goto section page goto youngmonkey main page make contact, e-mail

Yamaha TX-16W Technical Info
Advertising Space Available


0.      Introduction
1.      Overview of the TX16W
2.      Memory map of the TX16W
  2.1     Overview
  2.2     SYSRAM:       System RAM (128kB)
  2.3     ROM:          System ROM (16kB)
  2.4     TGBD:         Tone generator board memory and I/O space
  2.5     DM:           68000 Motherboard I/O ports
  2.6     Some asynchronous ports (old 800kHz bus circuits)
  2.7     WRAM:         Wave memory (1.5MB .. 6MB)
3.      Interrupts
4.      T8WSYS.SYS      File format
5.      Hello world, a programming example
6.      The disk format (low level)
7.      Yamaha Wave format

0.0 Introduction

The TX16W is indeed a powerful sampler with its 16 voices, its digital filters
and its ability to produce high pitched notes with remarkably low distortion.
It is also remarkable that nearly all chips used in the design are standard
industry circuits. This makes it possible to analyse the design and make your
own programs that makes your TX16W into a standard midi file player, a midi
dump to file converter, a small audio effect processor or a telecomunication
modem! As far as I know noone has done any of the mentioned things yet and
I'm sure there are more ideas out there about what to do of this excellent
piece of hardware.

This file contains the results of my own studies of the circuit diagram
of the TX16W. Some are verified experimentally and some are yet to be tested.
I have tried to put comments where I'm not 100% sure. I hope that someone will
find this information useful and that we will see some interesting utility
programs for the TX16W pop up on internet in the future. I am interested in any
experiences from programming the TX16W, so if you have anything to add to this
text, or if you discover any errors, or if you can confirm that something is
correct, please let me know. I will try to update this list when new experiences
are added.
I would be very glad if the Typhoon guys could fill in the gaps in this
information concerning the GEW chip and the ADF chips. I have tried to make
Yahama send me papers on this but without success. I don't see any other
way than to analyse the old OS and try to figure out how it works, which is
a terrible lot of work. I understand that Magnus, the typhoon hacker, has
done this. Please take the time to share this knownledge with us!

What you need to program the TX16W is:
- A 68000 cross assembler for the system you are using (GNU macro assembler
  should be just fine even though I haven't used it)
- A 6809 cross assembler if you are going to use the real time digital filters.
  (There are such assemblers on the net too, ask in the newsgroup comp.sys.M6809
  for example)
- A system to compile on with 3,5" disk drive capable of writing 720 kB
  MSDOS format. (I myself use a PC-compatible)
- Knownledge of programming 68000 assembler (and possibly 6809 assembler if
  you want to use the filter circuits)

The functions I have tested are the following:
- Floppy disk operations
- LCD display
- Buttons and lamps on the front panel

I haven't used the following devices:
- MIDI and RS422 ports (This is not very difficult though)
- The 6809 microcontroller
- The Sound and filter circuits
- The sample input

In this first version I haven't included information on many standard industry
chips. This info can be ordered from the manufacturer (for free in most cases)
If someone is interested, I can add info on how to program the serial ports,
the floppy controller and the LCD in the next update.

1. Overview of the TX16W:

The most important chips inside the TX16W are:

- The 68000 CPU         This powerful microprocessor has the overall control
                        of the system. 8 MHz
- The 68B09E CPU        This microcontroller controls the digital filter
                        circuits in real time. 2 MHz
- The YM2409 GEW        This special Yamaha chip generates all the voices
                        from the wave memory
- The two YM2412 ADF    These chips are also specially designed by yamaha
                        and they perform the real time filtering
- Floppy circuit        Western Digital 1702 (though I'm not precisely sure)
                        It is however not possible to install
                        an 1.4 MB drive, since the floppy circuit
                        only can handle 720k such.
- RS422                 Maximum (theoretically) speed is 1 MBit/s.
                        In practice 150 KB/s due to the speed of
                        the 68000 processor.

