
DevelopmentSega Master System / Mark III / Game Gear 
Home  Forums  Games  Scans  Maps  Cheats  Credits 
by andete. Original documents available at: https://github.com/andete/ym2413/tree/master/results
<< YM2413 Reverse Engineering Notes 20170126  YM2413 Reverse Engineering Notes  >>
It's again been over a year since my last progress report. I've mostly been working on figuring out the content of the YM2413 instrument ROM. For most instruments I've found settings that are close (sometimes very close) to the builtin instruments, but never 100% identical. I suspect there are still some details wrong in the model that I'm using. I will (slowly) continue working on this.
But this slow progress is sometimes discouraging. So for some more variety I started to look at the YM2413 rhythm sounds. This is still very early work, but I already found something interesting. (Spoiler: strictly speaking it's nothing new, software YM2413 emulators already got this right, but it's nice to have it confirmed anyway).
So far all my measurements on the real YM2413 captured (only) the output of channel 0, outputted on the 'MO' analog output pin. But the rhythm sounds are outputted on various other channel numbers (thus at different relative moments in time) and on the 'RO' analog output pin.
To be able to measure rhythm sounds I had to make (small) adjustments to the embedded software on the capturing board. Short summary: before the board itself located channel 0 (in time), only sampled that channel and send it back (over USB) to the host. Now I added a mode where the board samples 72x faster, thus capturing all channel information (both MO and RO pins). And then the host software must postprocess this data to isolate the channel(s) it's interested in.
Anyway, I was making some initial captures of the 5 rhythm sounds. And by mistake I captured the 'snare drum' sound with a frequency setting of 0x0 instead of the recommended value of 0x550 (I forgot to update my program to write the frequency settings to registers 0x17 and 0x27 instead of registers 0x16 and 0x26). This gave the following result:
Notice that the envelope is visible, but all samples have the same sign. If we zoom in on the tail, where the envelope is fairly flat, we see this:
From what we've reverseengineered so far this is an unexpected result: if the frequency is zero, the phase should remain constant. But in this result the phase is clearly toggling between two values.
Compared to the melodic channels, the rhythm channels use one extra component for sound generation, namely a random noise generator. Might the above signal be the output of the noise generator?
Looking more closely at (120) consecutive samples in this signal gives the following. I mapped sample value 255 to '0' and all other values to '1':
1, 1, 0, 1, 0, 1, 0, 0, 1, 0, 0, 1, 1, 1, 0, 1, 1, 0, 0, 1, 0, 0, 1, 1, 0, 1, 0, 1, 1, 1, 0, 1, 0, 1, 1, 1, 0, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 1, 0, 0, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1, 0, 1, 1, 0, 0, 0, 0, 1, 1, 1, 0, 1, 1, 0, 0, 1, 0, 1, 0, 0, 0, 1, 0, 1, 1, 1, 0, 0, 0, 1, 1, 1, 0, 0, 0, 1, 1, 0, 1, 1, 1, 1, 1, 0, 1, 0, 0, 1, 0, 0, 0, 1,
This looks pretty random to me. A very common choice for a random generator is a Linear Feedback Shift Register (LFSR). It's cheap to implement in hardware and it has various nice mathematical properties. It's also used is several other sound chips from the same time period (e.g. AY8910 and SN76489). So it's likely that the YM2413 (and other chips in the Yamaha family) use it as well.
But how can we know for sure? The BerlekampMassey algorithm can help us here. For a given sequence of 0's and 1's, the BMalgorithm constructs the cheapest LFSR that fully reproduces that sequence.
https://en.wikipedia.org/wiki/Berlekamp%E2%80%93Massey_algorithm
If I feed the above sequence of 120 bits into the BMalgorithm I get the following polynomial as result:
x^23 + x^9 + x^8 + x + 1
I'll explain what this means in the next section. If you're interested, you can check my implementation of BM plus some more analysis code here:
If I sample the noise signal at other time offsets and apply BM, I each time get the same result. Or if I take only the 60 first samples of the above sequence, BM still gives the same result. Moreover the resulting LFSR can then correctly predict the continuation (the last 60 samples) of that sequence.
