Why write protect M29W flash?

[borg1]

Given what we now know about the M29W flash, is there any reason to write protect it?

There are two outcomes of an update, acceptable and unacceptable.

If write protected, a reflash is required for either outcome.
If not write protected, only one outcome requires a reflash.

Are there any other factors I am overlooking here?

[m5runner]

i dont know what the hell is going on about this M29 flash deal but i am telling u i think its a hoax. any and every electronic device can be grounded. i have IRDs with the M29 and they are fine. sometimes you have to do things without a good explanation.


M5

[skinerd]

Not a hoax, a theory only, and so far appears not to be valid...as some M29W's are still up and some with the Intel chip went down.

A theory based on unwinks comments......I posted that and stated clearly it was a theory only.......what went down and wht is still a mystery.....and may remain that way.....

[m5runner]

if my M29 updates i guess that's the only way i can look at it and see if i can figure it out. remember that chip gets its voltage source from more than one place. that magic pin 13 again. if that is the case, we might have to couple it with 2 resistors to bring the juice down to less than 5 volts or something like that. i will have to look into it more

[m5runner]

ok, thought about it for a little while and this is my theory. though unwink is an awesome site, i don't think they were 100% on stopping this thing from getting updated (the 430 and its affiliates) i posted the data sheet on the M28 chip and only 44 people took the time out to look at it. for those 44 people, refer back to page 10 and notice again about pin 13 and see where it says that it can act as a power supply also. so the chip has more than 1 power option right?....right!

think back to the philips IRD and the IRD with the M28 chip and how sending that 12 volts to pin 13 will power up the flash for quick writing. my theory is simply this....
PIN 13 HAS TO BE GROUNDED ALSO. now some are probably wondering, if we send both power sources to ground, how will the unit even power up? well, back to the trusty data sheet and notice that VDD (pin 37) controls the core voltage.

now, for the people that are on dialup like i am on now, i will spare you this once and type this section ver batem from the trusty data sheet, and i quote:

IF VPP IS KEPT AT A LOW VOLTAGE RANGE (0V TO 3.6V) VPP IS SEEN AS A CONTROL INPUT. IN THIS CASE A VOLTAGE LOWER THAN VPPLK GIVES AN ABSOLUTE PROTECTION AGAINST PROGRAM OR ERASE WHILE VPP ENABLES THESE FUNCTIONS.

basically, we have to send pin 13 to ground.

M5

[borg1]

M5,

There is another way you can look at the M29W flash.
I just saved my corrupted M29W flash, and I can send it to you.
I also saved the eprom. Since it appears you are still online, I will wait for 15 minutes in case you can think of anything else that might help shed some light on what is going on here. Shoot me a post.

[m5runner]

looking at it from a software point of view won't stop it from being updated. it's all hardware. i won't bash you though, i will take a look at them after the all star game. i sent you a PM

M5

[skinerd]

Some 430 with the Intel flash were also corrupted........so it's not just a M29W issue.......

[sdeens]

I am glad to hear that its not just an Intel related issue..but I do recall reading long ago that the M29W did for some reason allow re-programming despite grounded.

The Intel chip as you know is completely differnt so I am not sure pin#13 applies..probably will need to pull the data sheet and look for a similar Vpp that we can ground.

meanwhile grounding pin#13 is very easy on the M28W chips and i would suspect its probably the same test point for those 430's that have the M29W chip.

If anyone is wondering there is a ground test point large enough to solder a small wire and hot glue it down for security...on the 430's with the m28W chip a continutiy point is directly to the left of the flash chip and just about on the very far left edge of the board..easy to find if you ohm it out.

has anyone figured out a better way to lock down the 430's with the Intel chip?

also any guesses why the 420's and phillips5353's have not been targetted?

[skinerd]

I wonder how many un-modded IRDs also scrambled due to the update, probably none, but may have been a few as they have not tried the update again yet....

As far as grounding pin 13 on a M28W,..............don't you think we better figure out if the IRD can turn that pin on,................ and if so, how it does, before we just ground it?? We cut a trace for normal write protect, so if the IRD is capable of putting 12v to pin 13 we had better dis-able that first..............

[m5runner]

ok so what's the difference between cutting the trace and grounding it? the point is it will stop the power from going to pin 13. YES, the IRD can turn on that pin....that is the pin used to make updates possible, remember?

M5

[skinerd]

What's the differenve betwen cutting and grounding??? You really don't know???????
Does the word short mean anything to you.........
Power + ground = short.....
Cut + ground = no short...............see,... easy...

[m5runner]

u are missing the point. the data sheet said that pin can be pulled down to 0-3.6 volts. see,.......easy


M5

[skinerd]

That data sheet says that, I am ok with that.
Does the data sheet say what happens when that pin is grounded, and then power is applied to it???????.....I don't need a data sheet to tell me what happens with that........
Pull the pin low, cool, but cut the trace to it first, same reason the trace is cut from pin 2 of the processor to the flash......that trace is grounded too, but AFTER being cut...........or grounding FP on a 420....AFTER the trace is cut......starting to get the picture ......AFTER the trace is CUT......

Come on M5, use some common sense, telling some one to just ground that pin, without cutting the trace to it, is foolish and bad advise, anyone with a little electrical common knowledge will understand why, if the receiver is capable of powering that pin, the cut is nescessary.

[borg1]

I finally looked through the 'corrupted' flash I saved from my M29W.
It is FF'd from 00000000 to 003EFFFF and again from 003FB93C to 003FFEFB. Sounds like everything but the protected block got erased?

[buckbronte]

I finally looked through the 'corrupted' flash I saved from my M29W.
It is FF'd from 00000000 to 003EFFFF and again from 003FB93C to 003FFEFB. Sounds like everything but the protected block got erased?


this is from the unwink site concerning the M29W320DB

" There is a minor issue with the flash type found in some of the receivers. Apparently, the Flash write protect procedure doesn't work 100%. It appears as though the flash will erase even though it is write protected. This is an issue with the flash type, and there is no harware way to work around it. A simple firmware patch should be able to work around this issue. (I'm working on a fix now) This won't become a problem until the next time dtv sends down an update. "


Seems to me like they can erase the chip but when the go to reprogram it the write protect works and you got yourself a dead receiver.

quick solutions.

1. reprogram and unlock receiver
2. Replace M29W320DB ( 48 pin tsop ) with a e28f320 ( 56 pin tsop ) and write protect.

[borg1]

According to the M29W320DB datasheet,

When VPP/Write Protect is Low, VIL, the memory protects the 16 Kbyte Boot Block; Program and Erase operations in this block are ignored while VPP/Write Protect is Low.

