Jump to content
Jokeyman123

Pooched XW-P1

Recommended Posts

I just updated my XW-P1 to version 1.11 successfully, though I was rather stressed out while doing it due to the reports in this thread.

 

I disabled AVAST! Antivirus active protections before starting the updater. My computer is running Windows 7 (64-bit).

 

I freaked out when the updater was running because I noticed the updater was only 45KB in size. (The entire firmware of the XW-P1 fits in less than 45KB?!? It didn't appear to read the existing firmware into RAM and patch it before sending it back. Or maybe it did and I didn't notice?)

 

Fortunately, all was well at the end of my update. The synth came up on firmware version 1.11 (no clear screen of death).

 

Whew...

Share this post


Link to post
Share on other sites

Oh, and it appears that what the update process does is put the XW-P1 in a special mode that mounts a virtual USB disk to the operating system. I noticed during the update that some "Casio" drive appeared temporarily on my system, but then it unmounted when the firmware update completed. I didn't have a peek at what was on the virtual drive, as I thought it best to leave the update process alone and not do anything that would interfere with it. Maybe that was how it could make the necessary changes without downloading a large image to the synth...?

Share this post


Link to post
Share on other sites

It was best to leave the update process alone. Anything, and I mean anything that interrupts the process completely disables the XW and it requires a complete hardware replacement to restore it. It is not the entire OS. I guess (since Casio tech support kept this secret at least to me) it is equivalent to the small firmware program routines embedded in hard drives, other computer hardware and possibly the CMOS chip in a computer that enable the XW to boot up, and access whatever part of the OS Casio wants to upgrade and that's it. Ever try to cold-boot a computer with no or corrupted CMOS? It can't be done unless you replace the chip, or are able to re-flash the chip which can be locked out by the manufacturer. Thus there is no way to user restore an incomplete "flash" into the XW rom without replacing the component that contains the original firmware. And firmware updates therefore can be very small, depending upon what additional code will be written into the OS.

Share this post


Link to post
Share on other sites

I just updated an XW-G1 to firmware 1.11. The process worked successfully.

 

Turns out that I missed something in my prior comments about the XW-P1 firmware update process, which is very similar.

 

When you unzip the updater files, there are two hidden .BIN files in the same folder. I noticed this today because the updater program is 45KB, but the .ZIP file is about 20MB. There's a ~17KB loader .BIN file, and a ~26MB firmware .BIN file. So the update process does not patch the existing firmware, but rather replaces it with new data.

 

When you power up the keyboard in update mode, it mounts a virtual USB disk to the operating system. The updater program initiates a wipe of the old firmware. After this wipe completes, the virtual USB disk dismounts and remounts. Then new firmware gets written to the keyboard's NVRAM.

 

After the write process completes, the keyboard resets. At that time, the virtual USB disk dismounts again. A few moments later, the keyboard appears in Windows as a USB MIDI device.

 

Hope this information helps for anyone who is trying to better understand how this process works.

Share this post


Link to post
Share on other sites

I have to say that Casio's UK support is second to none.

I had a PX 330 that was under the second year of its warranty when middle D started to buzz , badly !

The dealer arranged for free collection of the piano to be sent back to casio.

In transit the corner got damaged ( only a hair line crack ) but they put a whole new case on it and installed a new mother board...However the middle D buzz remained.

No fuss no questions , Casio arranged again for collection of the faulty piano and sent me a brand new one !

In the meantime I had purchased a newly released PX -350 and sold the new 330 on Amazon.

As for up grading the firmware on my XW , no thanks ...It works just fine on version one but at least I know I will have superb support if I did pooch it !

Share this post


Link to post
Share on other sites

New G1 synths are not made anymore, so if I find a dead XW-G1 cheap on eBay (unless smashed or otherwise mechanically broken) chances are high that the firmware is toast - isn't it? :-(

That an interrupted or wrong firmware update can brick a device is a severe design flaw. At the uni in software engineering we learned that updateable firmware always must contain a fallback flashloader that will be never overwritten during flash process and resides in a write protected memory area, from where the device can be booted by a button combination (or at least jumper contact on PCB) to permit re-flashing if the main firmware got corrupted.