The heart of the TX16W is the 68000 microprocessor. There are two CPUs in TX16W
but the 68000 performs all tasks except control of the digital filters, which
is performed by the 6809 microcontroller. The system program which is loaded
from disk by the boot ROM must be written for 68000 (for further information
about the file format of T8WSYS.SYS, see the separate section on this).

The following figure is an overview of the TX16W. The boxes represent different
functional blocks, for example a CPU, a communication chip or the LCD display.
The blocks are further described below.

 EXT     Sample        Floppy      MIDI       EXT.COM
 TRIG      in           drive      In/Out      In/Out
  v         v             I          I           I
  v         v             I          I           I
  v   v<<<<>>>I  ADF   I
  I   I    I 64kB I   I 63B09 I   I        I    I        I
  I   I    ----x---   ----x----   ----x-----    ----x-----
  I   I        I          I           I  V          I  V
--------  -----x----------x-----------x-------------x- V
I  Bus I           6809 Address/ Data/ Control bus     V
I Ctrl I  -------------------------------------------- V
--------                                 V             V
                                         V             V
                               --------------     ----------
                               I Individual I     I Stereo I
                               I    Out     I     I   out  I
                               --------------     ----------

68000 CPU:      The 68000 microprocessor is manufactured by Motorola and is a
                16 bit processor which (in the TX16W) runs at 8 MHz. This
                powerful processor is also the heart of computers like
                Macintosh, Amiga and Atari ST, and information about how to
                program it is widely spread.

A/D converter:  This is actually a large block of standard logic and a D/A
                converter. The resolution is 12 bits.

FDC:            (Floppy disk Controller) The WD1772 chip controlling the disk
                drive. The full name is WD1772PH-2 and it is manufactured by
                Western Digital. (This chip can also be found inside an Atari
                ST computer, info on how to program it can be found in most
                atari ST programming references)

UARTS:          The HD63B50 chips controlling serial input/output via MIDI and
                RS422. (It works exactly as the 6850 chips found for example
                inside an atari ST. The 6850 is manufactured by Motorola).

LCD:            The text screen. The full name is DMC40267UV-YGR, however I
                have programmed it using a datasheet on a display called
                LM40255M and it seems to work exactly the same.

switches and LEDs: The buttons and lamps on the front panel.

ROM:            The 16kB EPROM containing the bootstrap sequence

SYSRAM:         The 128kB working memory of the 68000

WaveRAM:        The 1.5 .. 6 MB wave memory RAM

Bus Arbiter:    Shares the WaveRAM between 68000 and the voice generation
                (GEW) chip

GEW:            The digital chip producing the output sound, specially designed
                by Yamaha and named YM2409.

63B09E CPU: (same as 6809E)
                This is the CPU that controls the digital filters. It is a
                8-bit microcontroller designed specially for shared memory
                systems. It is manufactured by motorola and runs at 2 MHz
                clock speed.

FRAM:           (Filter RAM) The 64 kB working memory of the 6809 processor

ADF:            (Advanced Digital Filter) The digital filter circuits,
                designed by Yamaha and named YM2412.

Individual out: A separate circuit board with the individual out D/A converters
                and LP filters

Stereo out:     The stereo D/A converters and LP filters.

2.1 Memory map for the 68000, Overview:

Address range           What's there
--------------          ------------
000000..01FFFF          SYSRAM: System RAM 128kB
040000..043FFF          ROM: System ROM 16kB
080000..0BFFFF          TGBD: Tone Generator board memory and I/O space
0C0000..0FFFFF          DM: Digital Motherboard I/O-ports
100000..17FFFF          Some asynchronous I/O-ports
800000..FFFFFF          Wave memory (8Mb)

Maybe someone thinks it is odd that there is RAM at address 000000. The
68000 processor always starts reading from address 000000 after reset, so
the reset vector must be at this location.
The answer is that the memory map listed above does not apply at bootup,
beacause the ROM memory is swapped into the space 000000..003FFF by
hardware when a reset is forced (for example at power up). However Yamahas
ROM program switches this back almost immediately and there is no way to
change it again except by forcing a reset, so you don't have to think about
this unless you are reprogramming the ROM (This can be done though, it is
just an ordinary 16kB EPROM which is easy to remove and replace)

The wave memory takes 8Mb of address space even though it actually contains
only 6Mb. This is because only 12 of the 16 databus bits are used.