It also mentions that the boot block can be on the bottom or top.
The 003F0000 address corresponds to the last 16kbyte block, which is behaving here in a manner corresponding to the boot block.

It may be that to fully protect the chip each block must be protected similar to the M28, and I would just as soon take the hit and reflash the chip.

I hope I am wrong.

[m5runner]

common sense huh skinerd? i won't even get into it with you...not worth the time. data sheet tells me i can bring it down to 0 volts so that's what i'll do. the same data sheet that told me that the M28 can be erased without typing in all the sectors. i am using that same common sense.

M5

[skinerd]

M5, bring it to 0v, I don't have an issue with that.....cutting the trace to the pin before grounding it is what I am advocating------THAT MAKES COMMON SENSE------
Why do we cut the trace before grounding FP???----COMMON SENSE-------
If you chose not to ground that's your decision......Then, why bother cutting the trace for FP????????????? Does the datasheet say to cut FP trace???
No, but we do anyway, because that is -----COMMON SENSE------

[m5runner]

do whatever you please with your IRD. i will do it my way. i don't want to argue with you again for another 8 months until you get the point. cutting it is fine if you want to go that route. i rather ground mine so if i fuck up and cut another trace (highly unlikely) i don't have to play games trying to solder it back. i don't care what anyone wants to say about cutting the trace or sending it to ground. the data sheet is my guide, not some guy telling me that that's the way to do it.


M5

[skinerd]

Then please explain why we bother to cut the FP trace.....damn datasheet must have left that out.......and I just don't seem to get it.....

I have not found anything on the datasheet that says grounding and powering the same pin was a good idea.....maybe I missed something?????

The datasheet I have is in English.......maybe that is the problem......

[m5runner]

ok, thought about it for a little while and this is my theory. though unwink is an awesome site, i don't think they were 100% on stopping this thing from getting updated (the 430 and its affiliates) i posted the data sheet on the M28 chip and only 44 people took the time out to look at it. for those 44 people, refer back to page 10 and notice again about pin 13 and see where it says that it can act as a power supply also. so the chip has more than 1 power option right?....right!

think back to the philips IRD and the IRD with the M28 chip and how sending that 12 volts to pin 13 will power up the flash for quick writing. my theory is simply this....
PIN 13 HAS TO BE GROUNDED ALSO. now some are probably wondering, if we send both power sources to ground, how will the unit even power up? well, back to the trusty data sheet and notice that VDD (pin 37) controls the core voltage.

now, for the people that are on dialup like i am on now, i will spare you this once and type this section ver batem from the trusty data sheet, and i quote:

IF VPP IS KEPT AT A LOW VOLTAGE RANGE (0V TO 3.6V) VPP IS SEEN AS A CONTROL INPUT. IN THIS CASE A VOLTAGE LOWER THAN VPPLK GIVES AN ABSOLUTE PROTECTION AGAINST PROGRAM OR ERASE WHILE VPP ENABLES THESE FUNCTIONS.

basically, we have to send pin 13 to ground.

M5

well if u missed it, i typed it right here, ver batem (word for word) from the data sheet.

[skinerd]

I do not understand why you are being so hard headed on this,

I AGREE YOU CAN GROUND THE PIN 13, DAMN, HOW MANY TIMES DO I HAVE TO SAY THAT.........

My contention is that before you ground it the trace to it should be cut, same as we do for FP.......

[sdeens]

ok boys,

its not that big an issue..i must take M5runner's side on this point since he was the one who properly interpreted the M28W data sheet to begin with..so in gold terms he has earned the Mulligan..and I think we should give him the benefit of the doubt and stick with a simple grounding of pin#13..which incidcently is rather simple to do..cutting a trace lead to it is more complicated and to safely do this on the M28W chip may require that we remove the board abd flip it over to find a long enough trace to safely cut..i ohm'd out that entire pin and its mostly underneath the board with only two tiny test pads poking their heads thru the top of the board..but maybe you guys can find a better spot to cut a trace that safe and easily reversed and long enough that we can jumper it at a later date for easy reversal..remeber guys never cut a trace unless you first identify future jumper points to reverse it..otherwsie you will need to do some delicate repair work to a trace and shave back and repair it..not easily done.

i also want to pint out my most cardinal rule of modifying receivers:
"NEVER CUT A TRCAE UNLESS IT IS VITAL TO TESTING"

the reason this is important is because some day down the road Dave may elect to routinely send down new firmware on a rotating basis (i.e 3-4 times per year) just to screw with modified NOZKT firmware..this is exactly the policy of Charlie (Dish/ECHO*); We need to routinely receiver updates of new firmware otherwise we get black video (no channles)..my DP-501 must have recived 4 updates in the last 12 months..if I refused them I lost many of my channels.

so for now boys lets just keep it simple and not cut a trace until we need to do it for sure..in fact, Wouldn't now would be a good time to test this idea while the updates are still in the stream to see what happens?

[skinerd]

M5's argument is that the data sheet says that pin 13 can be grounded, I totally agree with that.

But, using common electrical sense, think about it, why would you ground a pin that the receiver has the ability to power without stopping the ability to power it? Heck, I am not even sure the receiver has the ability to power the Pin 13, 430 schematics are not available, but if it does, then that needs to be cut.

The normal write flash protect/enable is pin 2 from the processor, which is what we cut normally. Pin 2 does not directly power the write enable for the flash, it does so thru a transistor amplifier circuit. The cut we normally do stops the processor from turning on the amplifier, then grounding the trace makes sure it stays off.

If the processor can enable pin 13, it must also do so thru an amplifier circuit as the processor outputs a low level signal. Again, I am not sure how this is done or even if the processor has the ability to do so. But doesn't it make sense to stop that ability, before grounding?

Anyway, the original poster in this thread was asking about the M29W, NOT the M28W, I have seen receivers with the M29W that got hit and scrambled, I have yet to see one with the M28W get hit. Maybe they did, but I have not seen one.

[borg1]

Read the difference in description of Vpp and WP on the M28, then the M29. On the M28, Vpp and WP are separate pins; while on the M29, Vpp and WP are the same pin.

[skinerd]

Yes, thats true, and the original question was why bother write protecting the M29W chip as it appears it still tries to update and becomes scrambled sometimes.
According to blaknite, some M29W chips will erase even if write protected, appaerantly that is true as some modded M29W chips scrambled, with the latest update attempt, and some did not...

I am not sure how this thread got messed up with the M28W stuff.

[turk]

There is some confusion but it appears that the grounding of pin 13 only applies to the m28. Is there anything similar for the M29?

[m5runner]

pull a data sheet for the M29 and figure it out. its not that hard, just read it.