(In Casio "Databank" watches 2 contacts need to be connected after battery change with corrupted SRAM contents to make it boot. But Casio instead wanted owners to mail their watch to a service center for each battery change, which sounds pretty much like a moneymaking scheme. I hope that such 2 pins exist here too, but I doubt.)

But even PC manufacturers don't care, so their EFI Bios is often extremely vulnerable (e.g. Samsung laptops got bricked by installing Linux, because too long error message log files written into the same flash chip overwrote the Bios). In DOS-age IBM Thinkpads a full battery had to be present during BIOS upgrade, because the resetting mainboard chip turned off the power supply input control pin while flashing, thus an empty or broken (since long time not made anymore) battery pack could end in a disaster. (Flashing the XW with full batteries inserted may be a good idea too against mains brownouts.) Also my "Willem Pro4isp" eprommer (connected to parrallel port in Win98SE) software warns to turn off antivirus and CPU throtteling when accessing certain ICs (e.g. Intel MCS-48 microcontrollers).

Nowadays where the IoT (Internet of Things) plague is taking over the mankind, necessarity of so-called "security" (or national trojan spying?) firmware updates in all kinds of cheap hardware will be likely the next obsolescence method to make perfectly intact household items unuseable.

People those modified their "dBox" settopbox to run Linux (for PVR software etc.) also often ended with bricked hardware (I found a dead one on a fleamarket), but these were neither made for not encouraged by the manufacturer to flash such inofficial firmware upgrades (which included connecting wires to IC pins and such things). That original stock firmware flash can fail catastrophically is unacceptable. I hope someone finds a hardware method to re-flash dead XW mainboards.

In past the presence of COB chips (except in watches) was a warning sign indicating overly cheap hardware, although nowadays speed of such uncooled CPUs certainly has become good enough to do something serious. Technically flash memory is such cheap now that an entire 2nd copy of unchanged original firmware can stay in it for emergency. It sucks if Casio really avoided additional memory capacity for a fallback flashloader to save a few (or a fraction of 1?) cents.

Casio should have at least a cheap repair service for this and particularly allow to only mail them the mainboard for exchange instead of shipping the entire bulky instrument (imagine a fullsize wooden home piano - yikes!).


piano_71 wrote:


Oh, and it appears that what the update process does is put the XW-P1 in a special mode that mounts a virtual USB disk to the operating system.


Does a dead XW mainboard still mount this drive? Then it might be possible to copy contents from an intact to a dead one.

When you power up the keyboard in update mode, it mounts a virtual USB disk to the operating system. The updater program initiates a wipe of the old firmware. After this wipe completes, the virtual USB disk dismounts and remounts. Then new firmware gets written to the keyboard's NVRAM.



After the write process completes, the keyboard resets. At that time, the virtual USB disk dismounts again. A few moments later, the keyboard appears in Windows as a USB MIDI device.


Wouldn't it make technically more sense to wipe the old firmware after the reset? So the time without firmware (running only on RAM contents) would be as short as possible.

Share this post


Link to post
Share on other sites

In my experience, once the firmware was wiped, the computer did not recognize the XW-P1 at all. There was no ability to transfer anything. I did not experiment with Linux ADB terminal commands to see if I could get into a bootloader or any kind of flashing process. I did not think this would be possible given the nature of flashing programs and drivers needed to recognize individual hardware devices connected through a USB port. and once I saw the CPU completely encapsulated in epoxy, I knew I was done. There was every possibility the firmware was embedded in this CPU and thus locked out by Casio specifically to cripple reverse engineering, an understandable security measure in this day and age. A good hacker knowing the type of CPU platform could conceivably clone the CPU's instruction and command set-literally copying Casio's machine specific routines that run the XW series!

Share this post


Link to post
Share on other sites

While with older videogame consoles soft- & hardware piracy is common (TV-Boy = Atari 2600, Famiclone = Nintendo NES, Wannawii = Sega Megadrive in Wii-like case etc.), yet I never saw any genuinely "pirated" cheap home keyboard clones.

