What happened with Miracle Piano rev-engineering?

Discuss technical or other issues relating to programming the Nintendo Entertainment System, Famicom, or compatible systems. See the NESdev wiki for more information.

Moderator: Moderators

Sik
Posts: 1589
Joined: Thu Aug 12, 2010 3:43 am

Re: What happened with Miracle Piano rev-engineering?

Post by Sik »

Jazzmarazz wrote:This photo shows a sample that is identical on both sound channels. Trust me, they are identical but the channels are not being displayed the same way.
Eh, it's just that their phases are offset (probably didn't start at the same time), the waveforms are clearly identical.
Joe
Posts: 643
Joined: Mon Apr 01, 2013 11:17 pm

Re: What happened with Miracle Piano rev-engineering?

Post by Joe »

Jazzmarazz wrote:AS0012 - Pin 21 (PWM)
It turns out this pin controls the master volume and NOT the envelope as I had originally assumed.
I did mention something to that effect earlier. :wink:
Jazzmarazz wrote:OUT4 on the other hand does not seem to react to any button or key. It simply outputs a DC voltage which measures 5.03v at pin 14 of U10.
I'm curious to see if any of the 128 instruments produce any effect here. I'll dig through the firmware and see if I can find anything in the instrument tables that would determine which pin is used for output.
Jazzmarazz wrote:I am a little saddened that the envelope is not broken out to any specific pin or sub-circuit. :(
The Miracle Piano can output up to 16 notes simultaneously; a single envelope signal is not enough.
Jazzmarazz wrote:J004 - Pin 40 (Bus Strobe)
This pin reacts differently for different sounds, however, when the key is pressed with a sound that has an attack and release; the pin will strobe for the full length of the sound and go to 0 when the note is finished.
For a sound that ends only when the key is released, the pin strobes at key press for a moment, then goes to 0 and strobes once again when the note is released.
That signal is actually from the CPU, and it strobes whenever there's a new set of data being sent to the J004. It sounds like the envelope is all done CPU-side, which would make it possible to snoop the bus to get the envelope. (Of course, we have no idea how it's encoded...)
User avatar
Jazzmarazz
Posts: 26
Joined: Mon Mar 30, 2015 2:22 pm
Location: Detroit, MI
Contact:

Re: What happened with Miracle Piano rev-engineering?

Post by Jazzmarazz »

Bavi_H wrote:
Jazzmarazz wrote:Harpsichord and Synthesizer [...] the other four sounds
Just want to make sure you're aware: Even though there are only 6 instrument buttons, there are 128 total instruments available using special button combinations. If you search for images of the Miracle Piano, you'll see some versions have much more text on the panel. On the NES version, the panel text is simplified and the extra functions are labeled on an overlay you place over the buttons.
PIANO = MELODY 1
HARPSICHORD = MELODY 2
ORGAN = ACCOMPANY
[up] = SCROLL UP