M5

[sdeens]

I will definately read it, but can you post a link for us to download it..I think you oncve uploaded the M28W data sheet, so I asume you also the M29W

thankyou :-)

[borg1]

Here is the download link for M29W320DB

http://www.st.com/stonline/books/pdf/docs/7876.pdf

[m5runner]

same thing applies to M28 as M29. for the M29, pin 14 has to be sent to ground (VPP) just like the M28.


M5

[sdeens]

I just read the same exact thing that pin#14 is the proper VPP/WP (write protect pin), but it clearly states that it ONLY porotects the 16kb BOOT BLOCK when WP is held low (i.e grounded)..we still need to also ground pin #2..this probably explains why some people after the new firmware was released a week ago, subsequently read their flash chips and discovered that Dave erased ONLY those 16kb sectors that were for boot block..some were at the beggining of the flash and others at the end..hence the letters at the end of the chip (CB/CT(M28W) and DT/DB(M29W)--top/bottom boot block sectors.

Will this be enough..in other words, if we ground pin #2 and pin #14 will that protect 100% of the flash and thus avoid a messy trace cut which appears now to NOT be necessary...the data sheets on both chips clearly state the holding pin #14 low 9i.e ground will completely prevent unlocking and erasure..but the cutting of a trace was NOT mentioned.

thus in order to fully lock down the M29W and M28W chip we will have to ground two pins (pin #2) and pin #14 BOTH to ground in order to fully protect 100% of the entire 4mb 48 pin-flash memory chip..but also cuit the trace before pin #2...so twpo grounded pins and one trace cut..

is that right?

I hope I interpreted the data sheet correctly.

please refer to p. 6 and p.10 (upper right hand side) of BORG1's link for the M29W chip..thankyou BTW, I was too lazy to go to ST's site and get it..:-)

p.s.
Since Pin#13 does appears NOW not to be the pin we nned to ground in either of the ST chips, doesn;t that contradict some of the comments in the above passages of this thread..I agree it looks to me that we use pin #14 in both of these ST chips to lockthe tiny 16kb BOOT SECTOR down.

[skinerd]

Of course cutting the trace was not mentioned in the data sheet, ST had no idea these would be in a hacked DTV receiver. I don't think the data sheet says you can power and ground it at the same time either.
Also, doesn't it make even a little sense to you, that before grounding something, you want to make sure that it cannot receive power while grounded?
Anything that you ground, that can receive power should be made to where it cannot receive power while grounded, UNLESS there is a pull-up or current limiting resistor, such as found in the BFR curcuit. Check BFR with the power on and BFR not grounded, it will be at 3.3v in a 430, but it can still be grounded because there is a pull-up, current limiting, resistor between the BFR port and the power..
If you are not certain about what will happen, then by all means, cut the trace to eliminate the power to ground possibiliy.
But, hey, don't listen to me, ground the damn thing, don't cut any traces, it's your receiver.

[sdeens]

thankyou for your insights,

Does anyone else have any thoughts on my question posed above?

Also, the data sheet p10 right hand side M29W chip...recommends that:

"A 0.1µF capacitor should be connected between
the VPP/Write Protect pin and the VSS Ground pin
to decouple the current surges from the power
supply. The PCB track widths must be sufficient to
carry the currents required during Unlock Bypass
Program, IPP."

Would this be redundant if a trace was cut from IPP or is it an alternative to cutting the trace to ensure normal operations.

the only dumb question is the one NOT asked.

does this mean that if we permantly ground pin#14 (WP) that a cap should be installed?


p.s.
so let's work together and keep it friendly...i have dozens of receievrs to test this stuff with..I collect them like baseball cards.

[sdeens]

I thought I would post most of the contents of page #10 for the M29W chip so we are all reading from the same page:

"VPP/Write Protect (VPP/WP-pin#14). The VPP/Write
Protect in provides two functions. The VPP function
allows the memory to use an external high
voltage power supply to reduce the time required
for Unlock Bypass Program operations. The
Write Protect function provides a hardware method
of protecting the 16 Kbyte Boot Block. The
VPP/Write Protect pin must not be left floating or
unconnected.
When VPP/Write Protect is Low, VIL, the memory
protects the 16 Kbyte Boot Block; Program and
Erase operations in this block are ignored while
VPP/Write Protect is Low.
When VPP/Write Protect is High, VIH, the memory
reverts to the previous protection status of the 16
Kbyte boot block. Program and Erase operations
can now modify the data in the 16 Kbyte Boot
Block unless the block is protected using Block
Protection.
When VPP/Write Protect is raised to VPP the memory
automatically enters the Unlock Bypass mode.
When VPP/Write Protect returns to VIH or VIL normal
operation resumes. During Unlock Bypass
Program operations the memory draws IPP from
the pin to supply the programming circuits. See the
description of the Unlock Bypass command in the
Command Interface section. The transitions from
VIH to VPP and from VPP to VIH must be slower
than tVHVPP, see Figure 15.
Never raise VPP/Write Protect to VPP from any
mode except Read mode, otherwise the memory
may be left in an indeterminate state.

"A 0.1µF capacitor should be connected between
the VPP/Write Protect pin and the VSS Ground pin
to decouple the current surges from the power
supply." The PCB track widths must be sufficient to
carry the currents required during Unlock Bypass
Program, IPP.
Reset/Block Temporary Unprotect (RP). The
Reset/Block Temporary Unprotect pin can be
used to apply a Hardware Reset to the memory or
to temporarily unprotect all Blocks that have been
protected.
Note that if VPP/WP is at VIL, then the 16 KByte
outermost boot block will remain protect even if RP
is at VID.
A Hardware Reset is achieved by holding Reset/
Block Temporary Unprotect Low, VIL, for at least
tPLPX. After Reset/Block Temporary Unprotect
goes High, VIH, the memory will be ready for Bus
Read and Bus Write operations after tPHEL or
tRHEL, whichever occurs last. See the Ready/Busy
Output section, Table 15 and Figure 14, Reset/
Temporary Unprotect AC Characteristics for more
details.
Holding RP at VID will temporarily unprotect the
protected Blocks in the memory. Program and
Erase operations on all blocks will be possible.
The transition from VIH to VID must be slower than
tPHPHH.
Ready/Busy Output (RB). The Ready/Busy pin
is an open-drain output that can be used to identify
when the device is performing a Program or Erase
operation. During Program or Erase operations
Ready/Busy is Low, VOL. Ready/Busy is high-impedance
during Read mode, Auto Select mode
and Erase Suspend mode.

are we now all on the same page?

[borg1]

A few thoughts,

First, it appears that pin #2 is the A14 address input. What will be accomplished by grounding this? Or are you talking about pin #2 of the sti5518? If the sti5518, we have already cut the trace to the current amp to disallow the processor to control flash enable. Something else is erasing the flash.

