because is a complicated topic.

author: alfredokiwi
author_rank: Contributor
timestamp: September 30, 2023, 09:48:32 am
content: The adapter seems to use two 74HC373 latch address buffers expanding the bus lines to write the flash memory in 16 bits mode. And much better because the programming runs at lower speed enabling the use of a parallel SCSI cable.This workaround forcing the memory setup only in read mode would not harm the working firmware in the reading process, but before opening the working SP2X I will test on failed mainboard if the flash memory is properly detected reading the entire code memory block to analyze what remains on data with an disassembler tool for the MC68331, family of the MC68000 Motorola processor.I hope to have good news in the next days, please let me know for any suggestions if something is wrong.Folks to make things more fun here a video about the working Kurzweil SP2X with me singing same as the broken unit, I am in the process of learning music.An here the custom digital dashboard of my Kawasaki GPX600 a cool homemade idea

author: fzabkar
author_rank: Super Contributor
timestamp: September 30, 2023, 08:13:24 pm
content: I wonder if the structure of the firmware update bears some similarity to Roland's?https://forum.hddguru.com/viewtopic.php?p=249990#p249990

author: alfredokiwi
author_rank: Contributor
timestamp: October 01, 2023, 11:40:04 am
content: Quote from: fzabkar on September 30, 2023, 08:13:24 pmMany thanks for the information. It would be nice if you have available the .BAS files and the application for the Roland firmware extraction. Maybe if I modify the files adapting the extraction of MIDI data for Kurzweil format would be the best option. The firmware is running the panel communication and display OK because seems that the DSP is the culprit part and has no sense to open my former SP2X working unit to experiment. The risk are to high and I don't want to have a second dead SP2X.On last tests seems that the failure is on the DSP. I was able to start up again the Kurzweil, forcing a reset on the DSP. The main CPU 68331 is waiting for a response from the Kurzweil MARA chip. This is the reason why a hot reset on the DSP overrides the issue. On the previous hot reset days ago the DSP worked fine in the sound output and effects adjusting the DSP Vcore at 2,8 volts below the factory 3,3 volts. But now it was impossible to make it work again with sound output, only the display and buttons panel works properly. And every day that pass the DSP consumes less power running at cool temperature meaning that there are issues caused by the high DSP temperature on the past without factory heatsink. I have some pictures and a video here the display and push buttons panel started to work properly because of the forced reset lowering the Vcore on the Kurzweil MARA DSP core. In other words the main CPU received a DSP Ok message starting the normal operation, communicating the UART with the panel and display. The DSP reset works like a sort of DSP error override.In the first picture is running the demo 2 a MIDI format song inside the flash Eeprom chipHere is selected the piano sound 3The selection of sound on the panel buttons working properly after DSP hot resetTo know if the system DSP started I soldered a red led on the coils of the mute relays, the red led means DAC sound output enabled. Kurzweil decided to use relays for the DAC output avoiding the pop noise on DAC initialization. With the blue trim potentiometer soldered on the 3,3 volts regulator I make the adjustments to lower the DSP voltage. This was the way at the beginning to eliminate the output white noises lowering the voltage on Kurzweil MARA DSP. But DSP degradation continues despite the lower Vcore voltage. The root cause is the inside silicon core deterioration caused by the past hot running temperature in the range of 70 celsius without heatsink. This is the reason why in year 2013 I installed on my former SP2X a passive southbridge heatsink on DSP, because inside the silicon ASIC hot spots are at 100 celsius or more.The oscilloscope helped a lot to understand what really happens. Here the culprit part is the poor silicon quality of the MARA Kurzweil DSP ENGINE. Inside the DSP seems that a degradation caused by the hot running temperature exhausted the chip core. I don't know if the DSP runs a sort of microcode but in the case of the effects the allocation of the algorithms is dynamic depending of the sounds in use and user patch configuration.I will continue to investigate.To have an idea about Kurzweil SP2X, SP3X, SP4X issues take a look herehttps://forum.vintagesynth.com/viewtopic.php?t=110509Another page reporting on PC3 issues on dual DSP MARA chipshttps://gearspace.com/board/electronic-music-instruments-and-electronic-music-production/1223933-my-kurzweil-pc3-nothing-but-static.htmlThanks very much.

