Casio CTK-1000 hardware analysis (also VA-10)

[CYBERYOGI =CO=Windler]

I finally got my hands on a Casio CTK-1000. It is unfortunately excessively bulky (like a 1970th Antonelli; at least the speakers are not bad). The synthesized IXA presets respond nicely to velocity and not only turn brighter and louder, but partly into metallic and resonant distorted timbres (physical modelling?). Picked strings, organs and synth pads are very nice. It can sound like a warm analogue synth and is well suited for new age music. In any preset sound 3 synth parameters {wave, attack, release} can be edited and saved as user preset. Their values can be 1..9, where 0 is the default. The behaviour of 'wave' depends on the preset sound.

What sucks is that many brass, string and ensemble timbres are only loop samples with sampled vibrato, which of course changes speed with the note pitch until the next (well audible) split zone is reached; this rather reminds to 1990th Bontempi GM home keyboards or Potex sound toys than a serious synth. Despite many DSP effects, there are no vibrato or tremolo settings; instead many voices contain an annoying delayed vibrato that can not be disabled. Obnoxious is also that there seems to be no easy way to play in the chord section chords without rhythm or accompaniment. (May be you can program this as a "style", but thats not what a keyboard should do.) There is no key split mode except as part of some "split" preset sounds. The entire thing somehow feels like an ill designed cross between MA-130 kiddy keyboard and a very serious workstation.

Absolutely insane is that despite complex multi-track sequencer with even editable styles and synth user presets there are no means at all for backup, so the only way not to loose them is to have fresh D-cells inserted and keep the AC adapter connected while changing batteries. (Why is there not even SysEx dump!? An SRAM upgrade module like those for SK-series could fix this.) The manual even warns to disable auto-power-off (hold 'tone' button and switch power on) during programming to avoid data loss. Interesting is that at least through midi (haven't tried) the sound engine is multi-timbrale and there is a "local off" mode that may permit to route the keyboard input through a PC to circumvent some design flaws (e.g. key split).

Despite superficial similarities to the Casio VA-10 (both from 1993), the ICs are much bigger and have nothing common.

main ICs:

• CPU= "NEC D939GD 010, 9315BA 006" (160 pin SMD, PCB label "UPD939GD-00X, NM-110", 20 MHz? crystal clocked)
• key velocity IC= "Casio HG52E35P, CDHG256, 3C33, Japan" (64 pin SDIL)
• ROM= "NEC D23C16000BCZ 065, 9314E7003, Japan" (42 pin DIL, 2MB)
• SRAM= "NEC D43256AC-12L, 9310AD019, Japan" (28 pin DIL, 256KB)
• DRAM= "Sanyo LC33832PL-70, 3DD0, Japan" (28 pin DIL, 256KB pseudo-static, PCB label HM65256BSP)
• DAC= "NEC D6376CX, 92498H003, Japan" (16 pin DIL)
• panel CPU= "NEC D78CP14CW, 9246PX701, Japan" (64 pin SDIL, 12 MHz crystal clocked)
• power amp= "LA 4620, 2J1" (23 pin SIL)
• IC= "F MB3771, 311F40" (8 pin DIL, PCB label "MB3771P")
• 2x IC= "Mitsubishi 5216A 2607R" (8 pin DIL)
• transistor array= "LB1216, 3N9" (16 pin DIL)
• transistor array= "LB1233, 1H8" (16 pin DIL)
• optoisolator= "NJL 51270,2Y" (6 pin DIL)
• 3x hybrid= "B9HC0118, 101Kx8" (9 pin SIL)

The 16 bit ROM (I dumped it) is 2MB large and contains plenty of samples and curves, as well as plenty of strange wavy ramps; possibly IXA employs the mysterious "triangular wave modulation" (https://www.google.com/patents/US5164530). With ROM removed, the panel LEDs and display ("00") look normal, but nothing responds and no sound.

The CPU "NEC D939GD 010" (160 pin SMD, 20MHz) seems to be successor of the MT-540 CPU ("NEC D938GD 005", 120 pin SMD, 2.17248MHz), but unlike the latter it interfaces velocity sensitive keys and parts of the control panel through 2 external large ICs and uses most of its 160 pins to access SRAM, DRAM and 2MB ROM simultaneously (no shared bus) to increase throughput per clock cycle. Despite high complexity it fortunately does not run hot and so neither shortens its own lifespan not that of the batteries.