VIBRAPHONE = BASS
ELECT PIANO = PERCUSSION
SYNTHESIZER = SELECT
[down] = SCROLL DOWN

[volume lights]
10 = CLASSICAL
9 = ROCK
8 = JAZZ
7 = BLUES
6 = RAP
5 = LATIN
4 = COUNTRY
3 = CATHEDRAL
2 = NEW AGE
1 = LIBRARY SELECT
The NES manual is available at archive.org: Miracle Piano Teaching System, The (1990)(Software Toolworks). The end of the manual has information about the keyboard. To see how to select the extra sounds, see PDF pages 171-173 (printed pages 164-166).
Thank you. I had actually forgotten since I never owned the manual and have actually not played this keyboard in several years. In any case, I had only used it as a MIDI controller when I 'did' play it.
The point was not nessecarily to view each sound sample, but to probe some of the logic instead.
Sik wrote:
Jazzmarazz wrote:This photo shows a sample that is identical on both sound channels. Trust me, they are identical but the channels are not being displayed the same way.
Eh, it's just that their phases are offset (probably didn't start at the same time), the waveforms are clearly identical.
True. While adjusting the vertical srcolling of each channel, I could only get them to stop as they are shown. Syncing them together was not possible.
Joe wrote:
Jazzmarazz wrote:AS0012 - Pin 21 (PWM)
It turns out this pin controls the master volume and NOT the envelope as I had originally assumed.
I did mention something to that effect earlier. :wink:
Jazzmarazz wrote:OUT4 on the other hand does not seem to react to any button or key. It simply outputs a DC voltage which measures 5.03v at pin 14 of U10.
I'm curious to see if any of the 128 instruments produce any effect here. I'll dig through the firmware and see if I can find anything in the instrument tables that would determine which pin is used for output.
Jazzmarazz wrote:I am a little saddened that the envelope is not broken out to any specific pin or sub-circuit. :(
The Miracle Piano can output up to 16 notes simultaneously; a single envelope signal is not enough.
Jazzmarazz wrote:J004 - Pin 40 (Bus Strobe)
This pin reacts differently for different sounds, however, when the key is pressed with a sound that has an attack and release; the pin will strobe for the full length of the sound and go to 0 when the note is finished.
For a sound that ends only when the key is released, the pin strobes at key press for a moment, then goes to 0 and strobes once again when the note is released.
That signal is actually from the CPU, and it strobes whenever there's a new set of data being sent to the J004. It sounds like the envelope is all done CPU-side, which would make it possible to snoop the bus to get the envelope. (Of course, we have no idea how it's encoded...)
1. Yup, you did. :P
I read it only briefly and thought you were talking about a different model for the master volume.

2. I want to think that 'some' of the sounds would affect this pin somehow, but I did not test any other sound banks. I had forgotten they existed. :oops:

3. & 4. The envelope being internal to the j004 or encoded on the data bus is unfortunate, but makes more sense considering the polyphony. 16-notes simultaneously is quite impressive to be honest. This is not a high-end keyboard by any means.

I already have the keyboard closed up, so I hope you can find something about j004 - pin 40 in the firmware. I suspect that this pin could be used to modulate the amplitude or offset of the sound. I did however notice 'some' slight offset of the waves that resembled a sinusoidal. Something like a carrier wave. It was present in only some of the sounds and was so small that I could hardly tell.
Joe
Posts: 643
Joined: Mon Apr 01, 2013 11:17 pm

Re: What happened with Miracle Piano rev-engineering?

Post by Joe »

Jazzmarazz wrote:2. I want to think that 'some' of the sounds would affect this pin somehow, but I did not test any other sound banks. I had forgotten they existed. :oops:
I've looked at the firmware and found something that might be the output pin selector. If it is, 72-76 and 97 are the ones that use OUT4. Those are all percussion and sound effects.
Jazzmarazz wrote:I already have the keyboard closed up, so I hope you can find something about j004 - pin 40 in the firmware. I suspect that this pin could be used to modulate the amplitude or offset of the sound.
All it does is tell the J004 when the CPU is sending a command. Any modulation of amplitude or offset would be in those commands.
Jazzmarazz wrote:I did however notice 'some' slight offset of the waves that resembled a sinusoidal. Something like a carrier wave. It was present in only some of the sounds and was so small that I could hardly tell.
That's probably analog noise. It's a digital signal, so the J004 will ignore anything like that.
User avatar
Jazzmarazz
Posts: 26
Joined: Mon Mar 30, 2015 2:22 pm
Location: Detroit, MI
Contact:

Re: What happened with Miracle Piano rev-engineering?

Post by Jazzmarazz »

Joe wrote: I've looked at the firmware and found something that might be the output pin selector. If it is, 72-76 and 97 are the ones that use OUT4. Those are all percussion and sound effects.
Begin associated with percussion actually makes sense. OUT4 could potentially be a white noise output. White and Pink noise are used as the tones for percussion effects. That would also makes sense why it is not filtered as much as OUT1-3.

...perfect sense in fact!
Joe wrote: All it does is tell the J004 when the CPU is sending a command. Any modulation of amplitude or offset would be in those commands.
Oops; I did not mean pin 40, I meant OUT4 and you answered that question.
Joe wrote: That's probably analog noise. It's a digital signal, so the J004 will ignore anything like that.
Maybe. My scope is not the best after all and I did have the signals amplified a lot so that I could see them clearly. Even a mV of interference or oscillation would be visible if amplified 5 or 10 times.