Secondly, we have been running without a capacitor, with no ill effects.
If you are asking if adding the capacitor would have prevented the update debaucle, I do not think so.

Possibly a minor point, from reading the chip, the boot block WAS protected.
Everything above it was FF'd. (boot bottom) In the boot block, the following is shown in plain text:

Entry Failed....Reboot
Unknown Flash part, terminating download...Ram Image Validated
pSDRAM image
Serial Download Failure: Incomplete Image
Error Check Recovery from SDRAM into Upper flash
Error Check Failure Recovery into Upper flash
pErase upper flash
Unable to erase chip, terminating
Erase done
Programming upper flash part
Check Recovery from upper into lower flash
Erase lower flash
Erase done
Programming lower flash
Error Check Failure Recovery into Lower flash
Error Check Secondary into Upper flash
Erase Upper flash
Erased Done
Error Check Failure Secondary into Upper flash
Program secondary partition
FLASH Write 1
FLASH Write 2
FLASH Write 3
Erase_Program_Partition_Done
ATTEMPT_RECOVERY
pErasing lower memory
Erase done
Start Programming part
Reboot
Erase Failed

[dssdude]

wow.. this thread has gone for a long time. So many opinions. Why not just use a chip programmer to unprotect the chip, write your new flash and then lock the sectors? You won't have to cut a single trace and your flash will be safe from updates.
Just don't bother with JTAG at all... less headaches and no problems having to unlock your chips.

[borg1]

I am increasingly of the opinion that protecting each block is the only practical way to prevent chip erasure.

I would like to think it could be accomplished with JKEYS similar to the way we unlock the M28 to prevent having to unsolder/solder a 48 pin TSOP.

However, an easier method would be to prevent the attempt to update. For a possible method, see the last post on 'Interactive NoZkt updated bin for 430 machine'

[skinerd]

thankyou for your insights,

Does anyone else have any thoughts on my question posed above?

Also, the data sheet p10 right hand side M29W chip...recommends that:

"A 0.1µF capacitor should be connected between
the VPP/Write Protect pin and the VSS Ground pin
to decouple the current surges from the power
supply. The PCB track widths must be sufficient to
carry the currents required during Unlock Bypass
Program, IPP."
Would this be redundant if a trace was cut from IPP or is it an alternative to cutting the trace to ensure normal operations.
the only dumb question is the one NOT asked.
does this mean that if we permantly ground pin#14 (WP) that a cap should be installed?
p.s.
so let's work together and keep it friendly...i have dozens of receievrs to test this stuff with..I collect them like baseball cards.

The cap is to de-couple pin 14 when connected to power for write operations, to help protect data integrity from surges, and is not absolutely nescessary, and would not ne needed if you ground that pin permenantly.

[skinerd]

I just sacrificed a bad 430 with the M29W chip.........ground pin 14 to your hearts content, don't bother cutting the trace as pin 14 goes NOWHERE, it connects to NOTHING, the receiver cannot power it, unless, of course, you run a seperate wire.
I had to raise the chip as the trace from pin 14 runs underneath the M29W flash chip.

The data sheet says theat the pin 14 must mot be left floating, but it appears this is the case, perhaps that is why the M29W has the problem that we are experiencing now.

I will try an confirm this tomorrow, it's late now, I want to be absolute certain that pin14 goes nowhere, but based on my observations tonight, that is exactly the case.

[skinerd]

Confirmed, pin 14 of the M29W goes NOWHERE, contrary to the datasheet, which says the pin 14 must not be left floating....Maybe that is the problem with it not write protecting effectively.
From this point forth I will be grounding pin 14 after modding the M29W chip.....there is a very convient place to attach a ground to accomplish that.
This concerns the M29W only at this time, if I get a M28W I will trace it also, as it is very similiar to the pin out of the M29W.

[Grasshopper2Ant]

skinerd, just to clarify. If we do the Pin #14 grounding on the M29W, do we still do the trace cut to Pin #2 and ground as before also?
Or do we just do the trace cut to Pin #2 and ground Pin #14 only? Thanks for testing and sharing your findings.

[turk]

Skinerd
Where is the convenient point to ground? Pictures?

[skinerd]

why are you asking him? he didn't figure it out....M5runner is the guy that deserves all the credit. i will wait on him to give me an answer. he led us to the promise land with the M28 so that's the guy i will take instructions from.

M5's remarks were for the fast erase of the M28W, how this thread got side tracked to the M28W, I don't know. But I agree with him on hooking 12v to pin 13 of the M28W to erase it, personally have not tried it as I don't have a M28W chip, I don't agree with just grounding it for write protect without cutting a trace first, if the receiver is capable of applying power to that pin....that's another issue.

This thread was about the M29W, and I traced pin 14 of that chip and found it goes nowhere, it dead ends, contrary to the data sheet that says that pin 14 of the M29W must not be left floating. Since pin 14 is left floating, that may explain why so many M29W receivers got scrambled.
The original question was why bother to write protect a M29W chip.

Further.....I don't give a rusty rat's ass who's info or posts you chose to follow, I don't care who gets credit for what, I don't do this for glory, or pat myself on the back everytime I find something worthy.
This is supposed to be a forum where info and ideas are shared, and if you don't agree with that then I suggest you find a nice shady spot, squat down, and pound sand up your ass.

[skinerd]

skinerd, just to clarify. If we do the Pin #14 grounding on the M29W, do we still do the trace cut to Pin #2 and ground as before also?
Or do we just do the trace cut to Pin #2 and ground Pin #14 only? Thanks for testing and sharing your findings.

I would recommend the normal write protect, (cutting pin 2 trace and grounding), and it appears that pin 14 of the M29W flash should be grounded too.

[skinerd]

Skinerd
Where is the convenient point to ground? Pictures?

I only have a 430RGA with the M29W chip, and there is a place, between the flash chip and the edge of the board, where the trace from pin 14 ends, that would be the place I'd use, I'll get a pic as soon as I can. I don't have a 430RG with the M29W so I don't know where it would be on those.

[skinerd]

that's the man that said ground pin 14 for the M29.....the first one to say it. m5runner, give us some input

Go up a few posts, he is referring to pin 13 then changes to pin 14????

Pin 14 on a 430 M29W chip is dead ended........trace it yourself......

[skinerd]

Take a look at the difference between a M28W and a M29W

[skinerd]

Skinerd, I got a 430RGA with the m29 chip. Im gonna try putting pin 13 and 14 to ground. Ill let you know how it turns out.

On a M29W the pin 13 does nothing, according to the data sheet.
I just tried to flash a 430RGA with pin 14 grounded, it APPEARED to erase and reprogram, however the receiver would not even boot when complete, I removed the jumper to ground on pin 14 and re flashed, and it now works again. I am going to leave pin 14 griunded, but really won't know unless another update is attempted.