Strange is that parts of the control panel are handled by a fairly large CPU "NEC D78CP14CW" (64 pin SDIL) on a daughterboard with ribbon cable wired to empty IC holes on the panel PCB. This hints that Casio had planned a different user interface (perhaps a professional synth?). Many D78CP14CW pins are unused; most do nothing but some output matrix signals. Possibly an LCD was planned but no software written for it. Annoying is that you e.g. can not see the effect settings and so have to tweak sound by ear and count button presses (MT-750 did the same). Also the menu structure is quite restrictive; e.g. various mode changes stop rhythm.

Perhaps the panel CPU was added to save computing time in the main CPU, which has more sound glitches and irregularities than MT-540. E.g. effect buttons cause strange transient pop noises, the sample split zones are much more audible (i.e. lack interpolation) and the awesome algorithmic program loops synthesis sounds are gone. (I.e. the 'sound effect' preset consists here only of a bunch of very plain behaving loop samples.) Knowing that MT-540 was a high grade variant of the softsynth-on-a-chip (Casio SA-series), I guess that Casio threw a lot of goodies out of their algorithm to save computing time for the IXA synthesis, effect section and higher polyphony. The only special behaving preset is 'synth-lead 2', which stays always monophonic with portamento, which hints that there are many hidden synthesis parameters. The effect section DSP may be in fact hardware (seen in Casio patents) and likely uses the DRAM. So it might be possible to install a microcontroller between CPU and RAM to edit further parameters or at least backup its content on persistent memory. It also may be that the strange D78CP14CW can be replaced with a programmable microcontroller to unleash hidden synth capabilities of this thing.


Somewhat similar like CTK-1000 is the much smaller Casio VA-10 "Voice Arranger", which also has a DSP effect section and can route microphone input through it. But the ICs are different:

• CPU= "NEC D911GF 003, 9243AA005, Japan" (120 pin SMD)
• DSP?= "OKI M6583-04, 2432202, Japan" (60 pin SMD)
• DRAM= "Toshiba TC51832APL-85, 9236HAK, Japan" (28 pin DIL, 32KB pseudo-static)
• op-amp= "XRAI5218, 245 214A" (8 pin DIL, PCB label "M5218APR")
• power amp= "Motorola AN8056, 2'D6" (28 pin DIL)
• 3x hybrid= "B9HC0118, 101Kx8, 2N" (9 pin SIL, PCB label "CNB8X101K")
• hybrid= "B9XC0118, 101Kx7, 20" (8 pin SIL)

Although the main voice preset sounds resemble much Casio SA series keyboards, the main ICs strongly differ from all other small Casio keyboards. The double sided PCB is fairly complex with 3 large digital ICs and plenty of discrete components. The CPU "D911GF" is such exotic, that not even Google finds its name. As expected, also the "OKI M6583" has no datasheet, but plenty of Mitsubishi ICs with "M6583..." (different pin count) are audio delay DSP for reverb and echo effects in things like karaoke machines, so technical relations would be very plausible.

[CYBERYOGI =CO=Windler]

CTK-711EX = CTK-1000 synth with built-in floppy drive?!

On eBay I saw a workstation keyboard Casio CTK-711EX, which looks like an even bulkier variant of CTK-1000 with LCD display, 232 ToneBank, 110 rhythms and 3.5'' diskette drive. May it be that this one was "the real thing" while CTK-1000 was only a cut down household variant?

My CTK-1000 panel PCB contains a strange adapter like when the hardware was originally designed for something else. Perhaps it was the LCD based CTK-711EX. This would namely explain why the fairly complex sequencer and synth in CTK-1000 was made but not means of data storage.

There is this YouTube clip about it:

By the way, I found out the mysterious meaning of "IXA Sound Source". It's "Integrated Cross-Sound Architecture" (thanks Synrise for info), which IMO sounds more like an advertisement name without technical meaning and therefore likely soon was dropped by Casio.