Obfuscating by "potting" a known microcontroller chip would only make sense when the actual sound engine was purely software based (SA-series was, but laters likely added hardware). And do not think that chip manufacturers laboratories have no means to decap ICs and dismantle them under an electron microscope. A Casio keyboard is not a banking card, so (unlike homebanking) extracting a master key from it would not mean to destroy the entire system or business model. It takes much more than a bit of code to imitate a keyboard hardware mass-produced cheap enough to compete, and they are big enough to be detected on trade fairs when counterfeit for profit. Modern softsynths on PC (accessing gigabytes of samples through a fast CPU) tend to have higher timbre quality than Casio hardware, so pirating modern models for profit in software would not be that reasonable nor destructive to Casio, those instrument benefit from being self-contained with real haptic controls those no mouse or touchscreen can replace. Nobody buys a Privia only as a midi sound source when he does not want to play on its keys. Multi-gigabyte sample software pianos on PC can do higher quality cheaper (and take less space) if that was the only purpose.

I expect that it would be relatively easy for a laboratory to desolder and read the flash rom from an XW mainboard to extract code and samples. It would not surprise me when even the official firmware upgrade files have no strong encryption at all but only a checksum. E.g. of my Samsung WB210 digicam the downloaded firmware file could be easily read with a hex editor and revealed plenty of setup commands in plain ASCII text. I haven't dug deeper, but I am quite sure it is nothing encrypted. Here is what I found out:

Samsung WB210 review (big touchscreen,wide angle,non-wifi|Hacking?)

In music keyboards I did find clones of simple Yamaha FM chips like YM2413B (OPLL) and the cheapish squarewave chip YM2163 (DSG - which was not used in any known Yamaha keyboard but only sold to other companies) remade in Chinese no-name instruments (e.g. Medeli, even pinout was camouflaged by bigger IC package). But the main CPUs always differ and particularly I never found any well known digital high quality sound engine pirated.

Keyboards with imitated case shape (sometimes Casio knock-offs) instead typically contain chips of the Holtek HT36 series. E.g. the Holtek "Ad-Lib Micro" was the grainy sounding heart of "My Music Center" toy keyboards. In late 1990th this microcontroller series became extremely popular in cheap no-name single-chip keyboards and sound toys, and likely also caused the almost demise of quality brand (Casio, Yamaha, Kawai) toy- and mini keyboard sales. The impact can be almost compared with the videogame market crash of 1983. Despite the timbre quality of the flood of Chinese toy tablehooters was lower than in-house developed chips of the classic quality brands (and many had other flaws), they were simply very much cheaper. So finally even Casio tried to sell such a rebranded piece of cheap awful sounding junk as MA-150/MA-170, and today Bontempi still offers a mix of rebranded Chinese toy tablehooters and own higher quality models. Also Holtek later made reasonable sounding digital keyboard CPUs based on sufficiently high resolution samples, and nowadays of course also other companies make them; but what it began with was the Ad-lib Micro. With multitimbrale polyphonic melody voices, samples, accompaniment and demos it was the first cheap single-chip microcontroller intended to compete e.g. with Casio SA-series, despite Casio's 4 bit softsynth CPU of 1989 was much more powerful (21.725 MHz, about 55.7KB DRAM, 63.5KB sample ROM+14KB program ROM according to patents). Unfortunately nobody spent time to program similarly complex sounds on the Ad-lib Micro, which makes it a bit boring. But among toy-grade keyboards it had the last genuinely novel sound synthesis engine, which timbre was still majorly defined by hardware constraints and not only by programmer's choice of sampled waveforms.

Several versions of this Taiwanese lo-fi synth chip exists, those mainly differ in polyphony and amount of memory, but the general sound engine with "ETS" (Electronical Tone Synthesizer) 7 bit static waveform ADSR synth and dedicated PCM voice (percussion) channels of compressed 5 bit samples stays the same. The sound is output through an 8 bit time slice DAC with characteristic glassy timbre. In many instruments for each melody voice 2 detuned ETS channels are layered in software as a (often stereo) chorus effect, which halves polyphony. The datasheets looks detailed enough to emulate this thing if anybody finds a method to dump the rom.