Someone might notice that there are a lot of "holes" in the memory space.
This is actually not true, the memory locations are "mirrored" and fills
up allmost all the space. For example the ROM memory of 16 kB can be found
at addresses 040000, 044000, 048000, ... , 07C000. Thus there is not much
room for adding more hardware stuff or memory (at least not without modifying
the circuitboard). There are some true holes though:

180000..1FFFFF          512 kB of free memory area
380000..3FFFFF                   ""
580000..5FFFFF                   ""
780000..7FFFFF                   ""

Hardware wizards are welcome to use these addresses. VPA is generated
automatically for these areas though, so as I understand it the transfer must
be synchronized to the E-clock (800kHz) which limits the transfer speed.

2.2 000000..01FFFF          SYSRAM: System RAM (128 kB)

This is where programs execute. The system program T8WSYS.SYS is loaded into
this memory by Yamaha's boot ROM. This memory is fast, there are no wait states,
except at some rare occasions when refresh is performed by the hardware.
The type of memory is "Pseudo-static" which means that it is dynamic memory
with internal refresh counter (The memory chips are called HM65256BSP-12).

2.3 040000..043FFF          ROM: System ROM (16kB)

The ROM contains only a simply boot-
strap that loads the file "T8WSYS.SYS" into memory and starts it. The
actual drive routines are located in system RAM and they are NOT that easy
to comprehend.

In this area you will find Yamaha's Boot ROM. I haven't examined all of it,
but it seems to contain some hardware tests and initialisation plus the floppy
boot sequence and nothing more. Because this memory is rather slow (there are
several wait states) the first thing that happens at bootup is that the contents
of the ROM is copied into SYSRAM at address 018000. So most ROM routines are
written to execute in RAM, so don't try to call them at the ROM address (if
you would find any useful procedures, which I haven't). If you want to exchange
the EPROM, use a 16 kB, eight bit EPROM, those chips are usually called 27128
or something like that.

2.4 080000..0BFFFF          TGBD: Tone generator board memory and I/O space

This area contains all memory and I/O ports of the tone generator circuit board,
except the wave memory.

080000..09FFFF  R/W     FRAM: Filter circuit RAM (64kB)
                              This memory is the RAM memory which the filter
                              controller circuit 63B09E uses for programs and
                              data. When accessed from the 68000 processor
                              only even addresses apply, odd addresses are not
                              connected. This is why the address space is 128kB
                              even though the memory is only 64kB large.
0A0000          Write   MGEW: Control register 1 of the voice generator (GEW)
0A0002          Write   MGEW: Control register 2 of the voice generator (GEW)
                              It seems that these registers can only be written
                              to, not read. I do not know anything about the
                              format of the commands that apparently must be
                              written here, but this is where the sound
                              generation is controlled !!! Only the lowest
                              byte of the databus is connected.
0A4000          Write   SCCNT: "Halt filter controller" write register
                        Bit0: 1 asserts the halt input on the 63B09E micro-
                              controller that controls the filters. The halt
                              input is asserted until a 0 is written in this
                        Bits 1..7: Not connected
0AC000          Write   GABC: ??? I don't fully understand this register.
                        Bit0: EGOFF: A logical 1 in this bit makes the
                              wave memory inaccessible from the GEW which
                              increases the transfer rate between the 68000
                              and the wave memory. 0 in this bit means
                              that the wave memory bandwidth is shared between
                              68000 and the voice generator (GEW) and this is
                              of cource necessary for any sounds to be produced.
                              I have confirmed this with a test program. The
                              results are in the section on WRAM.
                        Bit1: 1 in this bit enables the eight individual outputs
                              and 0 means that stereo outputs should be used.
                              Of some reason one of the two filter circuits is
                              bypassed when this bit is 1. Why ???
                        Bits 2..7: Not connected