When I get another chance, I will have a look at OUT4 and check all of the sound banks.
Joe
Posts: 643
Joined: Mon Apr 01, 2013 11:17 pm

Re: What happened with Miracle Piano rev-engineering?

Post by Joe »

Jazzmarazz wrote:Begin associated with percussion actually makes sense. OUT4 could potentially be a white noise output. White and Pink noise are used as the tones for percussion effects. That would also makes sense why it is not filtered as much as OUT1-3.

...perfect sense in fact!
I don't think so. All of the percussion sounds are samples in the ROM, so there's no need for a dedicated noise output. It's much more likely that OUT4 is just another DAC output, just like OUT1 through 3.

The difference in filtering does make sense; you'd want to keep sharp transients and noisy high-frequency content for percussion.
User avatar
Jazzmarazz
Posts: 26
Joined: Mon Mar 30, 2015 2:22 pm
Location: Detroit, MI
Contact:

Re: What happened with Miracle Piano rev-engineering?

Post by Jazzmarazz »

Joe wrote:
Jazzmarazz wrote:Begin associated with percussion actually makes sense. OUT4 could potentially be a white noise output. White and Pink noise are used as the tones for percussion effects. That would also makes sense why it is not filtered as much as OUT1-3.

...perfect sense in fact!
I don't think so. All of the percussion sounds are samples in the ROM, so there's no need for a dedicated noise output. It's much more likely that OUT4 is just another DAC output, just like OUT1 through 3.

The difference in filtering does make sense; you'd want to keep sharp transients and noisy high-frequency content for percussion.
OK, you're right. If the sound is stored as a sample then it is surely another dac output. It would have to be stored as a sample if the envelope is in software. Personally, I would have used an LFSR for the noise source just like the gameboy uses but that is besides the point.

Do any of the noise samples continue to play indeterminately? What I mean is, do any of the noise samples continue to play at full amplitude until the key is released? A common problem with looping noise sources is that they noticeably "breath." I find this attribute of psudo-random number generators to be interesting, but some audiophiles can't stand it!

I think I would like to use some of these samples in my own project. I plan to create a voltage controlled oscillator which is wired to a rom2dac circuit.
User avatar
Dwedit
Posts: 4911
Joined: Fri Nov 19, 2004 7:35 pm
Contact:

Re: What happened with Miracle Piano rev-engineering?

Post by Dwedit »

The first 6 keys of "Rap > Percussion" play as you hold down. Those aren't noise though, but they are from an Effects instrument.
Also, the applause noise loops as it's held down, and that IS noise.
Here come the fortune cookies! Here come the fortune cookies! They're wearing paper hats!
User avatar
Jazzmarazz
Posts: 26
Joined: Mon Mar 30, 2015 2:22 pm
Location: Detroit, MI
Contact:

Re: What happened with Miracle Piano rev-engineering?

Post by Jazzmarazz »

Dwedit wrote:The first 6 keys of "Rap > Percussion" play as you hold down. Those aren't noise though, but they are from an Effects instrument.
Also, the applause noise loops as it's held down, and that IS noise.
Thanks, I'll have a listen to applause.

I have elected not to open it back up to probe out4. Joe says it is used in software, so I am certain it is.
Joe
Posts: 643
Joined: Mon Apr 01, 2013 11:17 pm

Re: What happened with Miracle Piano rev-engineering?

Post by Joe »

The J004 (or 8500536 in my piano) is a close relative of the SGS-Thomson M114A and M114S Digital Sound Generator ICs. The pinout resembles the M114S, but the channel number is multiplexed onto the ROM address lines, so it's more like a pin-reduced M114A. Datasheets for the M114A and M114S can be found in the SGS-Thomson Audio and Radio ICs Databook at bitsavers. It's driven by a 4 MHz clock.

I don't know if there's any difference between the J004 and the 8500536.
Joe
Posts: 643
Joined: Mon Apr 01, 2013 11:17 pm

Re: What happened with Miracle Piano rev-engineering?