ETS channels have 8 static waveforms of 7 bit with 64 steps and ADSR envelope with 4 bit parameter resolution, sustain & vibrato. PCM channels (intended for percussion and effect noises, not main voice) use 5 bit samples with 8 to 5 µ-law compression, but sample rate can be only set for all channels together with coarse frequency resolution. The 8 bit CPU has only 96 byte RAM. The intended clock rate is 3.58 MHz (but can be overclocked higher - it is unknown if also keyboard manufacturers did this). Known generic versions are e.g. HT3630, HT3650, HT3670 and HT3690. The highest model HT3690 has 8 ETS channels and 4 PCM channels (32K*5 bit voice ROM, 128*5 bit per segment, but only 13 sample rates with max. 13.98 kHz) with 8 step volume control. The DAC has 2 melody outputs (statically assigning each 4 ETS channels) + 1 separate output for percussion (PCM channels). It has 4K*15 bit program ROM. Versions with less polyphony have higher sample rate.

Holtek published some datasheets of in-house example versions (e.g. as advertisement to bait keyboard manufacturers), but in their component list many other ICs are marked "restricted" (i.e. confidential) because 3rd party manufacturers can order custom software variants of ICs and keep datasheets secret as advantage over competitors. (However upon a time the original "My Music Center" CPU was such widespread that it was obviously offered to many different keyboard companies.) Such modern Holtek successors are named "8-Bit Music Synthesizer MCU" and have naming scheme "HT36+letter+cipher" (e.g. HT36A2, websearch the datasheet). Some of them support midi, USB etc. and are used in fullsize Yongmei keyboards those at least visually compete with Casio and Yamaha and are offered under plenty of fantasy brand names and -prices (from 40 to sometimes fraudulent thousands of € - typically 100 or 200€) on eBay.

In the official Holtek forum I read that of the HT36 chip series exists no OTP (prom) version, so normal ones contain mask rom, which will be good news for long term stability and safer circuit-bending, since mask rom does not suffer of bitrot and can not be accidentally overwritten by messing with wrong pins. For hardware developers apparently there is a development board "HT36DB", and of the (newer) "Music MCU" HT36B0 exists a flash version HT36P03 that can be written with a "HT-C300 Flash Writer". The caption mentioned "Music Studio HT36", which may be the name of a development software. But this is all I know. I am not their developer and haven't seen any of this.

Holtek earlier also made other awesome sounding unknown toy keyboad LSI chips with strange blip percussion (including the lovely multipulse squarewave based "Hing Hon EK-001" and Creatoy keyboard) those are technically similar like Casio VL-1 but not copies.


Sorry if this lead too far off-topic, but this is the typical stuff found in "clone" keyboards; unlike game consoles I never found actual pirated modern sound engines of a name brand keyboard in cheap tablehooters. That is to say, the (now outdated) SA-series patent text US5319151 is detailed enough to reimplement its well decribed softsynth on any modern hardware. (May be it's me who will eventually do this. ;-) ) Despite the SA-series IMO sounds better and more interesting than modern toy grade keyboards, Chinese companies don't seem to care but prefer making their own stuff. (Samples with simple envelope are obviously easier to adapt to changing market demand than a sophisticated real softsynth engine.)

By the way, on ElektroTanya I found a Casio CTK-2080 service manual of 2012. The depicted PCB "M822-MDA1" is quite similar like XW-G1 (but has only one flash rom). Unfortunately it also tells nothing about repairing misflash accidents. But the schematics may be useful to understand general principles.

Share this post


Link to post
Share on other sites

I will repeat this because it can't be said enough.  An interrupted firmware update to the XW series can be restarted in most cases.  Up until the point someone presses the OFF button on the synth, nothing is damaged.  Simply restart the updater app.  It will continue to update from the point it was interrupted.  

Share this post


Link to post
Share on other sites
CPU speed comparison

Interesting to discover is that the COB CPU "UPD800468P-012" in CTK-2080 (chip likely identical with XW-series, last 3 digits likely indicate software number, seen in schematics) has a clock rate of only 48 MHz. With 48 note internal polyphony this may mean that the sound engine cycles through all channels with an update frequency of 1 MHz.

Modern high performance CPUs (tablets, PC, digicams, Raspberry Pi) are clocked at least 10 times higher, which suggests that Casio keyboards use specialized dedicated (or just old) hardware and not a highspeed modern microcontroller to run state of the art DSP functions in software. (If the XW chip is specialized, this may be a reason why it can not simply play existing patches from CZ or VZ series, despite phase distortion in software emulation would not need much CPU power.)