2.5 0C0000..0FFFFF          DM: 68000 Motherboard I/O ports

This space contains some I/O ports that use the fast 68000 memory bus
Most ports use only the lowest byte of the databus, those can be read/written
either by a byte access to the given address or a word access. In the latter
case the lowest byte contains the byte read.

Warning: By the way, there is a serious error in the text I wrote concerning
I/O port read/writes. If you read/write bytes you have to add 1 to all
addresses. I only read/write words and (using the lowest byte), and then
there is no problem. Sorry about that!

  0C0000        Read    ADC: reads analogue sampling input
    Bit 0 :               1: Left sample, 0: Right sample
                             (doesn't apply at mono sampling)
    Bit 1 :               1: Sample is available, 0: Sample is not ready
                             (you should poll this pin!)
    Bits 2..3:            Always 0
    Bits 4..15:           A/D value

I'm not quite sure how this works. It seems that a read initiates an
Analogue to digital conversion and also reads the results of the previous one.
Also I don't know if the read word is in 2-complemented form, or if it is
an 11 bit integer with a sign bit, but that should be easy to test.

  0D0000                PNL: Front panel buttons and LEDs.
    0D0000      Read      PSW1: Read button group 1 (0 means button is pressed)
      Bit0:                 "1"
      Bit1:                 "2"
      Bit2:                 "3"
      Bit3:                 "-1"
      Bit4:                 "0"
      Bit5:                 "<"
      Bit6:                 ">"
      Bit7:                 "Enter"
    0D0002:     Read      PSW2: Read button group 2 (0 means button is pressed)
      Bit0:                 "7"
      Bit1:                 "8"
      Bit2:                 "9"
      Bit3:                 "-"
      Bit4:                 "4"
      Bit5:                 "5"
      Bit6:                 "6"
      Bit7:                 "+1"
    0D0004:     Read      PSW3: Read button group 3 (0 means button is pressed)
      Bit0:                 "Perform select"
      Bit1:                 "System setup"
      Bit2:                 "Performance edit"
      Bit3:                 "Voice edit"
      Bit4:                 "Filter edit"
      Bit5:                 "Wave edit"
      Bit6:                 "Sample"
      Bit7:                 "Utility"
    0D0010:     Write     Write LED (0 makes the LED turn on)
      Bit0:                 "Perform select"
      Bit1:                 "System setup"
      Bit2:                 "Performance edit"
      Bit3:                 "Voice edit"
      Bit4:                 "Filter edit"
      Bit5:                 "Wave edit"
      Bit6:                 "Sample"
      Bit7:                 "Utility"

The LEDs are funny and easy to play around with! My first program (that worked)
contained a loop which incremented a register and copied the highest byte
to the LEDs. Try it, and you'll notice the speed of the 68000!

  0E0000:       Read    FSW: Read foot switch and detect floppy disk
    Bit0:                 DSKC: If 1 then the disk has been ejected during
                                the current disk operation (?)
    Bit1..6:              Not connected
    Bit7:                 Foot switch input

I'm not 100% sure of the function of bit 0, but it is connected to the floppy
drive. The pin is named DSKC in the circuit diagram and is active low.