author: fzabkar
author_rank: Super Contributor
timestamp: October 01, 2023, 06:38:38 pm
content: The .mid file consists of 8802 blocks of data of size 0x106 bytes beginning with ...Code:F7 13 F0 82 02 07 00 30 01 05 02 00 00 00 00 00 00The blocks are contained within segments.This is an example of a block that is filled with data. Many blocks are full of zeros.Code:Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F00000000 F7 13 F0 82 02 07 00 30 01 05 02 00 00 00 00 0000000010 00 01 18 00 00 29 34 00 00 00 06 20 00 00 00 0000000020 00 00 00 00 00 00 74 40 60 0E 48 08 01 5B 00 0000000030 00 0D 59 00 00 00 6E 00 07 00 04 65 20 00 4F 5000000040 62 53 70 00 64 3E 4F 4F 60 09 52 64 28 3E 00 0D00000050 04 09 79 28 2A 3E 04 66 29 50 04 7D 02 14 19 0000000060 07 63 6C 7C 7C 01 4D 16 62 43 70 04 68 1F 4F 4B00000070 42 53 70 26 3E 41 00 66 29 61 21 78 02 32 1E 6700000080 68 00 04 69 34 14 1F 00 06 41 7C 7C 56 15 1F 0200000090 53 14 68 02 3E 41 0A 4F 40 03 11 76 3E 3D 00 66000000A0 4B 41 21 78 02 34 10 27 65 41 29 78 11 19 28 00000000B0 13 74 18 54 7C 00 19 0F 53 73 78 02 34 59 0A 0F000000C0 40 03 21 02 3E 2A 0A 4F 41 19 4A 34 01 1F 20 45000000D0 06 20 01 78 7B 1F 1F 00 33 25 58 50 7C 01 1A 07000000E0 73 72 70 54 7C 09 4F 50 20 19 4A 38 28 3E 00 4C000000F0 47 59 7A 00 01 1A 2D 05 07 60 01 50 3F 1F 15 4500000100 20 5E 41 2D 24 68In Roland's case, 7-bit data is converted to 8-bit by unpacking the 8th byte of each octet. Kurzweil seems to do it differently.