I just found the CTK-711EX service manual from 1998, and the main ICs do strongly differ:

* CPU="HD6473042F16-463"

* DSP="HG51B155FD"

* key velocity IC="TC190C020AF-001"

* DAC="uPD6376GS"

* LCD driver="SED1278F2A"

* ROM1="MSM27C802CZ-463" (8Mbit)

* ROM2="MSM27C3210MC-12CA89" (32Mbit)

* RAM1="TC551001BFL-70L" (1Mbit)

* RAM2="TC55257, GFL-70L" (256Kbit)

Thus it is likely more the case design than technical similarity.

[Jokeyman123]

Really good technical information, Cyberyogi. I have a question re your post here. How do you dump the contents of a ROM chip? I often work on equipment at the chip level (I have 4 inoperative units right now I'm troubleshooting-not Casio) and problems seem to be in the OS chips-some Yamaha stuff. I am familiar with eeprom burners (costly) and eeproms and proms although I've never invested in an IC burner (so far).  Would be helpful to me as a troubleshooting tool, and just for my own knowledge. Thanks in advance.

[CYBERYOGI =CO=Windler]

Dump a rom? Simply connect the midi cable, download a hacked sequencer program from the darknet that contains proper sysex command, select "Backup Firmware now", click "confirm? - yes" and...

*NOPE*

You have to desolder the actual ROM IC, identify its pinout (typically based on equally sized eproms) and buy or solder your own an adapter for your eprommer. (I wirewrap the stuff on some stacked IC sockets with bent pins sticking sideways if only few differ, else solder on a piece of perfboard.)

Here are some generic pinouts:
https://www.mikesarcade.com/cgi-bin/spies.cgi?action=url&type=info&page=ROMref.txt

Select a compatible mode in your eprommer's menu. I use a Willem Pro4isp for parallel port on Win98SE, but others should work also. Modern eprommers may be expensive, but for older stuff DOS or even C64 age eprommer with the appropriate computer can be sufficient. In worst case with large roms you may need to connect higher address pins on the ROM to a dip switch to manually dump in in multiple blocks. E.g. in some Casio roms the chipselect pins are inverted and so need some hacks to make the IC respond (I connected them with test cables).

Also DIY microcontrollers like Raspberry Pi may be suited to program a rom dumper.


Here is a section of the next WarrantyVoid FAQ:

make ROM dumps:

Like other tools, an eprommer has to be used properly to avoid damage, and soldered eproms usually need to be desoldered (install a socket in its place) to backup ("dump") them. But it is worth the effort because once data fade away, you can simply "burn" the original files back into the eprom. For general eprom info read websites about arcade machine collecting. Without working roms the keyboard stays scrap, so when the last rom has died before anybody dumped it, the final place to dump it will be solely a dumpster.

Even more annoying is that sometimes instead of (long lasting) ROMs PROM chips were used, of those certain types are simply eproms without window (to reduce cost) and so have the same limited data lifespan. These look like ordinary ROMs and can be only identified by their printing on the package.

The strongest hint that an IC has been programmed after manufacturing (i.e. contains PROM, EPROM or flash memory) is when it has a custom type sticker glued over the actual printed label (unless the sticker is about the device and not the IC). Suspicious is also when an IC has printing in several different colours (or other ink differences), which hints that the chip type number was printed during production and later a software number was stamped on after the chip was programmed (but it also can be a serial number or clock frequency rating stamped on only after passing a quality check). Also when an IC (despite it has no window) has the type number of an eprom or of a known mask ROM type with an additional 'P' in it, this hints for a PROM.