  0F0000:               ATT: Some miscellaneous I/O ports
    0F0000:     Write     LVOL: Left channel volume in lowest byte (unsigned)
    0F0002:     Write     RVOL: Right channel volume in lowest byte (unsigned)
    0F0004:     Write     SRT:  Write various hardware settings
      Bit 7                 MONI:  Sample input is mixed with the stereo
                                   outputs if this bit is set to 1.
      Bit 6                 TRIG:  The trigger input is disabled if this bit
                                   is set to 0
      Bit 5                 SH16K: 16kHz LP-filter is enabled if this bit is
                                   set to 1
      Bit 4                 FREQ:  33kHz stereo LP-filter is enabled and double
                                   (stereo) sampling rate is selected if this
                                   bit is set to 0
      Bit 3                 SH50K: 50kHz LP-filter is enabled if this bit is
                                   set to 1
      Bits 3..0:            Selects Frequency or sampling speed, I haven't
                            figured out how this works yet, but the higher
                            number the higher speed it seems. Note that bit 3
                            has another function too (see above)!
    0F0006:     Write     BRT: Sets some features of the RS422 interface
      Bits 7..4             Not connected.
      Bit 3                 Selects configuration: 1=Terminal, 0=Controller
      Bit 2..0              Selects clock rate (has no effect if bit 3 is 1
                            (terminal) because the clock rate is then determined
                            by the attached (controller) device)
                            0: 19,2kHz
                            1: 38,4kHz
                            2: 76,7kHz
                            3: 153kHz
                            4: 307kHz
                            5: 614kHz
                            6: 1,23MHz
                            7: 2,46MHz
                            This frequency is internally divided by 1, 16 or
                            64 by the UART chip to form the baud transfer rate.

An interesting "feature" is that software can enable more than one filter at
the same time. The result is that the outputs are mixed together (... perhaps
not very useful ...:-)

It seems to be possible to have transfer rates of up to 2.46 Mbaud !!! But
maybe the 68000 can't read the data stream at that speed ...

2.6 100000..17FFFF          Some asynchronous ports (old 800kHz bus circuits)

In this area you will find the LCD display, some miscellanous ports and the
two 63B50 (same as 6850) UARTs used for RS422 and MIDI communication aswell
as the WD1772 floppy disk interface circuit. An interesting thing is that both
these chips can be found inside an Atari ST computer and you will find all the
information on how to program them in any good atari-programmers-handbook.

  100000        R/W     LCD port command/status register.
  100002        R/W     LCD port data read/write register

If you read 100000 you get a status byte from the LCD display. Writing
to this address initiates a command to the LCD display. The LCD is called
DMC40267UV-YGR and is produced by DMC systems incorporated, I think. They
will probably send you the datasheets (with info on the meaning of status
bits and the command format) for free if you phone them up (I did that).

  100020        R/W     FDC port command/status register
  100022        R/W     FDC port track register
  100024        R/W     FDC port sector register
  100026        R/W     FDC port data read/write register

The floppy disk controller (FDC) is called WD1772PH-02 and is produced by
Western digital. As with the display, the manufacturer will most certainly
give you the information you need to program it if you call him up. As
mentioned before you can also look in any atari programmers reference book.

  100040        Write   FDD port
    Bit7:                 Side select (0 or 1)
    Bit5:                 Select drive 2 (1 to select)
    Bit4:                 Select drive 1 (1 to select)

Drive 1 is the one to select (because there is only one drive present)
Apparently it is possible to connect another drive, but the 1772 does only
work with 720 kB disk drives (not 1.44 MB) so I can't see any purpose of
connecting more disk drives. I have heard of pin compatible chips that
handles 1.44 Mbyte drives though. Maybe this chip can be replaced?

  100060        Read    Timer reset

A read at this address acknownledges a timer interrupt (which occurs every
2.56 ms) and must be performed by the timer interrupt handler (see the info
on interrupts). No data are read.

  100080                MIDI UART Command/Status port
  100082                MIDI UART Data read/write port

  1000A0                RS422 UART Command/Status port
  1000A2                RS422 UART data read/write port

Both MIDI and RS422 are handled by 63B50 chips as mentioned above. They are
produced by Motorola and are used in a number of other systems, including
the ATARI ST as mentioned.