Just read the data sheet again, appearantly grounding pin 14 does nothing more than protect the 16K boot block from program and/or erase operations.

[skinerd]

Skinerd, I grounded pin 14. same thing as you. appeared to erase. I didnt do any further testing but I would assume that the erase wiped out most of the flash with pin 14 grounded.

try reflashing and see what happens. Mine would not boot up......

[skinerd]

got error at location start (7FC00000) when trying to reprogram. receiver would not boot up. This is while pin14 is grounded.


Looks like grounding pin 14 with a M29W chip, in addition to the normal write protect, is a good idea then.....after modding of course. Only way to find out for sure is just ground it and wait for the next update attempt.

[skinerd]

same thing applies to M28 as M29. for the M29, pin 14 has to be sent to ground (VPP) just like the M28

that's the man that said ground pin 14 for the M29.....the first one to say it. m5runner, give us some input

That was his first mention of pin 14, ALL his other posts were saying to ground pin 13 of the M28.


On the M28
pin 13 is VPP: When high, approx 12v, allows rapid erase of all locked blocks. Kept low, gives absolute protection against program or erase

pin 14 is WP: gives additional protection for each block

On the M29
pin 13 is NC:

pin 14 is VPP/WP: Two functions, Allows use of external high voltage to reduce the time for Unlock Bypass Operations. When low the memory protects the 16k boot block, program and erase functions are ignored for this block when VPP/Wp is low.

Right from the datasheets for each chip type.

Don't take anyones word, if in doubt, try it your self and post YOUR results and observations.

[skinerd]

well, were you able to erase the flash with normal protect + pin 14 ground?

Did not try that.
I only tried the pin 14 grounded, and it APPEARED to erase and write, but got the write error at 7ffe000c, and it would not boot.
So, although it may be a good idea to ground pin 14 after modding it looks like it still does not offer complete protection. Perhaps with the normal write protect AND pin 14 grounded, there will be better protection, only time will tell. I guess we wait for the next update attempt?
My only receiver with a M29 chip ships out tomorrow, so my testing is done on this matter for a while.

[m5runner]

mods can u close this shit please. i am sick of reading the bullshit on it. oh by the way, good job on figuring out that pin 14 deal skinerd. we couldn't have done it without your understanding of the ST chip family group. i wanna be just like you when i grow up

M5

[m5runner]

oh, for all the guys just cutting traces and shit without testing (the jumping off a fuckin cliff effect) u might wanna take a look at pin 26. some guy criticized me here once about being 19 but he didn't have the answer to his problem and sends me a IQ test like i'm the one that needs help. after bashing his silly ass and posted an option, he never replied so i am guess what i posted worked. if u dont have the balls to test, don't even post in this thread.


M5

[skinerd]

Im going to try that a little later. Running pin 26 to ground and see what happens. Ill post the outcome. Also I should note that I have the DRD430RGA and where the trace normally would be cut is currently cut. just thought I should make that clear before I proceed. :D

Please understand what the data sheet says about pin 26 before grounding it.
The way I read it is that it put the chip in a disable mode.....probably won't hurt anything to try it, but I don't think it's going to help anything.

[skinerd]

mods can u close this shit please. i am sick of reading the bullshit on it. oh by the way, good job on figuring out that pin 14 deal skinerd. we couldn't have done it without your understanding of the ST chip family group. i wanna be just like you when i grow up

M5

I figured out nothing.....I can read the datasheets, and not being perfect, I also overlook things. I, among others, appreciate the fact you verified the putting 12v to pin 13 of the M28W to enable fast erasing, that's cool. I don't, however, believe you have much electronic ability. Example, the data sheet says you can power a pin and pull it low, but does it say you can pull it low while powering it? Of course not. And that's the purpose of cutting the trace, so if the receiver tries to power it while we have it grounded, it will be unable to do so.

No you don't want to be like me, I am still learning, and you already know it all.

If reading this thread makes you sick, why do you continue to read and post here?

[m5runner]

all this come from the guy that toasted 2 M28's by powering up pin 15 when we've only been talking about pin 13. you can think what u may and say what u may, it make none to me. i don't have electronic ability? good one. cutting trace or not, juice will find the quickest way to ground, no? i guess i can't be too damn stupid......you grounded pin 14. you said you read the data sheet so continue to read it. remember what i told you the first time you doubted me? " don't get your panties in a bunch. i do things my way, you do it your way" since you know so much post the pics everyone is asking you to post. guy didn't even have enough sack to admit he was wrong and apologized so why even talk

[skinerd]

all this come from the guy that toasted 2 M28's by powering up pin 15 when we've only been talking about pin 13. you can think what u may and say what u may, it make none to me. i don't have electronic ability? good one. cutting trace or not, juice will find the quickest way to ground, no? i guess i can't be too damn stupid......you grounded pin 14. you said you read the data sheet so continue to read it. remember what i told you the first time you doubted me? " don't get your panties in a bunch. i do things my way, you do it your way" since you know so much post the pics everyone is asking you to post. guy didn't even have enough sack to admit he was wrong and apologized so why even talk

Not only does your electronic ability seriously lack, so does your reading ability.
I did not post that I ruined 2 m28w's, but rather I was sent 2 m28w's that were ruined by someone else, who, following info for the Intel chip, applied 12v to pin 15......go back an read it again.

[skinerd]

Below is a cut and paste from the M28W thread.

http://www.dssftp.com/forum/upload/showthread.php?t=3103


7/27/2003
doing it manually might take months. try this method instead. instead of going through the passive trap/dcu, go into development panel and do the same thing you would do in the trap in the development panel and it should make you able to erase the entire flash.
M5

7/27/2003 Absolutely no mention of pin 13.
You talking about the M28W chip??
tell us exactly how you unlock it, I'll be happy to verify it.
if there is an easier way I would love to know it.[/QUOTE

7/29/2003
[QUOTE=m5runner]the original post was about the M28 chip right? that's what i was referring to.
M5

7/29/2003
then why don't you tell us EXACTLY how you unlock the sectors without unlocking each one individually???

7/30/2003 Still no mention of pin 13.
ok this is how i mod mine...

1. save flash
2. development panel
3. 7FFE0000/60...write byte
4. 7FFE0000/d0 ...write byte
5. read byte (you should get 80)
6. FF...write byte
7. close D. panel
8. erase flash...(watch it count all the way up)
9. program flash
***I did this method when modding 430/431 with the M28 chip
I have 2 430's in my house right now that have been up for quite some time now. I know for sure that it works because the tiers would fall off and the bin would go 745. If you do things another way then that's cool but remember there is always more than 1 way to skin a cat.
I tried that method on my very first 430 mod and I was confused why I didn't get 80 at the bytes when I go through the trap. I went development panel and it worked there so why not stick with that works.
***Modding was done under Jkeys 2.9 AND 2.0
M5

7/31/2003
This DOES NOT work with the M28W flash, just tried it DON"T work. I tried it myself this morning, and also confimed it with 2 other people I know that do mods. Tried it with jkeys 2.0.1, 2.9.9 and 2.9.10, don't work.