author: fzabkar
author_rank: Super Contributor
timestamp: October 01, 2023, 07:09:49 pm
content: Here are 5 consecutive blocks. The data payload appears to begin at offset 0x1C within each block. The last 6 bytes appear to be metadata of some kind.Code:Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F00000000 F7 13 F0 82 02 07 00 30 01 05 02 00 00 00 00 0000000010 00 00 10 00 00 08 4C 00 00 00 06 20 27 0D 09 6300000020 42 38 78 4E 20 13 48 44 72 21 1C 4C 27 14 09 6500000030 42 39 38 4E 30 13 4C 44 73 21 1C 6C 27 1C 09 6700000040 22 39 78 4E 40 13 50 44 74 21 1D 0C 27 24 09 6900000050 22 3A 30 4E 50 13 54 44 75 21 1D 2C 27 2C 09 6B00000060 22 3A 70 4E 5E 13 58 44 76 21 1D 4C 27 34 09 6D00000070 22 3B 30 4E 6E 13 5C 44 77 21 1D 6C 27 3C 09 6F00000080 22 3B 70 4E 7E 13 60 44 78 21 1E 0C 27 44 09 7100000090 22 3C 30 4F 0E 13 64 44 79 21 1E 2C 27 4C 09 73000000A0 22 3C 70 4F 20 13 68 44 7A 21 1E 4C 27 54 09 75000000B0 22 3D 38 4F 30 13 6C 44 7B 21 1E 6C 27 5C 09 77000000C0 22 3D 78 4F 40 13 70 44 7C 21 1F 0C 27 64 09 79000000D0 42 3E 38 4F 50 13 74 44 7D 21 1F 2C 27 6D 09 7B000000E0 42 3E 78 4F 60 13 78 44 7E 31 1F 50 27 75 09 7D000000F0 42 3F 38 4F 70 13 7D 04 7F 31 1F 70 27 7D 09 7F00000100 40 73 68 0F 72 38Code:Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F00000000 F7 13 F0 82 02 07 00 30 01 05 02 00 00 00 00 0000000010 00 00 10 00 00 09 30 00 00 00 06 20 28 00 0A 0000000020 02 40 08 50 02 14 01 05 00 21 20 0C 28 04 0A 0100000030 02 40 28 50 0A 14 03 05 00 71 20 1C 28 08 0A 0200000040 02 40 48 50 14 14 05 05 01 31 20 2C 28 0C 0A 0300000050 22 40 68 50 1C 14 07 05 01 71 20 40 28 10 0A 0400000060 22 41 08 50 24 14 09 45 02 31 20 50 28 14 0A 0500000070 22 41 30 50 2C 14 0B 45 02 71 20 60 28 19 0A 0600000080 22 41 50 50 34 14 0D 45 03 41 20 70 28 1D 0A 0700000090 42 41 70 50 3E 14 0F 45 04 01 21 04 28 21 0A 08000000A0 42 42 10 50 46 14 12 05 04 41 21 14 28 25 0A 09000000B0 42 42 38 50 4E 14 14 05 05 11 21 24 28 2A 0A 0A000000C0 42 42 58 50 58 14 16 05 05 51 21 34 28 2E 0A 0B000000D0 62 42 78 50 60 14 18 45 06 11 21 48 28 32 0A 0C000000E0 62 43 20 50 68 14 1A 45 06 61 21 58 28 37 0A 0D000000F0 62 43 40 50 72 14 1C 45 07 21 21 6C 28 3B 0A 0F00000100 00 3C 19 6C 70 58Code:Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F00000000 F7 13 F0 82 02 07 00 30 01 05 02 00 00 00 00 0000000010 00 00 10 00 00 0A 14 00 00 00 06 20 28 3C 0A 0F00000020 22 43 70 50 7C 14 1F 45 08 01 22 00 28 41 0A 1000000030 22 44 10 51 06 14 21 45 08 41 22 14 28 45 0A 1100000040 42 44 30 51 0E 14 24 05 09 01 22 24 28 4A 0A 1200000050 42 44 58 51 18 14 26 05 09 51 22 34 28 4E 0A 1300000060 62 44 78 51 20 14 28 45 0A 11 22 48 28 53 0A 1400000070 62 45 20 51 28 14 2A 45 0A 61 22 58 28 57 0A 1600000080 02 45 40 51 32 14 2D 05 0B 21 22 6C 28 5C 0A 1700000090 02 45 68 51 3A 14 2F 05 0B 71 22 7C 28 60 0A 18000000A0 22 46 08 51 44 14 31 45 0C 31 23 10 28 65 0A 19000000B0 22 46 30 51 4E 14 33 45 0D 01 23 24 28 69 0A 1A000000C0 42 46 50 51 56 14 36 05 0D 41 23 34 28 6E 0A 1B000000D0 42 46 78 51 60 14 38 05 0E 11 23 48 28 72 0A 1C000000E0 62 47 20 51 68 14 3A 45 0E 61 23 58 28 77 0A 1E000000F0 02 47 40 51 72 14 3D 05 0F 21 23 6C 28 7C 0A 1F00000100 00 6F 57 43 18 40Code:Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F00000000 F7 13 F0 82 02 07 00 30 01 05 02 00 00 00 00 0000000010 00 00 10 00 00 0A 78 00 00 00 06 20 28 7D 0A 1F00000020 42 47 70 51 7E 14 40 05 10 01 24 04 29 02 0A 2000000030 42 48 18 52 08 14 42 05 10 51 24 18 29 06 0A 2100000040 62 48 40 52 10 14 44 45 11 21 24 28 29 0B 0A 2300000050 02 48 60 52 1A 14 47 05 11 61 24 3C 29 10 0A 2400000060 02 49 08 52 24 14 49 05 12 31 24 50 29 14 0A 2500000070 22 49 30 52 2C 14 4B 45 13 01 24 60 29 19 0A 2600000080 42 49 50 52 36 14 4E 05 13 51 24 74 29 1E 0A 2700000090 62 49 78 52 40 14 50 45 14 11 25 08 29 23 0A 28000000A0 62 4A 20 52 4A 14 52 45 14 61 25 1C 29 27 0A 2A000000B0 02 4A 48 52 54 14 55 05 15 31 25 30 29 2C 0A 2B000000C0 22 4A 70 52 5C 14 57 45 16 01 25 40 29 31 0A 2C000000D0 42 4B 18 52 66 14 5A 05 16 51 25 54 29 36 0A 2D000000E0 62 4B 38 52 70 14 5C 45 17 21 25 68 29 3B 0A 2F000000F0 02 4B 60 52 7A 14 5F 05 17 61 25 7C 29 40 0A 3000000100 20 45 33 49 49 00Code:Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F00000000 F7 13 F0 82 02 07 00 30 01 05 02 00 00 00 00 0000000010 00 00 10 00 00 0B 5C 00 00 00 06 20 29 41 0A 3000000020 42 4C 18 53 06 14 62 05 18 51 26 14 29 46 0A 3100000030 62 4C 40 53 10 14 64 45 19 21 26 28 29 4B 0A 3300000040 02 4C 68 53 1A 14 67 05 19 71 26 3C 29 50 0A 3400000050 22 4D 10 53 24 14 69 45 1A 41 26 50 29 55 0A 3500000060 42 4D 38 53 2E 14 6C 05 1B 11 26 64 29 5A 0A 3600000070 62 4D 60 53 38 14 6E 45 1B 61 26 78 29 5F 0A 3800000080 02 4E 08 53 42 14 71 05 1C 31 27 0C 29 64 0A 3900000090 22 4E 30 53 4C 14 73 45 1D 01 27 24 29 69 0A 3A000000A0 42 4E 58 53 56 14 76 05 1D 51 27 38 29 6E 0A 3B000000B0 62 4F 00 53 62 14 78 45 1E 21 27 4C 29 73 0A 3D000000C0 02 4F 28 53 6C 14 7B 05 1E 71 27 60 29 79 0A 3E000000D0 22 4F 50 53 76 14 7E 05 1F 41 27 74 29 7E 0A 3F000000E0 62 4F 78 54 00 15 00 45 20 11 28 08 2A 03 0A 41000000F0 02 50 20 54 0A 15 03 05 20 71 28 1C 2A 08 0A 4200000100 20 6C 7D 77 5F 30