2.7 800000..FFFFFF          WRAM: Wave memory (1.5MB .. 6MB)

This memory is the four banks of dynamic ram memory used for storing the
sample waves. It is not as fast as the SYSRAM because it is shared with the
voice generator chip (see also the info on I/O port 0AC000 bit 0) as well as
refresh logic. The word size of the memory is 12 bits which means that a word
read/write operation from the 68000 produces the following result:

        68000 data bus  WRAM data
        --------------  ---------
        Bits 0..3       Not connected
        Bits 4..15      Bits 0..11 of wave ram word

Byte write operations are not supported! If you try to write a byte, the
other byte in the word you are accessing will be cleared!

The memory chips are called TC511000J-12. Any 120ns (or less), 1Mx1bit dynamic
memory chips should be OK to use if you want to expand your memory yourself.

The WRAM memory is somewhat slower than the PSRAM memory when accessed by the
processor. According to a test program I made, each access to the WRAM memory
takes about 7 clock cycles (0.873 us measured) more than the same access in
PSRAM, or 10 clock cycles (1.26 us measured) if bit 0 of port AC000 is 1.

3. Interrupts

The 68000 interrupt levels are the following:

  Level 1:              Timer           (Lowest priority)
  Level 2:              MIDI
  Level 3:              RS422
  Level 4..7:           Not connected

Timer interrupt:
This interrupt is produced every 2.56 ms by hardware according to the circuit
diagram. The interrupt signal comes from a divide-by-128 counter which in
turn is connected to an output named SYW from the GEW (voice generator) chip. I
don't know what this is or if it can be turned off by programming the GEW, but
the timer signal is marked "2.56m" in the circuit diagram, and I have verified
that it is normally asserted every 2.56 ms. The interrupt input is asserted until
the interrupt service routine acknownledges the interrupt by reading the
address 100060.

MIDI and RS422 interrupt:
These interrupts are generated by the 63B50 UART chips. Software can program
these chips to generate interrupts when a character has been recieved and
optionally also when a character has been transmitted.
At higher baudrates (RS422, more than say 200 kBaud) it is wise to turn off
all interrupts and poll the port instead, because otherwise data may be lost.

4. T8WSYS.SYS   file format

You can use this format of the T8WSYS.SYS file to make it boot your program:

WORD            Contents
----            --------
0,1             Long word (32bit) offset to the code entry point of this
                file. This is where you put the address to wherever you want
                execution to begin (relative to the start of the file).

2,3             Long word (32bit) length of the t8wsys.sys file.

4, ...          Code and Data

The file seems to be loaded at address 000400 (hex), at least with my BIOS

To generate the two first longwords I have made a small C-program for my PC
that converts motorola standard output file (that is the output format of my
68000 compiler) to the t8wsys.sys format. I will send that to anyone
interested, just send me a mail.

5. Hello world, a programming example

This is a short example of a program that prints the text "Hello World" on
the LCD screen.


 NAME hello_world
 TITL 'This program prints  on TX16W'

* Some status and command codes and addresses for the LCD
lcd_clear =     $1
lcd_busy =      $80
lcd_instr =     $100000
lcd_status =    $100000
lcd_data =      $100002

 rseg main

* This is the programs entry point. The offset to this position in the
* t8wsys.sys file must be in the first longword of the file.

 bsr    F_LCDclr
 pea    text(pc)
 bsr    F_LCDprint
 addq   #4,sp

* Eternal loop! This is where you have to turn off and reboot the TX16W.
 bra	   suicide

* This procedure clears the LCD-screen, positions cursor at upper left corner
* and restores all display shifts.

 bsr.s     F_LCDwait
 move.w    #lcd_clear,lcd_instr

* This function waits until busy-flag goes low.

 move.w    d0,-(a7)
 move.w    lcd_status,d0
 and.w     #lcd_busy,d0
 bne.s     wait_loop1

 move.w    (a7)+,d0

* This procedure prints a string to the current cursor position.
* !!! String must be NULL-terminated.
* Uses:
*       F_LCDputc
* Parameters:
*       L : Address to string.