Post by Joe »

The Miracle Piano accepts only MIDI input. It uses the 8032's built-in UART for RS-232 serial ports at 9615 baud or standard MIDI ports at 31250 baud. One of the ASICs handles receiving MIDI from game consoles.

The firmware specifically recognizes all of the following MIDI messages:

Code: Select all

8x xx xx
9x xx xx
bx 07 xx
bx 40 xx
b0 7a xx
bx 7b xx
cx xx
f0 00 00 42 01 02 xx
f0 00 00 42 01 04
f0 00 00 42 01 06 xx xx xx
f0 00 00 42 01 07
f0 00 00 42 01 08
f0 00 00 42 01 09
f0 00 00 42 01 0a xx xx
f0 00 00 42 01 0b xx xx
f8
ff
Channel messages (80-CF) only have effect for channels 0-7. Running status is supported for channel messages. System Exclusive messages are accepted without the EOX (F7) terminator.

Note Off (80-87) does what you expect. Velocity seems to be ignored.

Note On (90-97) also does what you expect. The highest accepted note number is 55. The lowest accepted note number is 18, but many patches won't produce sound with note numbers below 1E or 24.

Channel Volume formerly known as Main Volume (B0-B7 07) controls the main volume. It applies to all eight channels no matter which one is selected. Version 2.03 of the firmware keeps track of each channel's volume independently, but doesn't do anything with it.

Damper/Sustain Pedal (B0-B7 40) does what you expect. Contrary to the MIDI standard, only a data byte of 7F means pedal on, and all other values (00-7E) mean pedal off. The sustain pedal is tracked separately for each channel. Notes that receive a Note Off while the pedal is on will continue to play until the pedal is also off.

Local Control (B0 7A) turns on or off local control according to the value of the data byte. If bit 0 is set, local control is enabled. If bit 0 is cleared, local control is disabled and all currently playing notes on channel 0 receive a Note Off. The remaining bits of the data byte (1-6) are ignored. Unlike other channel messages, Local Control only works on channel 0.

All Notes Off (B0-B7 7B) performs a Note Off for all notes on the selected channel.

Program Change (C0-C7) sets the patch for the selected channel.

SysEx 2 (F0 00 00 42 01 02) seems to modify how velocity is handled. A data byte of 01 selects the default behavior. A data byte of 00 seems to decrease sensitivity, requiring greater velocity for the same sound. All other data byte values seem to be equivalent to the default.

SysEx 4 (F0 00 00 42 01 04) requests the firmware version. Version 1.10 responds with F0 00 00 42 01 05 01 0A F7. Version 2.03 responds with F0 00 00 42 01 05 02 03 F7.

SysEx 6 (F0 00 00 42 01 06) sets split patches. The first parameter byte selects the channel in the lower four bits, though only channels 0-7 have any effect. Bits 4-6 are ignored. The second parameter byte selects the patch for notes 18 through 3B. The third parameter byte selects the patch for notes 3C through 53. Some patches aren't supposed to respond to velocity; this effect is determined by the patch selected for the lower notes. This command can be interrupted after sending the second parameter byte to set only the lower patch without changing the upper patch.

SysEx 7 (F0 00 00 42 01 07) clears the firmware's input/output buffers and does a Note Off for all notes on all channels.

SysEx 8 (F0 00 00 42 01 08) turns on all the LEDs.

SysEx 9 (F0 00 00 42 01 09) returns the LEDs to normal.

SysEx 10 (F0 00 00 42 01 0A) sets the output MIDI channel to the lower four bits of the first parameter byte. The code to handle this command intentionally reads a second parameter byte, but completely ignores the value. Like the split patch command, this command may be interrupted after sending only one parameter byte and it will still take effect.

SysEx 11 (F0 00 00 42 01 0B) performs very basic memory test, then sets the output MIDI channel the same way as the previous command. It responds with F0 00 00 42 01 0B 01 F7 if the test passes, and F0 00 00 42 01 0B 00 F7 if the test fails. Like the previous command, it may be interrupted after only one parameter byte and the output channel will still change. It may also be interrupted without sending any parameters and the memory test will still run and produce a response. (Was this command supposed to accept parameters? It could be a copy/paste error that no one caught.)

