I am trying to repair my Yamaha HS-5 organ which uses an M50734 and would really appreciate help to disassemble the 128k x 8 rom file that I have in binary or Intel hex format. Any help would be much appreciated by this newcomer to the forum.
For interest a little of my background. I was an electrician by trade and moved into electronics in 1980 using a 6800-D8 kit and programmed with assembler. In later years I foolishly moved into hardware servicing rather than software. I am retired now and from what I see you doing on this forum, I am a long way out of date. However I still enjoy servicing older equipment.
I would appreciate any help you could offer. RR

Hi, and welcome to the forum.

Wikipedia says that the M50734 is a member of the Mitsubishi 740 (or MELPS 740) microcontroller family.
Mitsubishi\Renesas 740 family software manual, instruction map is on PDF page 192 (184).

It appears that the 740 family has some additional instructions when compared to the 65C02, and I'm not sure if the disassemblers we have "on stock" would know about them.

You happen to have the HS-5 service manual at hand, or a link to it ?
What part of your HS-5 does work, what part doesn't, what have you already checked (supply voltages etc.), and could you post any pictures of the HS-5 innards ?

Also, please take a look at the Simmons SDS6 percussion sequencer repair we had some time ago, maybe something in this thread might be helpful.

Welcome, RogerRabbit

I think it's wonderful that you're interested in the contents of that ROM, and from my own experience I know what an engaging puzzle it is to unravel an enigmatic ocean of hex bytes! Just a reminder, though. Disassembling that ROM is probably not the quickest way to get the organ working. In a previous life I used to service a lot of electronic keyboards, so I have experience with that, too! What are the symptoms? And what have you checked so far?

Of course you'll want to approach the situation in whatever way pleases you. Whether you're seeking adventure, an expedient repair or both, the folks here are willing to offer assistance.

cheers
Jeff

_________________
In 1988 my 65C02 got six new registers and 44 new full-speed instructions!
https://laughtonelectronics.com/Arcana/ ... mmary.html

Thanks for the replies, here is more detail. There is no sound and no lights on the keyboard. The service manual is 18Mb so here is the link to download it: https://elektrotanya.com/yamaha_hs7_6_5 ... nload.html. The schematics are right at the end. I have checked the power supply and all voltages are correct. All the audio is ok from the MIC input to speakers.The M50734 is running and is sitting in a loop. accessing ROM1 (main program rom),ROM3,RYP,PB via IC13 ADEC. The two clocks 2Mhz and 125kHz are running. The M50734 chip select signals MIC,DIC1,DIC2,DIC3 are not active and no data is transfered via MI-1. Upper, Lower and Pedal keyboards are being scanned but no serial data is sent. Keyboard switches are being scanned but no data transferred. It looks at first sight it looks like the MI-1 interface may be faulty but I have feeling it's not the case. I have a logic analyser and can see the loop the processor is in but can't decode the instructions on paper. I have been looking for disassemblers for M50734, found some on GitHub but they seem to need Python to run. At 74 yo I am struggling with cellphones without wanting to add Python to my skill set. From my analyser I can down load in an Excel format if anyone would like to look at the loop but it's a large file because of the sampling rate.
RR

Thanks for the additional information, R.R. (and thanks for the links in your post, Dieter).

Just a reminder that interrupts significantly increase the complexity of what is happening (or is supposed to be happening). The M50734 has several timers on-chip, and external devices generate interrupt requests, too. Each interrupt source and its corresponding Interrupt Service Routine constitute another loop -- and it's a safe bet that each of these interrupt loops interacts with the main loop you observed. Trying to get "the big picture" will be tough ... all the more so because you'll be working from a sketchy disassembly rather than a proper, commented source code listing. Also, there's no guarantee the clues you encounter will be obvious. (Would a missing interrupt be apparent, for example?) But if the analytical approach is what interests you, then go for it!

Myself, I'd start by using more eyes and less brains. Have I thoroughly searched for bad solder joints? Can I see any leaky electrolytics (resulting in corroded PCB traces, perhaps)? What about loose connectors? Cracks on the PCB? Corroded IC sockets? Also: what does the oscilloscope say about the address and data buses? -- are any of the bits stuck high or low, or at an invalid level? The logic analyzer isn't a good tool for finding such problems. Speaking of buses, I notice IC4 (the XB809A0, drawn just to the left of the Master CPU) seems to be what contains the address latch for demultiplexing address bits A7-A0. I'd expect activity on both of the 8-bit buses attaching to this chip.

And... although we here on 6502.org are happy to assist and love sharing an adventure, it might be worth also reaching out to the folks on organforum.org or similar. This problem is at least as organ-specific as it is 6502-specific.

Have fun, and keep us posted!

Jeff

_________________
In 1988 my 65C02 got six new registers and 44 new full-speed instructions!
https://laughtonelectronics.com/Arcana/ ... mmary.html

Jeff, thanks for helping me with getting that service manual, elektrotanya and my web browser don't seem to like each other.
The interesting part is the schematic on PDF page 123, the DM board.