7/31/2003
ok dude, no need to get the panties in a bunch. i do it my way, you do it your way ok.
M5

You won't do a M28W320CB chip as you posted, I can assure you of that. Even the data sheet for that chip shows the unlocking proceedure.

7/31/2003
I challenge anyone to follow the directions you give, and erase and reporgram a M28W.

.........From another thread...........
8/3/2003 What about pin 13 M5?
thanks for the info. the pics helped alot. i noticed that soldering a wire from pin 14 on the flash ship to 5V makes you able to save the memory but nothing else. i dont see where this would help any but i would post it anyway for further help in the future maybe. well i modded a 430 today with a M28 chip and let me tell you, typing in the 71 sectors is a BITCH and even worse when you make a mistake and it doesn't erase at all. there has to be an easier way to make it happen. well, either way it worked out for 1. i have 1 more to do but i am taking a break.
>>>M5

.......back to first thread....

1/22/2004 Still no mention of pin 13.
i still say that this chip can be erased without typing in all the sectors.
M5

Finally after months of argument M5 mentions the pin 13.
4 weeks ago (~Feb 2004 date not given)
100% correct huh sdeens? so why is the data sheet telling me to apply 12 volts to pin 13 for quick programming and erase? unlike some people here i can back up my claims. hell, it's right there in black and white. well, there is the data sheet. read and enjoy.
M5


Now who is bullshitting who?

[sdeens]

I'm glad we all now concur on the fast erasure technique on the M28W chip..we still seem to disagree on the proper way to lock down an M29W chip...the way I see it, this chip has two areas that need different methods to locking..the main flash code and the bootblock sector...I am going to use the normal grouding of pin#2 with the trace cut and also the grounding of pin#14 and see if that helps protect the boot sector...I am not so sure about cuttting a second trace to pin #14..maybe I will try both permutations.

This reminds of the same problem that the DP-301-013's experienced when Charlie locked the boot sector (I.e the VID modfication trick)..in order to lock that baby down a special digitial lock was necessary, but I prefer to leave my Dish receivers wide open so I can accept the new firmware code as it comes down the data stream.

In the end we are all probbaly wasting our time here since Dave does not send down frequent firmware updates to make them a concern..ie the Phillips and RCA's in the 5th generation category only have 2 such updates in their 3-4 year histories...that's not much to worry about.

If this becomes a more frequent problem (i.e Dave starts sending down more routine updates to twart NOZKT mods) then we can all start thinking about more complex digital locks to truly lock protect the flash chip..if that becomes a problem those older PROM based 1st-4th gen. receivers will re-gain their value and popularity as people scramble for more stable receivers.

so until then lets be nice to each other and respect the skills of our fellow testers..i myself am not an electronics expert (I just fix computers for a living) but I'm a good problem solver and I retain alot of information and like experimenting with different methods...IMHO the best testers are the ones who try new ways always searching for SHORTCUTs.

I think we have accomp[lised a lot in this thread and others we have participated in..we now have a well documentted method to fast erase the M28W chip and a very plausible way to fully lock down the M29W chip..although only time will tell

so until then peace and FEEL THE JOY :-)

[borg1]

Cold beers all around for the guys who fix computers for a living.
I have been one for far too long.
Since I am still out of town, I cannot look in my 430RGA, and therfore have one question I am unable to answer for myself.
I grounded the 3.3v jumper after I was finished. Is this pin 14? The only pics I have on my laptop are of the E28 flash.

[skinerd]

I'm glad we all now concur on the fast erasure technique on the M28W chip..we still seem to disagree on the proper way to lock down an M29W chip...the way I see it, this chip has two areas that need different methods to locking..the main flash code and the bootblock sector...I am going to use the normal grouding of pin#2 with the trace cut and also the grounding of pin#14 and see if that helps protect the boot sector...I am not so sure about cuttting a second trace to pin #14..maybe I will try both permutations.
snip.........
so until then peace and FEEL THE JOY :-)

EDITED to correct mistakes on my part.........better lighting and magnification helped me see and understand how the circuit for the m29w is configured......

[skinerd]

skinerd, please describe exact location. I would be interested in finding a better spot to solder to then the actual tsop chip. I got the RGA also. :D



EDITED...........see below posts for better more accurate m29w info........

[skinerd]

skinerd, how did you get that tsop chip de-soldered and onto another board. What kind of iron/equipment are you using? Im a little newer to electronics then then most of you who actually care about this thread, so dont bash!!! :p


Don't bash? Why do you say that? I thought we were working together on this, and doing pretty good, too....

I used a normal soldering iron, it's a HOT one tho, and solder wick. Getting it off is the easy part, not really easy tho, getting it stuck back is the tough part, for me anyway. I would buy some surface mount soldering equipment, but I don't do enough to warrant the expense. What I have works, but you have to be very careful, those pins are awful close together.


Did the pic and info make sense? Did you ohm the spot out to verify it was continous with pin 14?

[skinerd]

Ok, then ground it when the mod is complete, and MAYBE it won't scramble if another update is attempted. Do the normal write protect too.

[skinerd]

I would tend to think (correct me if im wrong), that If I grounded that pin and they went to update, they would erase the secors theyre going after and then when they go to write, it would halt, thus making us a scrambled receiver.

That's what happened last time, with pin14 not grounded, that's why we need to try to find a way to prevent it from happening again.
Hopefully grounding pin14 will help.

[m5runner]

skinerd, i see you took all that time to cut and paste. i see you have some time on your hands now that you can do a fast erase to the M28. i didn't know one had to have electronic experience to do something electronic. i am sure 80% of the guys here basically followed instructions on the how to and modded their IRD. i dont have any experience but i am sure you are using that 12V and sending that pin 14 to ground. take a break and stop posting.


M5

:cool:

[skinerd]

I rarely see a M28W, maybe 12 out of 350+ IRDs that I have done were M28W, and no, I have not used 12v to unlock, my macro is fast enough for me.
I have yet to see a 430 w/M28W that was scrambled with the update attempt. This thread is about write protecting a M29W........Can we stick to that topic.

