View Full Version : Rewriting 37VF010 without removing

08-08-2003, 04:49 PM
I'm thinking about taking a a PLCC wirewrap socket and dremel tooling it out so that it fits over top of the 37VF010 32 pin prom. I will wire it to a prom programmer and hopefully reprogram the prom without removing it.

Has anyone tried this yet. Has anyone traced the CE and OE pins on the HDVR2 motherboard? Will applying the 12 volts cook some other components on the mb?

08-08-2003, 06:26 PM
I predict that you'll fry something.

Either OE and/or CE *must* be fed by some other 3.3v output (either the ASIC or the MIPS chip, I don't know which offhand), because it's a shared databus, and the EEPROM needs to be told when to drive the bus.

You can always try lifting just those pins, doing your thing, and reattaching the pins to the PCB.

Caveat: It's always possible that OE and/or CE are not driven directly from a digital output, but rather through some kind of transistor arrangement gated by a digital output. To the best of my knowledge, nobody has come forward with the specifics.

08-09-2003, 10:34 PM

I agree that there is a good chance of burning up some chips. Some manufacturers program the prom before inserting it. I have seen others that have a programming or test jig that comes down on the board and programs the flash.

I doubt that this chip can be programmed on board because chip erase is done with 12v on OE and A9 as opposed to the chip erase command on the 39VF010. I just wanted to see if anyone has actually traced the board or attempted an on board program before.

08-10-2003, 02:14 AM
I've got the sneaking suspicion that the PCB itself has the ability to provide 12V to that pin, under the control of a few GPIO pins on the ASIC.

I've thought about sequencing through all the unused GPIO addresses in the ASIC, but haven't had the opportunity yet. Of course, if TiVo ever pushes an EEPROM reflash upgrade down the pipeline, they'll reveal the GPIO address inside the binary, making this much easier :)

08-26-2003, 02:01 AM
Does anyone know what part U54 is? It looks like the number is A32S - I'm not sure though.

09-15-2003, 01:19 AM
I have put much effort into devising a simple method of reprogramming the 37 series prom on board with little hardware modification. After much research, I do not believe that it can be done. Thanks to the others on this board who privately helped out with the task.

As many are aware, erasing a prom sets all its bits to "1". When the prom is programmed the 0 bits are burned. It is possible to rewrite a location if you only want to convert 1's to 0's. The fix involves writing a few locations, only 1's to 0's, without erasing the chip first. Erasing requires 12 volts on pin A9 which is not feasible.

The 37 series prom requires 12 volts on OE to perform a write operation. The OE pin has a via right next to it. The trace was cut between the via and the OE pin. A wire was soldered to the OE pin, the via, and 12 volts. A spdt switch was installed. Homieflash.c was modified and testing commenced. A logic analyzer and scope were attached to CE and WE of the prom. Unfortunately it did not write. Analysis revealed that there were 2 major problems.

1) WE and CE rise at the same time leaving no Data Hold time. This was corrected with a transistor. The chip still did not write.

2) The WE pulse is ~350 ns. The data sheet for the 37 says 10-15 ns pulse. I believe this is a misprint and should read 10-15 ms pulse. Elsewhere in the data sheet it states that byte programming time is 10 ms. This makes more sense because a 10ns pulse would be very difficult to clock even with an internal oscillator. So the WE pulse would need to be extended a huge amount. Also, the data and address lines release when WE and CE return high. Holding the WE and CE lines low with additional circuitry will not work becasue data and address would no longer be present.

The processor is a NEC VR5432. It supports JTAG and boundary scan. This looked like a possibility. However, the MISP uses a companion chip which is a system controller, a VRC5477. The processor uses a multiplexed address and data bus. The prom is connected to the system controller. No documentation is available on the VRC5477. There is no indication that it supports JTAG. It does support programable bus timings but no where near the timing required to write the prom.

There are only 2 possibilities left. One is to get a programmer that programs the 37 chip and put it on a scope and determine the actual length of the WE pulse. If it is 350 ns or less than there is a possibility.

The other is to find a data sheet on the VRC5477 and hope that it supports JTAG.

09-15-2003, 01:39 AM
The three IC's near the prom are gates and are used to decode OE and WE. Their part numbers are 74V1G32S and 74V1G43S.
Here is the url for their data sheet.


There is also the possibility of coming down on top of the prom with a test clip connected to a programmer and the OE trace cut and a switch installed as mentioned above. The system controller would have to be capable of putting the prom's address and data lines in tri-state mode. Circuitry would have to be incorporated so that WE and CE would be driven to the maximum low threshold voltage to avoid from burning out the gates. There is substantial risk in doing this. Tristating the chip would require the data sheet on the VRC5477.

For those that do not want to socket their chip, it is possible to solder a 39 part on top of the 37 and cut and solder jumpers on the CE pin. Not exactly a clean hack, but it will work.