Timing Clock (F8) messages are discarded before they reach the firmware's MIDI input buffer. Unlike other unrecognized MIDI messages, they won't interrupt any messages in progress and won't terminate Running Status.

System Reset (FF) resets the piano mostly to its initial power-on state. It doesn't completely reset the 8032, but it's pretty close.
User avatar
Dwedit
Posts: 4911
Joined: Fri Nov 19, 2004 7:35 pm
Contact:

Re: What happened with Miracle Piano rev-engineering?

Post by Dwedit »

Joe wrote: Tue Feb 06, 2024 10:27 pm Local Control (B0 7A) turns on or off local control according to the value of the data byte. If bit 0 is set, local control is enabled. If bit 0 is cleared, local control is disabled and all currently playing notes on channel 0 receive a Note Off. The remaining bits of the data byte (1-6) are ignored. Unlike other channel messages, Local Control only works on channel 0.
I believe the game does this during screen transitions. I noticed how you can't play any keys during those times, and noticed that the manual mentions special codes sent to the keyboard to do those things.

Now I just wonder which Sysex is sent when you trigger the "You're pounding not playing" screen. Is it just All Notes Off?
Here come the fortune cookies! Here come the fortune cookies! They're wearing paper hats!
Joe
Posts: 643
Joined: Mon Apr 01, 2013 11:17 pm

Re: What happened with Miracle Piano rev-engineering?

Post by Joe »

Could be! I haven't looked at the games at all, but the MIDI messages I listed are the only ones the piano understands.


At least two versions of the Miracle Piano main board exist. The (presumably) older version, marked "800951 REV B1" in silkscreen and copper, seems to match the schematics available here (aside from the bodges). The (presumably) newer version, marked "800961 REV A" in silkscreen and copper, has some significant differences, apparently to reduce the part count and fix mistakes.

From the outside, the only obvious difference is the color of the power LED. In the older version, it's yellow. In the newer version, it's green.

The newer version rearranges the address and data lines for the firmware ROM. Data lines 3 through 7 are reversed (3 exchanged with 7 and 4 exchanged with 6). Address lines 0 through 7 are reversed (0 exchanged with 7, 1 with 6, and so on).

The newer version rearranges how the LEDs are connected to the shift registers.

The newer version uses a couple of 74LS244 line drivers for the keyboard instead of a bunch of resistors and diodes.

The newer version uses a 74LS125 to replace some passive components in the part of the circuit that switches between RS232 and MIDI. (It might also have other functions, I didn't trace all of its pins.)

The newer version uses part of a 74LS14 for the same thing, and another part of it to help generate the 12MHz clock signal. (It might also have other functions, I didn't trace all of its pins either.)

The audio circuit in the newer version is significantly different. The LM13700 and LM324 have been replaced with passive components or removed entirely. The PWM signal that provided volume control in the older version isn't connected to anything in the newer version. In my piano, the main synthesizer chip is labeled "8500536" instead of "J004", but I don't know if that has anything to do with the changes to the audio circuit.

I've attached a schematic for the newer board's audio circuit. I'm a bit colorblind, so I can't promise the resistor values are correct...
Attachments
schematic.png
Joe
Posts: 643
Joined: Mon Apr 01, 2013 11:17 pm

Re: What happened with Miracle Piano rev-engineering?

Post by Joe »

Most of the digital logic inside the Miracle Piano is contained within two ASICs, labeled AS0012 and AS0013 in the schematics but 800502 and 800601 on the actual chips.

The AS0012/800502 ASIC provides the keyboard interface, the game console interface, and the PWM volume control signal. It's connected to the CPU's external interrupt 0 pin to notify the CPU when the keyboard or game console interface needs attention. The firmware ROM accesses its registers at $C480-$C483, but some of those address bits are not decoded.

Reads from $C480 access the keyboard interface status register. Bit 7 is set to indicate a key press or release has occurred. Bit 6 is set to indicate press or clear to indicate release. Bits 5 through 0 indicate the key number (add $20 to get the MIDI note number). The front panel buttons are keys $38 through $3F.