[sdeens]

I wish you guys would stop feuding..we are all in this together :-)

[dssdude]

I wish you guys would stop feuding..we are all in this together :-)

Yes, that sounds like a great idea.
To put this subject to rest. The M29W320DB has no "CHIP" write protect feature, Only write protection on the 16K boot block. In order to write protect your chip, you'll need to protect each block after programming... this is much too time consuming using jtag. Get a universal programmer, remove TSOP and program that way. When done, protect the sectors. You won't have any problems after that.

[skinerd]

Yes, that sounds like a great idea.
To put this subject to rest. The M29W320DB has no "CHIP" write protect feature, Only write protection on the 16K boot block. In order to write protect your chip, you'll need to protect each block after programming... this is much too time consuming using jtag. Get a universal programmer, remove TSOP and program that way. When done, protect the sectors. You won't have any problems after that.

Not per say, it doesn't have one like the M28W does. But by doing the normal write protect, trace cut and grounding(which disables the write enable pin), AND griunding pin 14, it seems to be protected completely. Try it, flash the M29W then do the normal write protect and ground pin 14 then try to erase and reflash. Post results...........

[dssdude]

Not per say, it doesn't have one like the M28W does. But by doing the normal write protect, trace cut and grounding(which disables the write enable pin), AND griunding pin 14, it seems to be protected completely. Try it, flash the M29W then do the normal write protect and ground pin 14 then try to erase and reflash. Post results...........

I understand what you are saying... however, the write error will only occur on the first 16K (boot block) of the M29W. It may appear as though the entire chip is write protected... it is only the 1st block though... since jkeys will not move beyond this point once the write error occurs, you won't be able to see that the 2nd block and the rest are still write enabled.

In order to write protect this chip with jkeys, you will need to enter devel panel and enter in each block address(66 blocks).
data is 60h write byte,
40h verify write byte,
result read byte 01=protected, 00=unprotected.

[skinerd]

I agree with that to an extent, but if you disable the write protect, with the normal trace cut and grounding, the rest of the chip is protected, then grounding pin 14 will protect the first 16k block.
One way to prove that, (I don't currently have a M29W chip to test), do the normal write protect, and don't ground pin 14, then try to erase and reflash.

[dssdude]

I agree with that to an extent, but if you disable the write protect, with the normal trace cut and grounding, the rest of the chip is protected, then grounding pin 14 will protect the first 16k block.
One way to prove that, (I don't currently have a M29W chip to test), do the normal write protect, and don't ground pin 14, then try to erase and reflash.

Please clearify what you mean by "normal trace cut and grounding". I know for a fact that there is no chip write protection built into the M29W320DB... so if you have somehow found a way to write protect it without sector protection, I'd really love to hear more... please provide some pictures of how you accomplished this. Please give pin numbers & labels.

Addition...
Writes are still possible on chip after the 1st block regardless of pin 14 being grounded. So in other words, for complete write protection, you will need a combination of pin 14 ground & sector protection for each of 66 blocks.

[sdeens]

This chip sounds alot like the chips that Echostar uses in their receivers..a more elaborate digital loick may be needed.

of course next time I get an IRD with M29W I will try the two lock methods (pin #2, Pin#14..and the trace cuts)..but I suspect it will not lock that chip down 100%..but we shall see.

meanwhile..the idea of individually locking the 66 sectors is really not a practcal option either since that is way too elaborate and time consuming..unless one wants to try and write a macro...besides i would rather have a wide open chip and reflash, unless of course Dave makes it a common practice to send down routine firmware changes...only in the face of constant firmware upgrades would it be necessary to go to that extereme.

We can at least test these ideas and see what happens when we attempt to erase the chip using jkeys..if the lock works then it should fail and not a single sector whould be harmed...but if one byte or one sector is erased than the receiver will be corrupted and no "green" light

[borg1]

I code painfully slow, and probably will not have time to address this until after the end of April.
Do we have anyone who can code relatively fast, willing to give a go at inserting a recursive function into JKEYS, which will allow successive locking/unlocking of sectors (blocks) given a user-supplied start and end point?
I believe the source is available at SourceForge?
This would kill the proverbial two birds. (M28 also)

[skinerd]

Please clearify what you mean by "normal trace cut and grounding". I know for a fact that there is no chip write protection built into the M29W320DB... so if you have somehow found a way to write protect it without sector protection, I'd really love to hear more... please provide some pictures of how you accomplished this. Please give pin numbers & labels.

Addition...
Writes are still possible on chip after the 1st block regardless of pin 14 being grounded. So in other words, for complete write protection, you will need a combination of pin 14 ground & sector protection for each of 66 blocks.

Normal trace cutting is cutting the trace from pin 2 of the 5518 chip, that trace is made 3.3v to write enable and ground to protect, which on an Intel chip, disables pin 15 and on a M28W and M29W disables pin 13, (indirectly thru a transistor anplifier circuit), however, pin 13 on a M29W is a n/c pin it does nothing. So it appears that you are correct, there really is no hardwire write protect for the entire M29W chip. I intend to study the datasheet in more detail to see what can be done.

edited to correct a misconception that I made without following the traces completely.

another edit.....
I just studied the M29W datasheet and totally agree that there is no hardware protection for this device. Seems as locking each block individually is the only way. Pin 14 protects only the 16k boot block, and the normal trace cut/ground does nothing on the M29W.

I wish I had one to test with, I believe that with the trace cut as usual, this chip will still erase and reprogram.......without pulling the trace to 3.3v.

[skinerd]

Pin 12 for a M29W is RP, and is described below, pulling it to 3.3v doen not sound like it write protects anything.

Reset/Block Temporary Unprotect (RP). The
Reset/Block Temporary Unprotect pin can be
used to apply a Hardware Reset to the memory or
to temporarily unprotect all Blocks that have been
protected.
Note that if VPP/WP is at VIL, then the 16 KByte
outermost boot block will remain protect even if RP
is at VID.
A Hardware Reset is achieved by holding Reset/
Block Temporary Unprotect Low, VIL, for at least
tPLPX. After Reset/Block Temporary Unprotect
goes High, VIH, the memory will be ready for Bus
Read and Bus Write operations after tPHEL or
tRHEL, whichever occurs last. See the Ready/Busy
Output section, Table 15 and Figure 14, Reset/
Temporary Unprotect AC Characteristics for more
details.
Holding RP at VID will temporarily unprotect the
protected Blocks in the memory. Program and
Erase operations on all blocks will be possible.
The transition from VIH to VID must be slower than
tPHPHH.

Pin 14 for a 430 w/m28w or m29w is already isolated, I have traced it, and it goes nowhere, so can be readily grounded to write protect boot sector.

I believe that the normal trace cut along with grounding of pin 14 protects the M29W completely.

[buckbronte]

last month I changed the chip on my receiver from a m29 to a m28. A few days ago the m28 got erased even though it was write protected the old fashioned way.