Normal (mask) ROMs often have the same pinouts like eproms and so can be also read with an eprommer. How ever sometimes there are little differences like inverted or swapped "chip select" or "output enable" pins (to ease multiplexing or as stupid copy protection) those make the rom appear empty and so may need some testing with adapter sockets and different combinations of 0V and +Vs to find the right one. Many roms have an open-collector data output that strictly needs external pulldown resistors. When read without (my Willem PRO4 isp eprommer contains none), due to internal capacitance the data signal on oscilloscope will resemble falling sawtooth waves and cause a bad dump. E.g. the bus in my Casio MT-800 rom has a resistor array (bus terminator), so I had to make an adapter socket with a 22 kOhm resistor against GND at each data line to read it reliably. The presence of pulldown or pullup resistors at data lines in a device can hint that the rom needs them to be read properly. Particularly the Casio keyboard ROM types NEC D23C64EC (aka Hitachi HN61364P) and NEC D23C256EC (aka Hitachi HN613256P) need pulldown resistors. Another point of confusion is that many ROMs simulate the pinout of higher capacity types, having large address space areas left blank. So they need to be read as a larger eprom type to prevent garbled data. E.g. the D23C64EC is a wannabe 27C256 with only 8KB. Its additional 3 OE lines simulate higher address lines of the 27C256 to place the 8KB block within the 32KB address space of the latter. So by pinout it has to be read as a 27C256 (not 27C64 as the size suggests!). The OE lines can be partly inverted by the manufacturer to determine the placement of the 8KB block; the rest is "00", so by the open collector architecture (or "open drain" in FET technology) several of these or other ICs can share the bus without additional control lines so long their non-zero output address areas are different. The D23C256EC is the genuine 32KB version of it. If you want to replace any of these with eproms, you may need to insert a diode into each of the 8 data lines from the bus to the eprom D0..D7 to simulate that open collector behaviour. Also NEC UPD23C2001ECZ (Bontempi BT909) reads as a 27C040 with 2nd half empty. (The open collector bus may be even one reason why so many circuit-bent Casio keyboards survive shorting random data and address lines of the bus with each other, because there will be no excessive currents when active bus lines pull voltage only to +Vs while the only thing pulling down to GND is the resistor. Modern fast computers pull in both directions and use additional handshake lines to prevent data collision.) With "HN613..." roms the software number seems to be the 3 digit code below the type number; the 3 digit code above it may be a kind of serial number. My Casio MT-800 and MT-85 have the same rom contents and only the top 3 digits differ, while my CZ-230S contains 2 HN613256P with different contents and only different bottom number.

Unlike eproms, the chip select or -enable lines of certain old ROMs need to be pulsed (clocked) during each new address to make internal input buffer latches pass a valid address into the circuit. A simple way to achieve this is to make an adapter for an eprom type with as many more address lines as CS/CE lines exist and use them as address inputs. This way the content will appear somewhere in the (larger) address space of that eprom type while the rest will be "00". (D23C64EC seems to work this way.) Use a hex editor to remove empty space when needed. With certain such roms also the CS/CE pin may need different timing, i.e. the rom reads the address edge-triggered only during the begin or end of a pulse on that pin. If the address voltages have not stabilized at that moment it will read a wrong address and so output wrong data. A 10 kOhm pulldown resistor from CE (active low) against GND can prolong the pulse which is claimed to help with 2364 ROMs. Sometimes simple discrete analogue components can help to fix timing problems. You may e.g. delay a CE pulse by inserting a resistor (e.g. 10 kOhm) into its line (which makes the chip internal capacitance slow down the voltage change). Also a tiny coil in series or a capacitor of some pF against GND may delay it when an IC has a particularly odd behaviour. Also small supply voltage changes or a stabilizing capacitor from the Vcc pin to GND may help to tweak timing.

With special pinout ROMs also additional address lines in odd places can complicate to read it completely. (Checking the original PCB traces may help.) By replacing original ROMs with a customized eproms it e.g. can be possible to replace samples or even edit the machine code to change the behaviour of a keyboard. ROM backups can be also suited to write an emulator or at least extract samples. Certain ROMs (e.g. reported from Roland keyboards or arcade games) may contain copy protection that outputs garbage data (pseudo random numbers, often as regular looking textures) when e.g. an address is read that by design is not supposed to be read by the keyboard itself, but strange repeating textures typically hint that the IC simply needs pulldown resistors at the data lines to prevent crosstalk from address lines.

In 1980th Casio keyboards mask roms often begin with "D23" or "HN62", proms or eproms with "D27" and rams with "D43". But even when a digital keyboard has separate ROM, this does not mean that its sound samples are in it. E.g. early Casios with PCM percussion had dedicated percussion ICs "OKI M6294-xx" ("xx" is the software number) those contain sample rom with integrated DAC to output percussion samples only as analogue audio. Also some Bontempi relatives had such percussion ICs. By my observation Chinese "no-name" tablehooters (neither Medeli nor Yongmei relatives) generally contain no external ROMs. The only exception seem to be prototype or pre-mass-production specimen (e.g. from a trade show) those have a separate flash rom connected to their special CPU.

