Yamaha PSR-70 reverse engineering project

One day at the Hacklab: “Hey, guys! I have an old Yamaha PSR-70 keyboard in my car trunk. Does anybody want it? If not, I will take it to e-waste today.”

“Don’t throw it away, I can take it and see if it’s any good”, I hear myself saying.

Because of that careless reply, I discovered I have yet another keyboard filling up my crowded storage:

 


At least this is a dream for any push button and blinkenlights maniac. There is no display at all, but there are almost 100 push buttons and even more leds. Nice looking front panel indeed.

I’m not very familiar with Yamaha keyboards in general and especially this model I knew nothing. It is from year 1985, typical arranger keyboard of that time. It has a small selection of ready made auto accompaniments and you can also create new ones. There are 32 sounds which are not editable. It has also a midi interface, which was not so common at that time. An external cassette player can be used as a mass storage for your own rhythms.

As an instrument the device is a bit lacking: the keyboard is 5 octaves but there is no velocity sensitivity, nor pitch bend or modulation wheels. These are not supported even through the midi. Multitimbrality is not available either. The polyphony is 8 voices.

Yamaha had a family of three keyboards in this range: PSR-60, PSR-70 and PSR-80. It looks like the PSR-60 and PSR-70 are internally the same device, because I found the marking on the left from the circuit board. The difference is in the enclosure: PSR-60 has only 4 octave keyboard and is smaller overall. According to internet, PSR-80 is completely different device internally.

Here are some more pictures of the keyboard. 

Original manual: http://www.synthmanuals.com/manuals/yamaha/psr-70/owners_manual/psr70e.pdf

Sample pack is available. This is from PSR-60 but it has same sounds: https://www.youtube.com/watch?v=vDYm8zYRW50

 

First tests

My new giveaway keyboard did not include any power supply. The previous owner said the keyboard is broken, it draws too much current, so I fed it carefully with a laboratory power supply using current limiting. It wants 9...12V DC from the barrel connector, but the current consumption was not too big. It takes about 300...400 mA, which is reasonable for a device at that time. Even after longer testing I did not notice any problems with excess current draw. It remains a mystery, where did the problem disappear.

So after some more testing I realized I’m now an owner of a fully functional PSR-70. Only problem is that as an instrument it is nothing to write home about. I don’t actually need it for anything.

In this kind of situation, the next question is naturally: can you hack it? Can you build something funny or even useless from it? Let’s open it up!

 

A peek inside

Turn over the keyboard and unscrew the numerous screws holding the bottom cover. This reveals a respectable amount of electronics:


This is a beautiful view! It is completely different from the modern devices: they have that one small PCB at one corner of the box, containing one custom BGA circuit which handles everything. There’s nothing interesting in that. You cannot do anything with those one-purpose devices. This 1985 circuit might be possible to be repurposed or something.

The big board in the center contains the essential components. By turning the board over it is quick to see the preconditions for the hacking project:

  • Sounds are produced by Yamaha’s own YM3806, also known as OPQ circuit. It is a 4 operator FM synthesizer with 8 voices. This is about all internet knows about this IC.
  • Drum sounds come from Yamaha YM2154, which is a sample based drum chip. Not much is known about it either.
  • CPU is NEC D70008, which is a Z80 clone.
  • Fimware is in one 32 KB EPROM (27256) so it is easy to read out.

My first impression was disappointment: meh, completely undocumented sound chips, cannot build anything from this. I’ll throw this away...

But then an idea started to grow: if there is no documentation, it should be written. Maybe I could dig up how these sound chips are controlled. In the EPROM there is a software which can control the chips, it will need only some amount of reverse engineering to see, how it is done. At least the software environment is familiar, it is Z80.

The more I thought of this idea, the more I got excited with it. This is now turning into a full-blown reverse engineering project. Interesting detective work ahead!


In the next post, we will start investigating the internals of the PSR-70.


Comments

Post a Comment

Popular posts from this blog

Secrets of the YM2154

Image
  After a break, I returned to the PSR-70 reverse engineering project: t he YM2154, a.k.a. RYP4 is still an unknown territory. The time has come to reveal its secrets. R YP4 is used a bit more widely than OPQ. Besides PSR-60/70 it is used at least in PSR-80 and RX- 11/15/21 drum machines. This time I did remember to check for service manuals, and found one for RX-11: https://elektrotanya.com/yamaha_rx11_sm.pdf/download.html . This contains a full schematic and other useful information.   T racing register writes Because I had good results with OPQ by tracing what the PSR-70 firmware is writing to the chip registers, this would be a good starting point also for RYP4. The chip has 128 registers which reside in Z80 I/O address space at addresses 80H...FFH. Looking at the disassembly listing reveals quickly that there is no single function which would take care of all the register writes, like OPQ had. There are many IN and OUT instructions accessing the RYP4 register
Read more

Reversing the PSR-70 hardware

Image
  First step in the actual reverse engineering is to start studying the PSR-70 hardware. This is quite service-friendly (meaning hacker-friendly) device: all circuit boards are single-sided and copper side silkscreen has IC numbers and jumper wire positions marked. There are also many useful looking signal names marked, like “D7”, “A12”, “IOWR” etc. It would be possible to draw the whole schematic from one high-quality photo of the circuit board. My intention is not to draw the whole schematic, but at least the address maps should be figured out. It will make the interpretation of disassembly much easier. All address decoding is done with 7400-series discrete logic, no PAL-circuits or other nuisances used, this is very good.   Block diagram Most of the electronics is on the large main board . The other cards are: Power + audio board contains the audio amplifiers, some kind of analog chorus-effect based on a BBD-circuit, power amplifiers feeding the speakers, and voltage
Read more

Digging into YM3806

Image
In the previous post I got the PSR-70 original firmware modified so that it dumps to serial port all register writes done to OPQ chip (YM3806). Now I’m getting the data I wanted and plenty of it! A simple keyboard key-down or key-up produce only under 20 register writes but changing sound from the front panel results in about 300 writes. Why 300, there are only 256 registers? Yes, but there are many registers which are written several times. T he raw dumps from the modified firmware are quite hard to read, they just list the register address and written value in hex in the order they happened: 1F=20 5E=1F 56=1F 4E=20 46=20 5E=81 56=81 4E=81 46=81 9E=1F … To make some sense out of this I wrote a small python script to analyze the dump. It lists all registers in numerical order and all writes done to that register. In the script output the first column is OPQ register number, second column is the number of writes to that register and then a list of the written values.
Read more