This page describes the TNR hardware (as much as I know).
A teardown of a TNR-W can be found here at bunnie’s blog. I really didn’t want to take mine apart!
The service manual is a fantastic resource for identifying how the peripherals are actually connected to the CPU, and therefore what the various registers are actually doing. This has been my main route of investigation into the software : for example, the service manual identifies that the MIDI connector is attached to pins 126 and 127 of the CPU. Looking up these pins in the CPU datasheet tells us that these are Ports F0 and F1, located at 0x003C in the memory map. Consequently, and code accessing 0x003C is to do with handling MIDI.
The service manual for the TNR-O (the orange version) can be found on-line.
It is in both Japanese and English. The service manual for the TNR-W is almost identical. While there are several differences between the TNR-W and the TNR-O (colour, backside LEDs, battery), the schematics in the service manual for the TNR-O just show the TNR-W components with a dotted line saying “not fitted”. Similarly to the actual hardware, the service manual is really fantastic, and provides so much good information for wannabe Tenori-on modders.
CPU : Toshiba TLCS-900/H1 : TMP92CA25FG
The CPU is a now-discontinued Toshiba microcontroller, with quite a lot of useful inbuilt interfaces. Useful documents include the datasheet and the CPU instruction set manual . The best bit of the manual is chapter 3.
Finding a compiler/disassembler/assembler for this however is hard. Toshiba sell a commercial one, but it is expensive (~500 €).
For disassemblers, by an amazing coincidence, this is the same processor as used on the Neo Geo Pocket Color, a hand held video game console made by the now defunct SNK. Like many retro games, this has a bit of a emulator community, and I found that the Neopop emulator code included a TLCS disassembler. Also, github hosts a python based TLCS 900 disassembler from user Victorious3.
The commercial IDA disassembler from Hex-Rays also includes support for the TLCS-900, I believe as a module that you need to compile using the IDA SDK.
I am reassembling using the excellent Macro Assembler AS. When I couldn’t get binary-identical reassembly for the 2.10 branch, Alfred - the developer of the assembler - made some specific enhancements to AS which enabled me to generate identical code, so much thanks to him.
“Tone Generator” : Yamaha SWL-01 : YMW767-VTZ
I can find very little information on this device. It is used in some Yamaha synths contemporaneous with the TNR; scroll down to find the SWL01. This is essentially a second CPU. The TLCS-900 and SWL-01 communicate over the address and data bus, the SWL-01 is memory mapped into the TLCS-900 address space. However, the Flash memory used for storing the instruments, and user samples, is only accessible by the SWL; updating the user samples involves the TLCS-900 messaging the SWL, which then writes to its Flash memory - this is why updating user samples takes so long.
LCD Module : WG12232D-YGH
I couldn’t find much useful on this directly, but it includes (most likely a pair of) Avant SBN1661G LCD controllers (1⁄32 duty cycle), running 122x32 dots. Datasheets on the SBN1661G controller exist that help understand how it is being driven. This is controlled via specific IO ports on the TLCS-900.
Various blocks of memory are memory mapped onto the CPU’s address bus. The memory mapping is set up by the boot code, and I haven’t managed to work out how to dump an image to an SD card yet, so can’t quite tell for sure how it is configured.
- There is some Flash memory : S29JL032H 70TFI010 (32Mbit device) : accessible by the CPU.
- There is 16Mbit of SDRAM fitted; the schematic lists this as W9816GCH-7. This would be 143MHz/CL3. The parts list indicates it could also be W98G6IH-7 (which looks very similar) or even IS42S16100E-7TL. the schematic also indicates a further lump of RAM (M12L64164A) with the helpful label “Not installed” and “For the future”.
- There is a further bank of Flash memory (TC58FVM7 B5BTG65CCH, 128Mbit) attached to the Tone Generator.
The digital-to-analog converter (that makes the audio sound) is an AsahiKASEI AK4385 24bit, up-tp-192kHz DAC.