For comparison, the SA-series 4 bit RISC CPUs of 1989 was already clocked at (at that time quite fast) 21.725 MHz for 8 note internal polyphony, so clock rate hasn't increased that much, but instead parallel processing capacity was slightly increased. The 4 bit CPU would need to run at hypothetical 130.35MHz to compute 48 channels. To need 48 MHz for this job means it is only about 2.716 times faster than a chip made in 1989. For the 64 note polyphony of XW-G1 it would need either a 3.62 times faster CPU or run at 64 MHz clock rate. (I don't know how high it is actually clocked.) The MT-540 of 1988 even had 10 notes at 21.725 MHz, so it would need to be only 2.897 times faster to handle this. Please correct my if my maths are wrong.

This may be a bit speculative and possibly unfair because the XW synth engine may process more complex synthesis and DSP algorithms per channel and so internally use a much faster CPU. But it gives an idea whether Casio designed really something completely new or only slightly improved a creation perfected in late 1980 to 1990th. The fact that XW-G1 has this strange chiptune appeal that tends to sound a bit grainy with less parameter resolution than modern softsynths and partly coarse timbre transitions would make it plausible, that it indeed feeds "good old" 1990th algorithms with only bigger samples and increased polyphony through otherwise very small hardware. This is not a complaint (Casio synth fans have learned to like that sound) but only a conclusion.

Share this post


Link to post
Share on other sites

I bricked a computer network router doing a firmware upgrade.   The computer went into screen saver then power saver put the computer into standby shut down due to inactivity.  

 

Needless to say,  turn off screen savers and power savers on Windows computers.

 

WK 7500

CTK 900

Share this post


Link to post
Share on other sites
On 12/29/2013 at 8:27 AM, Andrey_sad said:

Well, here's the end of my story.

Received XW-P1 mainboard, soldered it and it works :)

 

It cost me extra $140 (PCB + shipping to USA + shipping to Ukraine). Nice price for firmware upgrading.

2013-12-28_22-30-41_617.jpg

2013-12-28_22-56-01_132.jpg

Soooooo. I just bricked mine.  Saw this forum and still did it. Pretty pissed. I opened the updater and it wasn't recognizing my casio so I tried to quit the updater and restart it. Wouldn't quit. Then I went through the directions and properly turned on my xw-p1 in update mode and my computer recognized it and started updating. Two minutes later the updater finally decides to quit. I restart the updater and it doesn't continue updating. Then I waited and still nothing. Then I stupidly decided to try and restart my casio. LCD screen lights up for a second with no lettering and immediately goes off.

 

It's fried huh? 

 

I bought mine new 5 years ago so the warranty is done. I saw the above post and it looks like this is going to be me. Is this my only hope? I have a link here http://www.pacparts.com/cart.cfm to what seems to be a replacement mainboard. Is it very difficult to replace this myself? I have almost zero soldering experience. Or do I need to buy this mainboard and take it to professional? I'm gonna call casio tomorrow.  I figure it can't hurt to ask you. Thanks

Share this post


Link to post
Share on other sites

The flash updater apparently first erases the entire firmware and so the only thing that keeps it capable to communicate through USB lives in RAM, i.e. power-off is deadly. The fact that the CPU has a software number (at least in CTK-2080) suggests that there is a mask rom built-in. But that it can not communicate by itself with the updater is a massive design flaw. Isn't there a way to save firmware (possibly those 2 .BIN files) on an SD card and press a button combination to make it boot from there?

On the rear edge of the XW mainboard I saw (on photo) an unused 9 pin connector "CN9". May it be that this is used in factory to load firmware first time, or do they really need to flash the roms before soldering them in? The IC1 and IC11 have marks of 2 blue or 3 yellow dots, those may get added after successful flashing. But the handwritten model number on PCB back and the empty "MX-[______]" and "[NO._____] fields looks like when the mainboards are generic (made for several models) and only receive their firmware when they are actually installed (or sold as an expensive spare part).