If you desolder an IC for dumping its rom contents, if any possible install a socket instead of soldering it back in. This avoids additional heat stress to the chip, makes it replaceable/ reprogrammable in case of failure, and not least especially with non-standard parts there is a chance of about 1/3 that you will first get a bad dump (by wrong pinout, voltage or timing problems etc.) which will make it necessary to remove and dump it again. Dumping a rom without removal is normally not reliably possible; you would need to stop the CPU and prevent all other ICs from blocking the bus, which needs detailed analysis of the situation. So unless it is a tiny SMD package that you can not handle, it is safer and more reliable to carefully desolder the chip. (But do not overheat it. If the package feels too hot to touch fo 10s, let it cool down before you continue soldering.) For DIY with desoldered DIL ICs (especially for making adapters) cheap spring contact sockets are better suited than laced expensive ones; the latter tend to break chip pins and get clogged when there is solder or other debris in the way. Spring contacts can be easily bent apart to remove debris, bent tighter when too loose and you can even detach and replace damaged contacts. The only benefit of laced ones is that they are slightly flatter.

 

[CYBERYOGI =CO=Windler]

On Samstag, 20. Februar 2016 at 2:39 PM, Jokeyman123 said:

Really good technical information, Cyberyogi. I have a question re your post here. How do you dump the contents of a ROM chip? I often work on equipment at the chip level (I have 4 inoperative units right now I'm troubleshooting-not Casio) and problems seem to be in the OS chips-some Yamaha stuff. I am familiar with eeprom burners (costly) and eeproms and proms although I've never invested in an IC burner (so far).  Would be helpful to me as a troubleshooting tool, and just for my own knowledge. Thanks in advance.

Something else. How old are those 4 Yamahas with faulty OS ROM?

Did the problems occur in classic (up to 1990th) Yamaha keyboards or modern models containing flash rom (with firmware upgrade mode)?

Unprotected flash roms are infamous as the natural enemy of circuit-benders, but it would really suck if classic Yamaha keyboards have started to die of bitrot now. Are also small (PortaSound) and home keyboards affected, or only professional synths? (Due to lower manufacturing quantity, pro stuff was more often equipped with prom/eprom memory, and also earlier got writeable memory to store user settings.) My newest Yamahas are likely a PSR-230 (with MusicCartridge slot), a DJX and a PSS-7 toy keyboard from 1990th.
 

[Jokeyman123]

Drum modules-DTXtreme and DTXtreme iis newer version. Both looked to have "pooched" their OS but are otherwise electronicslly complete-no bad connectors, backup batteries etc.  I think dates from after 1990. And an old QY70 module-these all have socketed ROMs (I think these are ROMs-Yamaha hasn't been much help. This is a Casio forum, sorry if I 'm getting too much into other "stuff". I love Casio, but Yamaha has been unavoidable in my world too.

[CYBERYOGI =CO=Windler]

About modern Yamaha drumkits I know nothing. My only Yamaha drum machine is a DD-10 with 2 velocity steps.

Does the QY70 need internal batteries to hold sequencer data, or was it blessed with the eh "progress" of flash memory to hold user data without? 

http://www.synthmania.com/qy70.htm

quote from there: "To initialize the QY70 to factory specs, turn the unit on while pressing the "OCT DOWN", "OCT UP" and "1 F# Gb" buttons at the same time."
 

[Szo]

Quote

The behaviour of 'wave' depends on the preset sound.

I find out that in some presets it change the shape of the wave, and in another presets it change one of the two PCM (?) component samples of the tones. I didn't yet found a pattern of this behaviour but it can be used similar to layer function. Especially when combined with pan.

I agree that it's a shame there is no modulation/vibrato settings, but i found out it responds to mod wheel via midi.

 

Quote

Does the QY70 need internal batteries to hold sequencer data

QY70 as far as i know (i've selled it some time ago) has the internal battery CR 2032 or similar.

 

Edited February 9, 2022 by Szo

[pianokeyjoe]

@CYBERYOGI =CO=Windler"The only special behaving preset is 'synth-lead 2', which stays always monophonic with portamento, which hints that there are many hidden synthesis parameters". THAT is the sound I love best of the CTK1000! I heard it as well in the XW series.. same hardwired Portamento too though! No way to get rid of the portamento? Or reduce the glide? in the CTK or the XWs??

[CYBERYOGI =CO=Windler]

By the way, I have added some PCB photos of CTK-1000 in this thread: