back to Korg Zone up

Wavestation Samples dissected

So there was it, my new Wavestation. Of course, I had looked into the service manual way before the machine arrived to notice something interesting:

The TG88 tone generator can address a total of 16MW of sample memory as 16 banks per 1MW using a 4-bit wavebank WB[3:0] and a 20-bit wave address WA[19:0]. Much more than Korg ever equipped any WS with. So what's going on?

Step 1: Wave memory decoding

Instead of making full use of all banks, waveform memory is only split into two major banks:

  • WB3=0 signals access to PCM ROM, Cartridge and (on the AD) the external signal input.
  • WB2=0 signals access to the internal connectors CN16/CN17 only found in the WS and EX (but not the AD; there, WB2 is n/c). A potentially perfect space for hacking in own samples -- assuming that the OS really checks this area. If not, OS hacking is required.
Quite wasteful! Properly decoding this would give 4 pages per 4MW instead of just two.

A page is broken down with the help of WB[1:0] and WA19. Let's treat them in this very order as a 3-bit number and get the following page structure with each part being 512MW (1MB) in size:

PageOffset (W)Offset (B)PCM DataComment
00x00.00000x00.0000classic ROM #1 IC9 on WS/EX, IC8 on AD; MSB only
10x08.00000x10.0000classic ROM #2 IC8 on WS/EX, IC7 on AD; MSB only
20x10.00000x20.0000classic ROM #3 IC7/6 on WS/AD, IC6/5 on AD
30x18.00000x30.0000external signalWA18 separates left/right (only AD)
40x20.00000x40.0000PCM card only WA[17:0], no WA18
50x28.00000x50.0000EX ROM #1 IC5 on WS/EX, IC3 on AD; MSB only
60x30.00000x60.0000EX ROM #2 IC4 on WS/EX, IC2 on AD; MSB only
70x38.00000x70.0000EX ROM #3 IC3/2 on WS/EX, IC4/1 on AD
  • In order to save cost, Korg stored single-cycle and other low-dynamic waveforms just as 8-bit quantities. For these, the LSB value is always 0x00 by hardware.
  • Page 3 is only used in the AD, not the WS or EX (where it is empty). While WA18 separates the audio channels, there's seemingly no stereo wave signal processing in the other pages.

Step 2: PCM data decoding

Now the fun begins. How does the WS access its PCM data? Luckily, I was able to get hold of the EX ROM dumps, so I didn't have to desolder these. (Anyone having a dump of the classic ROMs, feel free to send me the dump for further analysis!).

In case you want to join in, here's the two EX ROM #1 images fused into a single file, my quick and dirty analyzer tool, and an example log.

So let's concentrate on EX ROM #3 which, unlike #1 and #2, is fully attached (all 16 data lines). And, indeed, there we find management data:

Offset Size Data
0x00000 4 "KORG" marker
0x00004 2 Index marker (0x000f for EXROM, 0x001e for WS Classic)
0x00006 10 presumably empty (0x00)
0x00010 8 User-wave reference #1
0x00018 8 User-wave reference #2
(presumed, empty in EX ROM)
0x00020 8 Wave-map reference #1
0x00028 8 Wave-pointer reference #1
0x00030 8 Wave-map reference #2
(copy of #1 in EX ROM)
0x00038 8 Wave-pointer reference #2
(copy of #1 in EX ROM)
0x00040 ... Data area, all samples are 16-bit signed
Offset/Size given in bytes

The 8-byte references hold the following information:

Offset Size Data
0x00 4 Page-based offset to management data
0x04 2 Number of entries in referenced table
0x06 2 Flags: 0x0083 / 0x0059 for classic/EX WaveROM reference (classic / EX set), 0x0000 otherwise

  • Interestingly, the number entry only holds true for references to user-waves and wave maps. For wave-pointer references, not the number of actually present wave pointers is given, but the number of wavemaps is repeated.
  • Page-based offset assumes 16-bit data access, so it's only half of what you'd expect for a byte-sized dump.
  • No idea about the flags yet.

User waves are simple beasts, consisting of just the following:

Offset Size Data
0x00 2 Index to wave map table (start entry)
0x02 1 Wave type:
0x00 (multi-cycle waves) or
0x01 (single-cycle waves / VS waves)
0x03 1 Number of entries (zones) in wave-map table
(0x00 for VS waves)
0x04 10 Name as fixed-size ASCII char array
Offset/Size given in bytes.
  • The VS waves don't have an entry in the wave-map or the wave-pointer list as they follow a simple mapping approach:
    • Single-cycle waves (VS waves) are marked with 0x00 entries in the map table.
    • They reside at the start of ROM #1.
    • Each VS waveset comprises 2427 samples containing 9 individual mipmapped waves of fixed size: 514, 364, 514, 364, 258, 183, 130, 66, and 34 samples; seemingly for the lower 3 octaves there's a half-octave stepping (2^0.5=1.41=514/364=256/183), for the upper 3 octaves there's only full-octave stepping.
    • Indexing hence is simple: zero-based wave no * 2427 + mipmap offset

Wave-map entries are already a little more obscure:

Offset Size Data
0x00 2 Index to wave pointer table
0x02 1 Zone start note as MIDI note number
0x03 1 Flags: seemingly always 0x05
0x04 1 8-bit (presumably signed) quantity
fine tuning? (possibly cents, max values -82 and +97)
0x05 1 MIDI note number;
sometimes higher, sometimes lower than base note.
coarse tuning? (reference key)
0x06 1 Flag, mostly 0x00;
only few discrete values in the [0xdf:0xff] range
ff only as ff/ff, f7 as f7/00 or f7/f6 (see flag 0x07)
0x07 1 Flag, mostly 0x00; only two discrete values (0xf6, 0xff)
0x08 2 Flags, always 0x0000
Offset/Size given in bytes.

Wave-pointer entries, in term, are less of a mystery:

Offset Size Data
0x00 2 Flags, mostly 0x0000; only few distinct values found
(0x0000, 0x0034, 0x03a5, 0x03b7, 0x0600, 0x0981, 0xfa00, 0xfda6, 0xfeed)
0x02 3 Waveform start address
0x05 1 presumed unused, 0x00
0x06 3 Loop start address
0x09 1 Loop flags: one-shot (0x00) or looped (0x04) wave
0x0a 3 Loop/sample end address
0x0d 1 presumed unused, 0x00
Offset/Size given in bytes.
  • With 16M address space, only 3 address bytes are needed. However, the TG88 can only do word accesses and hence has to fetch 2*2 bytes. Consequently, the 4th address byte contains flags such as the loop flag (0x04).

Step 4: TG88 considerations

Korg's TG88 aka MB87726 is another Fujitsu ASIC, like so many custom chips used in Japanese synthesizers (cf. also Casio). Looking at the schematics reveals the following:

  • The Audio interface has 20-bit output data OD[19:0] and 5-bit voice number VN[4:0] plus output waveform enable OWEF. This feeds the digital filter chip DF88 (MB87727).
  • It comprises a DRAM interface of four individual banks (4x RAS/CAS/WE). Not sure if this needs to be specifically activated by MMODE=1.
  • The CPU interface is implemented in true 16-bit, i.e. an 8-bit address space of (256) 16-bit registers. (DMODE=1)

So we presumably have a maximum of 32 oscillators. 256 addresses/32 oscillators gives 8 registers per oscillator. What do we need?

  • 24-bit wave start address padded to 32 bits, i.e. two 16-bit (24+8) registers
  • 24-bit loop start address plus loop flags, i.e. two 16-bit (24+8) registers
  • 24-bit loop end address padded to 32 bits, i.e. two 16-bit (24+8) registers
  • Volume and control register (osc start/stop) -- probably 8+8 bit
  • Read and write to sample memory, probably 2x16 bit address, 1x16 bit data

Hence, there's probably something else going on, e.g. some sort of address ("register select"). OS analysis will tell.