I agree that IC4 (XB809A0) seems to contain the latch for generating A7..0 from the multiplexed AD7..0 address\data bus of IC1 (M50734, the master CPU).
IC4 seems to be a CMOS gate array scanning the keyboard etc. (by talking with some slave CPUs per SPI), found some more info in The Organ Forum.

IC13 (XB828A0) is the address decoder for IC1, found no info about that chip in the internet.
Since the M50734 only seems to have a 64kB address range and it's attached to two 128kB ROMs plus some other stuff, we could expect to have some odd bank switching stuff in the address decoder.
Looks like A16 is generated by IC13 pin 13. //Means that IC13 can't be something like a GAL22V10 stamped differently, because GAL22V10 pin 13 is an input.

IC3 (YM2154) rythm generator also is tied to IC1. Found the IC3 pinout here.

We also have a slave CPU IC2 (HD63B01) in DIP64 package, which appears to be a bigger version of the 6801 microcontroller.
Bad thing is, that there is no ROM attached to IC2, only a RAM, so we could expect that IC2 runs on code in the on_chip ROM.
Port 6 (8 Bit data) and port 5 (P5.5 /IS, P5.6 /OS) of the slave CPU IC2 are tied to the master CPU IC1.
It's an interesting question, what the master CPU does when the slave CPU doesn't respond to a communication.
Aha: master CPU IC1 pin 17 (/DIC3) drives slave CPU IC2 pin 6 /RES input.


Considering the complexity of the whole system, I would say that reverse engineering the machine code of the master CPU won't be fun, it will take a lot of time and effort,
so it's the last thing to be tried. Would be better to check for simple electrical or mechanical problems first...
...are the chips plugged into sockets, or are they soldered directly into the PCB ?

If the chips are plugged into sockets, it would be worth to check for bad contact or corrosion.
If the chips are soldered directly into the PCB, then ripping IC1\IC2\IC4 out of a functional organ for plugging them into the PCB won't be an option.

Is it a brownish PCB (phenolic paper FR1 or FR2), or is it a greenish PCB (FR4 epoxy) ?
If it's a phenolic paper PCB, I would suggest to take a closer look at it if there are hairline cracks somewhere.

It also would be a good idea to check for bad solder joints.
//Had my share of PCB hairline cracks and bad solder joints when I did TV repairs for a living in the 90s.

I suppose, that the +5V are nice and clean (no ripple from a dried out electrolytic capacitor in the power supply).

/IC, low_active initial clear generated by IC30, is the reset signal for the master CPU, IC1 pin 29.
It is supposed to stay low for a short moment after power on.

IC29, IC51 generate a 6.4MHz master clock labeled 'PHI2', but that clock signal doesn't seem to drive clock inputs of IC1\IC2\IC4, so we can ignore it for now.
The 2MHz clock is there (generated from IC1 pin 40), so the 8MHz crystal at IC1 is supposed to be oscillating.
The 125kHz clock is there, I would say IC13 generates it on pin 14 by dividing the 2MHz clock by 16.
Does the 8MHz crystal at the slave CPU IC2 pin 2, pin 3 oscillate ?

The 125kHz clock is buffered by an OR gate (IC31) before it leaves the PCB, are the 125kHz present at IC31 output pin 6 ?

IC3 YM2154 rythm generator, is the 2.7MHz crystal at IC3 pin 63 and pin 64 oscillating ?

When the master CPU IC1 is stuck in a loop, does it try to communicate with the slave CPU IC2 ?
If yes, there would be spikes at IC2 pin 21 and/or pin 22, generated by the IC4 gate array.

IC11, the RAM for the master CPU. What's the VCC voltage at pin 28 of the RAM ?
A supercap for preventing the RAM contents from getting lost during power off, that's nice. //No acid leaking out of batteries.
Also, a 74LS03 open collector NAND prevents the RAM /CS from getting active at power on (by making use of the /IC signal)
for preventing incorrect/accidental RAM writes by a master CPU which has entered reset condition at power on a little bit too late.
Are there spikes at IC11 pin 20 /CE ?

If the master CPU reads the ROM, then there are spikes supposed to be at the low_active enable inputs pin1 and pin 19 of the IC27 bus buffer (74HC244).

If the list above won't provide any clues about the problem, then we need to dig a bit deeper.
An internet search for "Yamaha HS-5 reverse engineering" brought no results so far.

Hm, I'm not sure the signals you mentioned are chip selects. But never mind that; I'm more interested in what you said about MI-1. Can you clarify what you mean?

Dunno what MI-1 stands for, but the chip labeled MI-1 is IC4, the XB809A0 I mentioned earlier. It should receive a continuous stream of pulses on pin 13, "ALE" (Address Latch Enable). On the 8-bit latch input (pins 5-12) we should see continuous activity, and likewise continuous activity on the latch output (pins30-23) albeit not so "busy" as the input.

Right -- this an important detail, and one that's easy to check.

