Like Engineering, But Backwards

Reverse engineering is just the time-reversed antiparticle of regular engineering, and when the two collide it usually results in a massive release of energy. Today that energy is being released through a soldering iron, adding some header pins to this DE-9 pass-thru adapter I got.

Like this.

Why do I need them? Well, I'm glad you asked.

This is my Roland S-760, connected to my Roland RC-100 by way of this convenient pass-thru DE-9 adapter, complete with a very convenient set of header pins. Header pins that I can attach scope probes to, in order to see signals like this.

The purple trace on top is the clock line, and the yellow trace is the data line. The S-760 sends out a long high-pulse on the clock line to initiate the data transfer, and then the RC-100 responds by toggling out the most significant bit of the 7-bit word. Each bit thereafter is put on the data line shortly before the next low-to-high or high-to-low clock pulse, to give us a double data rate signal at around 60kHz.

The initial clock pulse is about 45 microseconds long.

And the data is put on the bus about 5 microseconds before the clock transition.

The RC-100 asserts an ATTN signal by pulling it low in order to notify the S-760 that it wants to send a packet. It holds it low for the entire transfer, including when sending a 2-byte sequence for the dial motion: a zero followed by a signed 7-bit value for the relative rotation since the last transmission (positive is clockwise).

As you might imagine, there's no consistent timing between the ATTN signal and the start of transfer. The S-760 just gets around to it when it gets around to it.

And, hmm, these header pins are getting a little bit crowded.

Ok, using a ribbon cable makes things a lot easier to manage.

The S-760 will send LED updates using a sequence of 4 bytes. I've only observed the first two bytes being used, however, so I don't know what the function of the second two is.

Now you might think that this first block of 14 bits maps to the 14 LEDs on the device in an order that makes logical sense based on the logical pin ordering of the IC they're connected to. Or perhaps one based on the component designators.

But neither of those appears to be correct. It seems like the MCU in this device does some logical reordering to map the bits to the LEDs in an order that's roughly in line with the physical layout of the device. Here's a dump of the start-up chaser sequence it does after a reset:

And this corresponds to Play->Edit->Disk->MIDI->Func->Utility->F1->F2->F3 twice, then lighting up Edit-Disk-MIDI-Func-Utility all at once.

Poking around, it looks like Menu is 0x4000 and Command is 0x0100. I haven't managed to get Sub Menu, Execute or Rec to light up from interacting with the S-760, so I'll have to see if I can just inject some data to map out the remaining bits.

But how am I capturing this, and how am I planning to inject this data?

With a friendly little Arduino Nano, of course.

Anyway, how about the mapping in the other direction? Well the high bit is for key-down: 1 for down, 0 for up. From there, it goes like this:

0-9: 0x00-0x09, conveniently

Enter: 0x0A

Inc/Yes: 0x0B

Dec/No: 0x0C

Right, Left, Up, Down: 0x0D to 0x10

Del: 0x11

Ins: 0x12

Play, Edit, Disk, MIDI, Func, Utility: 0x13 to 0x18

Menu, Sub Menu, Command, Execute: 0x19 to 0x1C

F1, F2, F3: 0x1D, 0x1E, 0x1F

Start/Stop, Rec: 0x20, 0x21 (these are hard-wired to the pedal inputs, so the same values are used there)

Now one sneaky thing I should mention here is that while the RC-100 transmits to the S-760 at around 60kHz, the same is not true in the other direction: setting the LEDs is a much more leisurely data rate.

The bits are clocked at 33kHz, or 30 microseconds, and the initial pulse lasts a solid 85 microseconds.

And that tripped me up for a while. (Ignore the yellow trace in these pictures, I didn't have that probe connected)

Anyway, I only have a bit more work to do in order to map out the final three LEDs, and then I'll be ready for the next phase of the project. More to come then!

Seven Fiddy

I've been on the lookout for a certain piece of hardware for a little while, and just recently a good deal came up on eBay, so I jumped at it.

This here is the Roland S-750. It's a much older rack sampler than the Roland S-760 that I purchased previously.

And it is a chonky boi. It's 3u tall instead of 1u and a bit deeper than the S-760. What's somewhat amusing is that the boards inside don't really take up all that much more actual space than what would fit in a 1u case, but whatever, it is what it is.

Why did I want an S-750? Well I kind of didn't, actually. I wanted what it came with, which is this.

Wait, no, that's just a regular IEC power cord. I mean this.

This is the RC-100 remote controller, and it's actually worth more than I paid for the whole bundle together. So I essentially got a discounted RC-100 and a free S-750, which is kinda cool.

The RC-100 works with a number of Roland samplers, and in particular it works with the S-760, thus why I was interested in picking one up.

Anyway, fun will be had with the RC-100, but first let's see what we can do with the S-750. Inside we can see that it lacks the wave memory expansion, which is also something I'll be tinkering with later. It slots into the two grey connectors up at the top of the board.

But first, the volume knobs were looking a little misaligned and were binding somewhat, so let's see about fixing that.

The diagnosis of this issue is at least pretty simple.

This metal bracket is not supposed to be shaped like this. Let's fix that real quick.

And that's much better. Not perfectly straight, but it'll do. Back in the unit, things are looking much more aligned.

Though I do need to deal with one of the volume knobs, which managed to separate into two pieces while I was trying to pull it off the shaft.

A bit of not-so-super glue does the job just fine.

And the knobs are looking much better now.

So let's see what the RC-100 does. Just plug it in and hold the right buttons on the front panel to select it.

Except hmm, no dice. It's not powering on. Let's have a look at the jack board to see if it yields any clues.

It's the board on the right, there. Pulling it out we can see the problem pretty easily.

R35, a fusible resistor, has fused. This is not really a surprise given that it's on the +5v rail which supplies this port with power.

And as you can well imagine, with these male pins sticking out of the front of the unit, it's only a matter of time before something conductive comes in contact with them and lets all the magic smoke out of the fuse.

So a new pack of fuses is on the way, but in the meantime there's another problem: the sampler keeps auto-detecting a mouse, and the UI is scrolling uncontrollably when nothing is connected to this port.

After doing a fair bit of diagnosis, it looks like IC14 on the mainboard has fried. It's reading a very clean logic-high on the unconnected port as a logic-maybe, and interpreting that as (junk) data from a nonexistent mouse.

This is unfortunately a Roland-proprietary ASIC, and so no direct replacement is available unless I can find one to salvage from a parts unit. The other option would be to reverse engineer the ROM and OS to determine how it talks to this chip and then replace it with an FPGA. The chip doesn't do any particularly complicated tasks, it mostly just does the front panel matrix scanning, drives the LEDs, and acts as an IO expander.

Anyway, that project, assuming it ever happens, is pretty far down the to-do list so we'll see if I ever get around to it.

Oh and just in case you're wondering, the RC-100 works perfectly with my S-760.