I repeated this experiment on several different captures and several different sample sequences, and I always get the same result. Of course given that the input sequence is long enough (usually 3040 samples is sufficient). This is a strong indication that the YM2413 indeed uses a LFSR for it's noise generator, and specifically the LFSR with this polynomial.
But what is a LFSR exactly? You can find many details and references on wikipedia. But below I'll also try to explain in an easier (less precise) way.
https://en.wikipedia.org/wiki/Linearfeedback_shift_register
Very brief the idea is the following:
This is illustrated in the following image:
For now only look at the 'Fibonacciconfiguration'. You see a large rectangle that contains 23 smaller cells. Each of these cells stores one bit. These contain the last 23 output bits of the LFSR. Some of these outputs (bits 1, 8, 9 and 23 in this example) are XOR'ed together and the result is feed back to cell 1. This is the newly generated random bit. When a new output bit is generated, all existing bits shift one position to the right. So the last bit becomes the 2ndto last and so on.
Notice how the 'tappositions' (1, 8, 9, 23) correspond to the exponents in the
polynomial that describes this LFSR (x^23 + x^9 + x^8 + x^1 + 1)
. There's a
mathematical reason why polynomials are used to describe LFSRs, but I won't go
into that. The '+ 1' at the end of the polynomial does not correspond to a
tapposition, it makes sense in the mathematical description (it's related to
the input), but we'll also ignore that here.
This was the 'Fibonacciconfiguration' of a LFSR. This description is easy to understand, but it's usually not how LFSRs are actually implemented. In practice, both in hardware and in software, often the 'Galoisconfiguration' is used instead. This configuration is shown in the lower part of the image.
Both configurations have the same number of shift register bits and the same number of XOR operations. Only the arrangement differs. (Also note that the numbering is swapped lefttoright). In the Galois configuration the XOR operations are located 'in between' the shift register bits. Thus the shifted bits get modified while they are 'inflight'. It can mathematically be shown that both configurations produce the exact same output sequence (in cell '1'). But the full internal state (including the values of the other bits in the shift register) is NOT the same for both.
Some mathematical properties:
2^231 = 8388607
steps.
Applied to the YM2413 this means that:
I mentioned that 'Galois' is more often used than 'Fibonacci'. Why is that?
Let's check how the noise function is implemented in the existing YM2413 software emulators. In the openMSX src/sound/YM2413Burczynski.cc code you can find this code snippet:
That's equivalent to the 'lfsr_step_galois()' function above (difference is whether the XOR operation is applied before or after the shift operation). So the software emulation was already using the correct LFSR. It's always nice to confirm such things.
Can we also find this LFSR in the YM2413 dieshot? I already speculated about this in an earlier article. Here's a (slightly extended) repetition of the YM2413 dieshot.
In the upperright corner, near the green colored 'PG' rectangle I marked in white a shiftregister with 14 (or 15?) bits. That's not enough for the full LFSR (needs 23 bits) but it might correspond to the longest chunk of 14bits in the Galoisconfiguration of the LFSR (see above). The single bit registers surrounded by XOR gates are hard to see in this die shot (at least for me). And the remaining 7 bit shift register might be obscured by all the wiring in this region. Also important: placing the LFSR close to the other circuitry that handles phase calculations is very logical. All this gives me more confidence that this white colored shift register is indeed related to the noise generation.
I'll probably continue with investigating the rhythm sounds. This article only looked at the noise generator, but we still need to figure out how exactly this noise is used to produce the rhythm sounds. After that I'll probably return to the instrument ROM. As always, help would be appreciated.
<< YM2413 Reverse Engineering Notes 20170126  YM2413 Reverse Engineering Notes  >>