_________________
In 1988 my 65C02 got six new registers and 44 new full-speed instructions!
https://laughtonelectronics.com/Arcana/ ... mmary.html

Thanks for your suggestions and I will start re checking this evening. Most IC's are soldered in and it's a fibre glass pcb. Really nicely made as typical with Japanese stuff. I will post more details as I check them. Many thanks for your support guys.
RR

If you really do need to get into the code, I can add the instruction set to WFDis, but I agree that hardware testing will probably be more fruitful for actual repair.

_________________
WFDis Interactive 6502 Disassembler
AcheronVM: A Reconfigurable 16-bit Virtual CPU for the 6502 Microprocessor

White Flame, thanks for jumping into the thread.
Meanwhile, I tried to look around a bit for datasheets.

IC46, IC47: Mitsubishi M5222 voltage controlled amplifiers, datasheet at PDF page 622 (10-3).
Chip part numbers starting with "TC" might indicate Toshiba as the chip manufacturer, but no luck when searching Bitsavers for the part numbers in the HS-5 schematics.
Also, Bitsavers doesn't have anything Yamaha related.

IC4, XB809001, is a Toshiba gate array TC17G005 (540 logic gates ?), the MI-1.
IC5, XB811001, is a Toshiba gate array TC17G008 (880 logic gates), which links the IC9 Rythm ROM to the IC3 Rythm Generator.
More info about Toshiba gate arrays here.
TC17G was manufactured in a 3µm CMOS process, 2.5ns propagation delay, 50MHz max. HC²MOS, two metal layers.

Found a list of Yamaha chips, a quote from this site about Sovjet synthesizers:
"Never thought there were so many, as any of those were not normally available to buy.
Generally all those are amazing reverse engineered copies of popular Japanese synthesizers packed in weird cases with bizarre names."
But when flipping through the ruskeys pictures, amount and arrangement of the instrumens keys all were differently from the Yamaha HS-5, no luck there.

In answer to ttlworks. Interesting you saw A16 as an output from IC13. I saw it as an input but couldn't find the source so thanks for that. ROM1 and ROM2 are 28 in chips TC531000 dip packages. It was evolution. IC13 is a standard 24 dip package.
I checked the following:
IC31 Activity ok,
IC3 clocks ok,
IC2/ 21 always LOW IC2/22 always HIGH,
IC11/28 4.84 Volts,
IC11/20 Activity
IC4/13 Activity
IC27 Octal latch. Both sides ok

In answer to Dr Jefyll
In talking about MI-1 I mean there are no serial signals into or out of the IC. Normal levels of activity on all address and data lines
RR

ps I have a lot of eproms ranging 128k up to 1M that I'm happy to give away as members need them. just cover the postage cost. Not sure where I would post this.

Pin 21 of the IC2 HD63B01 slave CPU is the /IS signal, pin 22 is the /OS signal.

From the HD63B01 manual, a falling edge (transition from HIGH to LOW) at /IS latches data written by the IC1 master CPU
into the I\O port of the slave CPU and/or triggers an interrupt in the slave CPU.
/OS then would be set LOW by the slave CPU to tell the master CPU "I got the data".

To me, it looks like something went wrong in the communication between IC1 and IC2.

IMHO this narrows down the search to: IC1, IC13, IC4, IC2.

When the master CPU IC1 does a read/write to the slave CPU IC2, the address decoder IC13 selects IC4 (MI-1) according to A15..10, setting IC4 pin 17 (/CE) to LOW.
IC4 then decodes A7..A0, decides it's a read/write to the slave CPU, and handles /IS and /OS of the slave CPU IC2.

So let's take a closer look at the slave CPU: does the 8MHz crystal at IC2 pin 2 and pin 3 oscillate ?

IC2, some more pins to check:
pin 4 (MP0) supposed LOW,
pin 5 (MP1) supposed HIGH,
pin 6 (/RES) supposed HIGH,
pin 23 (/OPIZC) supposed HIGH,
pin 24 (/GEWIC) supposed LOW,
pin 33 (VCC) supposed +5V.

I contributed the M50734 support in cc65-- a quick attempt to disassemble the binary you've got can be done with:
The late great Lee Davidson had access to a version of IDA with M50734/740 support, and helped my work on this. (The Commodore MPS-1250 Printer has a M50734 as well-- being clocked at 10MHz, it was the fastest computer CBM made until they got into the 68020 hardware..)

In reply to ttlworks:
8Mhz clock OK
IC2/4 low
IC2/5 high
IC2/6 high
IC2/23 high after power on sits at 0.3v for 1 sec then pulled to 0 for 250ms them goes high 5V
IC2/24 high after power on then pulled low for 250ms then goes high 5V
IC2/33 Vcc 5V
At the moment I can't check the timing relationship between pins 23 and 24 because pins are to close to fit clips but I will try to check if you need that relationship. Both these events are at power on. I will check if they are static after.

Thanks cjb but what or where do I go with "da65 --cpu m740 rom.bin" please? Is it a disassembler I can download and use please or upload my file to? Sorry to ask but I'm an old newbie here.