Inside the S-1 expansion card

Started by sonical, March 27, 2017, 07:23:09 PM

Previous topic - Next topic

0 Members and 1 Guest are viewing this topic.

sonical

What baffles me is that no one seems to have opened up the cardboard (or plastic?) cover or otherwise dismantled or peeked inside the S-1 expansion card.
Seems that most are/were obsessed with the prospect of reselling the card as "MINT NOS NIB L@@K rare vintage military soviet" item on ebay.  ;D

So, has anyone seen any photos of what is there?
If I'd get my hand on one, I'd definitely read all data out and find out everything about its innards - without even thinkinking about selling it. (as I mentioned in another thread, I have a jig to read/write such cards and could easily improvise some software to read out in whatever unusual way some additional stuff is stored there). If these cards contain battery, at some point they all will become useless.

First, a non technical question that appeared on this board, but wasn't clearly answered: Did anybody ever have a problem with any S-1 features missing after a factory reset?
It shouldn't ever happen this way, as the box have tiny RAM that does not fit any software, and upgrade re-flashes a non-volatile memory, that has nothing to do with factory reset. But there's allways room for some weird firmware bugs.
Community needs a clear reassuring answer from VG8S-1 users, that have done factory reset without losing any features.  8)

Secondly, a thing in regards to actual ROM and RAM differences between VG-8 and VG-8EX: there are none. Both have 512kilobytes of flash memory for program and presets, and a tiny 32kilobytes battery-backed SRAM chip for user programs. New banks are just an added software candy. VG-8 patches are very small, and entire dump in sysex and card takes only a bit over 10kilobytes, so there's very likely some noticable amount free RAM left in the "default" VG-8, and there technically would be space for 4~6x as many patches in a single M-512 card.
In fact, in VG8EX service manual page 14, if you look at the board image silk screen, it still says 8 (without EX), and my non-EX seems to have exactly the same board with the same layout and silkscreen... (unit manufactured in april 1995)

Also, I think I could someday patch up an update MIDs that would work without S-1 card to update any VG-8. Currently I have looked into 1.04 for the non-S1 and 1.01 for EX, and this looks to be completely doable. There seems to be one simple byte that designates the version of the coming update, and a peculiar change in block addresses, that could be done intentionally to brick the VG8 (or cancel / fail the update) in case someone tries to simply patch the beginning of the update.
I have risk-free ways to do and test these things in hardware - a bit cumbersome, but doable. Whole process can be perfectly trace&tracked, and writes can be diverted away from the internal VG8 flash not to do any actual damage, while modified firmware can be run as a test.
I can also read out the firmware in-circuit, without desoldering the chip, so I'd have a complete backup (including the bootblock) before any evil actions would take place.


Below it gets very technical. (But it may be useful to some!)

Card slot in VG-8 can only address up to 64kilobytes (card data for VG-8 only use about 10kbytes, and doesn't seem to even bother touching anything above 16kbytes even when formatting!). Firmware is much larger than that, so there's some upper address paging register.

First, before I knew card is only "one time upgrade", I thought it has some generic 512kbyte or 1Mbyte rom chip and a 572/573-like latch to switch the upper addresses, and in the lower part it would have some identification as an upgrade card, and possibly piece of upgrade software to be loaded and run from RAM. And the latch could be written by just lowest addresses, for example. So, when starting, VG-8 would detect the card present via SENS pin, perform a harmless write (say to address $0000 write an "R" so as not to damage user data in any roland formatted sram data card) to reset the latch, then read contents, decide if to update, load/run tiny firmware block that later flashes the big firmware.

However.

When I found out that there are some way of making the card used, it sparked strong interest in it's innards.
Is there SRAM and battery? If so, what if in those used S1s, circulating the online pawn-bays, batteries start to leak or go completely dead?
Or there is a single bit cell, made up of discrete parts?
Or maybe a on time "programmable" fuse-like element?
Or there, instead of MASK rom, is an onboard OTP ROM that gets some byte overwritten? If so, it may need serious charge pump to supply it with some >13.5V.
Or maybe there is serial EEPROM?

How is it written/set and how is it read? Reading may even be through the battery sensing pin.

Even more surprising was a discovery of a weird addition to the card slot in VG-8 (in difference to all other sound modules in synthesizers I know). There is a typical card detect pin, called SENS, that detects when both sides of the card come in contact with the slot. Very simple thing that just assumes a card is plugged in as soon as approx +5V appears there.

But VG-8 attracted my attention there due to having some additional protection, and something else!
As it turns out, if +8V or more volts (up to 12V seem to be safe) are supplied to this pin, address decoding for the CPU swaps program ROM and RAM&I/O places... At first it seems to be some vestigial remnant of R&D in-circuit firmware development stuff, but it may be something (although very funk'd up) for S-1 update process.



In that case, card should need an onboard charge pump capable of sourcing at least 3mA. Such a carge pump would be visible under that cardboard or plastic. In case of OTP ROM, older flash or something - a 12V or higher voltage charge pump would definitely be present and be quite large.

This feature just looks too weird to actually be used for an update, as all it would technically take, is just copy some small updating firmware into RAM, jump there, update flash from the card, restart.

However, maybe it allows to run firmware directly from the card (and maybe that's why there are two schematic differences on the use card access gate array in VG-8), and then such a feature makes perfect sense, as it would allow a safe update that works allways - even on "bricked" units with incomplete updates or trashed flash, or even for first programming while manufacturing.

Elantric

#1


QuoteSeems that most are/were obsessed with the prospect of reselling the card as "MINT NOS NIB L@@K rare vintage military soviet" item on ebay.  ;D

Which are often priced around the same cost as buying a perfect condition VG-8EX ($160) that already has all the upgrades -  - thats what I did