 move.l    a0,-(a7)
 move.l    8(a7),a0
 bsr	   F_LCDwait
 move.b    (a0)+,d0
 beq.s     print_eos
 move.w    d0,lcd_data
 bra.s     print_loop1

 move.l    (a7)+,a0

 dc.w	   'Hello World',0



This is the uu-encoded compiled file (92 bytes long). Just uudecode it and
copy it to a TX16W formatted disk and boot your TX16W with it.

begin 644 t8wsys.sys


6.0 The disk format

The physical format of a TX16W disk is:

*       80 Tracks
*       Double sided
*       Double density
*       9 sector per track and side
*       512 bytes per sector

Each track concists of the following:
(All values are in hex, nnxmm means nn repeated bytes of mm)
        Gap 1:          Ca 82x4E

        Nine sector groups containing:
                Gap 2:  0Cx00

                Index:  01xFE           (Index)
                        01xTrack nr     (0 - 4F)
                        01xSide         (0 or 1)
                        01xSector       (1 - 9)
                        01x02           (Sector size 512 bytes)

                Gap 3:  16x4E

                Data:   01xFB           (Data mark)
                        200x00          (Actual data!)

                Gap 4:  36x4E

        Gap 5:          Ca 200x4E       (Until next index pulse)

Each CRC-Null byte is written as F5 (hex) when formatting, while the
doublet of CRC-Sum bytes is written F7 (hex). (Thus one F7 byte creates
two CRC bytes on the disk!)

To format a disk you use the "write track" command of the floppy controller
chip and write the above data. After that you write the correct information
to sectors 1,2 and 5 as described below, using the "write sector" command.

There are two sectors on track 0, side 1 that can't be accessed (a
primitive copy-protection !?). The secret is simply that the sector
number 0 has been written in the index field of those two sectors!
This must be done for Yamaha OS to accept the disk.

The logical disk format:
*       MSX-DOS (very close related to MS-DOS and Atari-DOS)
*       12 bit FAT

1.) Sectors 1/2 on track 0,side 1 are both renumbered as sector "0". The
    TX refuses to operate if it cannot find a sector "0" on this
    track. The cluster that is lost by these sectors is marked bad in the FAT.

2.) The disk has two FATs ( File Allocation Tables ), but the TX reads and
    writes only the first one. This is the reason why a TX disk is unreadable
    by an Atari ST computer, which usually uses the 2nd FAT.

You can read and write the disks on IBM compatibles, Amigas,
Macintoshes and Ataris (with standard MSDOS emulators).

Sector 1 is the Bootsector containing information about the
disk format and a small bootstrap program. The disk format is contained in
the BPB (BIOS Parameter Block) which starts at position 0B (hex) in
sector 1.

BPB valid entries: (Offsets are from BPB start at offset 0B in sector 1)

 Offset:        Value:          MS-DOS value    Meaning:
 00             0200            Same            200 bytes per sector
 02             02              Same            2 sectors per cluster
 03             0001            Same            Number of reserved sectors
 05             02              Same            Number of FAT copies
 06             0070            Same            Maximum nr of root directry entries
 08             05A0            Same            Total nr of sectors on disk
 0A             FE              FD              Media descriptor
 0B             0003            0002            Nr of sectors per FAT
 0D             0009            Same            Nr of sectors per track

Sectors 2-4 contain the first copy of the 12-bit FAT.
Sectors 5-7 contain the second copy of the 12-bit FAT.