The flash ROM type "MXIC MX29GL128ETL2I-90G" can be found in the datasheet of "MX29GL128E" (56 pin TSOP) by Macronix. It has "128Mb x8/x16" architecture, i.e. it contains 128Mbit that can be accessed as bytes or 16bit words. (I.e. the instrument has 32 megabyte rom in total, which is not much in an age where you can buy several GB flash memory per Euro or US$. Nowadays it would be cheaply possible to put several CDs full of hifi samples into such an instrument, which makes me suspect that possibly the employed special CPU is too old to address more memory. It might even be that this was the technical reason to make a separate XW-P1 and G1 with each different omitted features, although I guess this was rather a marketing decision, because bank switching through external small parts is nothing new.) The MX29GL128E chip contains various security stuff including a "Solid Protection Mode" and a "Password Protection Mode". (These are likely functions needed for SD-cards.) It is unknown if the XW hardware makes use of them. Also individual sectors can be write protected. There is a "chip erase" command to auto-erase (format) itself without need of complex software interaction, which may be what the updater does.

Share this post


Link to post
Share on other sites

So I was able to talk to Casio today and they referred me to an authorized Casio repairman in my city. No one seems to be able to  know what is wrong with my Casio without taking a look at it. The repair person charges 67 dollars for any estimates that don't result in repair. What I'm wondering is if you guys know exactly what happens to these keyboards when they are bricked, what needs to be replaced and if an amateur can take care of it themselves. I'm worried that it might cost more than it's worth to have it fixed by a professional. I don't want to blow $67 and end up fixing it myself on top of that. So, any ideas?

Share this post


Link to post
Share on other sites
1 hour ago, BradMZ said:

The keyboard or main board needs to be replaced. Are you on Facebook? We have a users group there for more support resources.     https://www.facebook.com/groups/Casio.XW.Synths/

Thanks brad. I just joined up and commented in an existing post. Do you know if it's difficult to replace the main board? And if this link I have is the correct main board and if it's a good deal?

 

Share this post


Link to post
Share on other sites

It is a bit strange that the modern XW keyboards have so little memory. My Casio MT-540 of 1987 had 768KB (mask) rom, which was quite a lot upon that time. (For comparison, the entire RAM of an Amiga 500 homecomputer of the same year was only 512KB and its rom 256KB.)

The SRAM IC9 "R1LV0414DSB" on the XW mainboard photo is only 512KB (organized 256kWord*16bit) and thus way too small to hold the complete firmware during update. But if the hardware or firmware (by what reason ever) can only execute "chip erase" to format the entire ROM (i.e. nothing left to boot from), it for sure still would have been possible to load the boot code (flash loader) from PC into SRAM before starting erasure and then immediately write this part back into flash rom without depending on a still properly working PC program and USB connection. This way the keyboard would never become unbootable after power-off (unless a freak accident or extreme stupidity causes a power fail or powers-off just between formatting and reinstalling the boot loader) and could still always boot into the flash loader, no matter what happens to the PC or connection.

Has anybody tried to load the BIN files from the update program on a small SD card (old hardware often supports maximum 2GB) or even USB stick and tried to start the keyboard firmware update mode with it inserted? If the CPU contains mask rom (it very likely does), it would be plausible to include such a fallback method if the normal method went wrong. It may be that special file names or other strange tricks are needed to make it work (possibly another button combination or even connecting 2 special pins on the mainboard), but before discarding the mainboard I would try to boot directly from SD or USB media. (What is the procedure with Privia or older Casios with updateable firmware? Is there something similar?)

E.g. the CTK-2080 service manual mentions an easteregg, namely holding buttons "0"+"1"+"2" together during power-on enters a diagnostic program (aka test mode or service mode) where various functions can be checked. Items are selected with the cipher buttons. Button "9" displays rom version and model number.

0 = return to main menu
1 = button check (press all keys and buttons in a certain order)
2 = LCD check
3 = AC adaptor check
9 = rom version check

If USB works correctly, it will show in Windows device manager an item "USB Audio Devices" under "Sound, Video and Game Controllers".

Power off to exit. (But I guess this works only with intact firmware and not when it is already bricked.)

Share this post


Link to post
Share on other sites

Hi...i am a new user here. For my case No one seems to be able to  know what is wrong with my Casio without taking a look at it. The repair person charges 67 dollars for any estimates that don't result in repair. What I'm wondering is if you guys know exactly what happens to these keyboards when they are bricked, what needs to be replaced and if an amateur can take care of it themselves. I'm worried that it might cost more than it's worth to have it fixed by a professional.

 

circuit boards assembly

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×