Reads from $C841 access the keyboard interface velocity register. Bit 7 is always 0. Bits 6 through 0 indicate the velocity. Reading this register seems to acknowledge the keyboard interface interrupt. It's unknown whether the ASIC reports key up velocity; the firmware seems to keep track of it, but doesn't use it.

Writes to $C480 seem to be used to reset the keyboard interface, but the details are unknown.

Writes to $C841 set the PWM volume level. Firmware 1.10 writes values from $00 (loudest) to $BF (quietest). Firmware 2.03 always writes $00.

Reads from $C842 access the game interface status register. Bit 6 is set when a data byte has been received from the game console. Bit 5 is set when a data byte needs to be sent to the game console. Bits 4 and 3 seem to indicate an interrupt has occurred for some other reason, but the firmware acknowledges the interrupt without doing anything else. The firmware ignores the other bits.

Writes to $C842 seem to be used to reset the game interface, but the details are unknown.

Reads from and writes to $C843 access the game interface data register. Data sent to or received from the game console pass through this register. (It's probably actually two registers.) Reading this register seems to acknowledge the game interface interrupt.

The AS0013/800601 ASIC provides the programmable LUT for the sample ROM upper address bits, and also decodes the 8032's address bus for other components on the board. The firmware ROM accesses its registers at $8000-$800F, but some of those address bits are not decoded. Its registers are write-only.

Writes to $8000 through $800F program the sample ROM upper address bits for each of the sixteen J004 channels. I suspect each register can actually hold two sets of upper address bits for the two samples on each channel, but I haven't been able to confirm it using only static analysis.
Joe
Posts: 643
Joined: Mon Apr 01, 2013 11:17 pm

Re: What happened with Miracle Piano rev-engineering?

Post by Joe »

Huh, I posted about which MIDI messages the piano can receive, but not which messages it can send.

Here's all the MIDI messages the Miracle Piano can send:

Code: Select all

9x xx xx
bx 40 xx
bx 7b 00
cx xx
f0 00 00 42 01 01 0x f7
f0 00 00 42 01 03 0x f7
f0 00 00 42 01 05 xx xx f7
f0 00 00 42 01 0b 0x f7
The piano may be configured to send Channel messages on any of the 16 MIDI channels.

Note On (90-9F) messages are used for both note on and note off. It means note off when the velocity is zero.

Damper/Sustain Pedal (B0-BF 40) is used as you would expect. The piano sends a data byte of $7F for pedal on and $00 for pedal off.

All Notes Off (B0-BF 7B 00) is sent to the RS232 or MIDI port when the keyboard buffer overflows (right before the SysEx 3 message). The piano won't send this message to a game console.

Program Change (C0-CF) is sent when the patch is changed while the piano is in Library Select mode. The piano doesn't send it in the other modes.

SysEx 1 (F0 00 00 42 01 01 0x F7) is sent when buttons are pressed or released. Bit 3 of the data byte is set when a button is pressed and clear when a button is released. Bits 2-0 indicate which button; they're numbered sequentially from left to right, top row first. In the default preset, all buttons send press and release messages. In the other presets, all buttons except the "synthesizer/select" button send button press messages, and all buttons send button release messages. In Library Select mode, only the volume buttons send button press messages, and no buttons send button release messages.

SysEx 3 (F0 00 00 42 01 03 0x F7) is sent when one of the firmware's internal buffers overflow. The data byte is $01 to indicate a keyboard buffer overflow. The data byte is supposed to be $02 to indicate a MIDI output buffer overflow, but due to a bug it will probably crash before sending the message. There's no special message to indicate a MIDI input buffer overflow; the firmware silently discards any bytes that arrive while the input buffer is full.

SysEx 5 (F0 00 00 42 01 05 xx xx F7) is sent in reply to SysEx 4. The two data bytes indicate the firmware version: $01 $0A for 1.10, or $02 $03 for 2.03.

SysEx 11 (F0 00 00 42 01 0B 0x F7) is sent in reply to SysEx 11. The data byte is $01 if the memory test passed, $00 if it failed.
Post Reply