author: alfredokiwi
author_rank: Contributor
timestamp: October 02, 2023, 04:46:32 am
content: Quote from: fzabkar on October 01, 2023, 06:38:38 pmThanks a lot here I share the only video that I have recorded, on which the output white noise can be heard. Is a fatal non working sound DSP scenario. Based on the information provided in forums the manufacturer recommendation is to disable the effects on internal Kurzweil MARA sound DSP chip.The good news about the PC3 model dual DSP Kurzweil MARA engines one working as master and the other as slave is the possibility to interface a JTAG debugger to see the internal registers status and errors on each DSP. Despite that the manufacturer recommendation because there are no available software tools is to disable the output effects or replace the entire mainboard.FYI there is also a special sound patch effect for downloading called "Noise killer" for the complete disabling of the MARA DSP turning the Kurzweil into a MIDI controller. After that you can use Kurzweil plug in VSTs in your PC as sound generator with no more issues.

author: alfredokiwi
author_rank: Contributor
timestamp: October 03, 2023, 04:43:18 am
content: I find a video about Kurzweil issues and how customer's are left without support any help. We are talking about the most expensive PC3X line of keyboards. The amount of dead Kurzweils rise every year.I seems that a big ventilator runs below the keyboard to cool it down. The degradation inside the logic core destroyed the mainboard.

author: Ailalola2023
author_rank: Newbie
timestamp: January 02, 2024, 02:04:57 pm
content: Hola Alfredo te consulto, tengo un kurzweil pc361 con ese problema de ruido blanco ya asumí que es el chip mara encargado de los efectos dsp, es en vano hacer un reballing para ver si se soluciona el problema? En el caso de hacerlo tenes idea si es complicado el proceso? Gracias saludos desde Rosario, santa fe, Argentina...