FAT format:

  The FAT keeps track of the use of all clusters on the disk and how they
  are chained together. Each FAT entry is 12-bit long. It works like this:

  Two entries: (Three bytes)    AB CD EF
        First cluster entry:    DAB
        Second cluster entry:   EFC

  Meaning of a FAT entry:       000             Not used
                                002..FF6        Pointer to the next cluster
                                                in the chain
                                FF7             Bad cluster
                                FF8..FFF        Last cluster in chain

Sectors 8-14 contain the root directory ("almost" MSDOS compatible)

Clusters 0 and 1 are reserved and cannot be used. Cluster 2 is marked
bad in the FAT (the bad sectors 15 and 16). Cluster 3 - 714 can be used.
Thus, the first three FAT entries of a formatted disk contain FF9, FFF, FF7,
which means that the first six bytes contain F9,FF,FF,F7,0F,00.

Copy protection on Yamaha Disks ********************************************

The protection on the files is done by changing the 7th byte.  The first couple
bytes of a protected file look like:

  (character):          L  M  8  9  5  3 02               
  (hex):               4c 4d 38 39 35 33 02

The 7th byte is usually a "02" or "01".  To unprotect, change this byte to 0.
Some disks have protection on the setup files only; others, the wave files as

This c code will change the 7th byte to 0:

     main(argc, argv)
     int argc;
     char **argv;
	     FILE *music;
	     if (argc != 2) {
	     if (!(music = fopen(argv[1], "r+b"))) {
		     printf("can't open %s\n", argv[1]);
	     fseek(music, 6L, SEEK_SET);
	     putc(0, music);

7.0 TX Wave Format:

The file consists of a 32 byte header followed by the actual waveform
(the first 16 bytes only identifies the file type).  In C syntax the
header would look like this:

char filetype[6] = "LM8953";
char nulls[10];
char dummy_aeg[6];    /* space for the AEG (never mind this) */
char format;          /* 0x49 = looped, 0xC9 = non-looped */
char sample_rate;     /* 1 = 33 kHz, 2 = 50 kHz, 3 = 16 kHz */
char atc_length[3];   /* I'll get to this... */
char rpt_length[3];
char unused[2];       /* set these to null, to be on the safe side */

The "atc_length" and "rpt_length" fields are quite complex.  First of
all you should know that there is no such thing as a looping point in a
TX wave.  Instead a wave is split into two parts, the attack part and
the repeat part (of course the actual wave data isn't split, this is
just a logical definition).  As you might guess, the attack part is
played first and the repeat part is looped until the key is released.
Each of these parts are limited to a maximum of 128k words in length.
That is the reason why waves can't be longer than 256k words (4096

The length of a part is stored LSB first (Intel).  And only the least
significant _bit_ of the third byte (bit 0) is used (representing the
most significant bit of the length).

Are you confused yet?  Then hold your breath.  It seems that Yamaha has
chosen to squeeze in the sample rate(!) of the wave in the unused _bits_
of these last bytes.  Although they already have a separate byte for the
sample rate, this isn't enough.  I won't go into details on this now (or
you would be even more confused).  You only need to know that the
possible values are:

  0x06, 0x52 = 33 kHz
  0x10, 0x00 = 50 kHz
  0xF6, 0x52 = 16 kHz

(The first value is located in byte three of "atc_length" and the second
value is located in byte three of "rpt_length".)

To wrap it up, this is the format of the two length fields on a bit

            [0]      [1]      [2]

A = LSB of the attack length
B = MSB of the attack length (except for one bit)
C = the utterly most significant _bit_ of the attack length
D = the first value of the magic sample rate constant (0x06, 0x10 or
E = LSB of the repeat length
F = MSB of the repeat length (except for one bit)
G = the utterly most significant _bit_ of the repeat length
H = the second value of the magic sample rate constant (0x52, 0x00)

Now for the most important (and probably most interesting) part.  The
waveform data.  As you certainly know the TX uses 12-bit sampling
resolution, and this requires some kind of encoding if we are not
willing to waste one fourth of our disk space.  Yamaha has chosen to
group the samples two by two, making three bytes of data in the file for
each pair.  I'll illustrate this on a bit level (as with the lengths


A = MSB of the first sample
B = MSB of the second sample
C = least significant nybble (oh, is that the correct spelling?) of the
    first sample
D = least signiticant nybble of the second sample