[skinerd]

last month I changed the chip on my receiver from a m29 to a m28. A few days ago the m28 got erased even though it was write protected the old fashioned way.

I have yet to see a M28W with the erase or scramble problem, not saying it does not happen, I have yet to see it.
With the trace from pin 2 of the CPU cut, I don't see how it could tho.

[buckbronte]

I have yet to see a M28W with the erase or scramble problem, not saying it does not happen, I have yet to see it.
With the trace from pin 2 of the CPU cut, I don't see how it could tho.

Its not an isolated occasion.. I have 4 receivers that i have done this to come back all at the same time..

[skinerd]

Its not an isolated occasion.. I have 4 receivers that i have done this to come back all at the same time..

I have about 12 430's w/m28w out there, and not one has come back, so I don't know what to say.....other than, after cutting the trace and grounding, after programming, try to erase the chip and see what happens.

[buckbronte]

I have about 12 430's w/m28w out there, and not one has come back, so I don't know what to say.....other than, after cutting the trace and grounding, after programming, try to erase the chip and see what happens.

These units were originally with the m29 chip which i converted to a 56 pin tsop using the m58 chip. I program them in a programmer and not via jtag.. Maybe there are some motherboard differences but i dont have an actual m28 ird to check it out.. I have located the problem . They have not erased the tsop but have buggered the EPROM. A reflash of the EPROM cured my problem.

[sdeens]

To: Skinerd

did you find a convenient test pad to ground that pin#14?

I did a simple search and probe and stopped after about 10 or 15 points were checked; its very delicate trying to ohm out that pin/leg and I don't want to damage the legs on the M29W...i guess i will have to flip the board over and continue.

To: Bruckbronte

I like your tech/guide file for reparing the RCA420's..parts and troublshooting.

Did you ever make one like that for the older RCA303/430's..I know they don't break down nearly as muich as the 420/440's...how ironic is that BTW?The older receiver is built better than the smaller and newer receiver it seems.

[buckbronte]

To: Bruckbronte

I like your tech/guide file for reparing the RCA420's..parts and troublshooting.

Did you ever make one like that for the older RCA303/430's..I know they don't break down nearly as muich as the 420/440's...how ironic is that BTW?The older receiver is built better than the smaller and newer receiver it seems.

No I did not. I have only seen one fail and it was a 33 ohm resistor that went on it. Unfortunatly the older receivers are much better quality then the new ones. It seems that the priority back then was to put out a quality product first. With the arrival of the 4th gen RCA ( 222) the priority was cost and not quality. The 4th and 5th gen RCA receiver are the worst satellite receivers in the history of satellite receivers as far as quality goes.. Nobody even comes to a close second. Its a badly designed power supply and not so good tuner. Add the fact that alot of boards don't even have the factory flux washed completly off and you see alot of white residue on them that unfortunatly is eating through the boards.. Oh, well. they keep me busy.. :)

[skinerd]

.................................................. .............................................. Unfortunatly the older receivers are much better quality then the new ones. It seems that the priority back then was to put out a quality product first. With the arrival of the 4th gen RCA ( 222) the priority was cost and not quality. The 4th and 5th gen RCA receiver are the worst satellite receivers in the history of satellite receivers as far as quality goes.. Nobody even comes to a close second. Its a badly designed power supply and not so good tuner. Add the fact that alot of boards don't even have the factory flux washed completly off and you see alot of white residue on them that unfortunatly is eating through the boards.. Oh, well. they keep me busy.. :)

My sentiments exactly.........

[sdeens]

BTW

If anyone needs some RCA303's I have a bunch already modifed for NOZKT.

actually I would prefer to trade them for Charlie hardware and/or cards, but cash is ok. of course computer hardware for trade is always welcomed, provided I NEED it.

PM me if anyone is interested.

and yes I completely agree these older work horses just never fail..I have a stack of bad 420 and 222's so i underastnd what you mean..in another 12 months the failure rate on that 5th gen. model will be shocking, while the 303 will probbaly be still working..:-)

[gearheadib]

HRviolation, how do you change over to the special update mode on the Demo screen? I to have a 430rga with a 29m.I did the mod with what I found around the internet but it does have the trace cut and grounded (pin 2 at the cpu) and pin 14 gounded. But every nite I put it back in the stream dave hits it with a auto update. I have done everything I've read about and I've done alot of research and pin tracing but i'm stumped.I',m beginning to wonder if the 29m can be write protected?

[gearheadib]

thanks i will try it tonight

[borg1]

Interesting....
Will this need to be repeated after each power outage?

[gearheadib]

man I got up this morning and the tha same old thing "updating your software do not unplug" and the old black sreen to go along with it, and this were no power outages last night. I have the trace cuts and the pin groundings and what i think is a good flash. so what am I doing wrong. can a m29 chip be W/P? this 430 is the only one giving me problems can some please help?

[sdeens]

did you also re-program the serial EEPROM with one that is virgin or at the very least the one provided that matches the new 430/431 firmware?

[gearheadib]

no I didn't re-program the eeprom I've never had to do this before on a 420? where do i get the the one that matchs the firmware?

[sdeens]

you mean 430RGA don't you?

read the serial EEPROm with jkeys..save the 16kb file.
launch a program called Flashedit 2.0a2
select EEPROM from pull down tab
open your saved eeprom--see open select box in upper right corner of window
thena save it as a virgin eeprom and re-name it so its not confused with your other eeprom

write it back to 430RGA

the $#)RGA's wit that M29W chip had dual corruption..bot the flash and eeprom were changed...they do not match so go back to virgin and that shoudl cure the problem..you may also want to re-flash the flash again for good measure.

virginizing the serial eerpom will cause you to lose all prefernce settings

[gearheadib]

Ok i kinda anwsered my own ???? I find it here but what address do i save and program? do i use the single location programming?or what

[m5runner]

either volatage works.

[gearheadib]

where can i find Flashedit 2.0a2 ?

[skinerd]

EDITED to correct mistakes on my part.........better lighting and magnification helped me see and understand how the circuit for the m29w is configured......

[skinerd]

I left the trace cut and grounded with a M29W, the entire chip, except for a small section at the very bottom erased......

[skinerd]

=========================

What I think is when Dave updated the flash, he first used pin-14 with Vpp to erase the flash then used pin-2 of the processor with the amplify transistors to write the Flash. As a result, most of the NoZkt receivers, either pin-2 trace cut or grounded without a trace cut, had a "DEAD" symtom, and everybody must reflash the chip again. You're right, Gounding a PIO pin-2 MIGHT screw up the CPU but it was not in my case.
JMHO
CS
I

I have traced pin 14 thoroughly, it dead ends.......NOT true.....see below.......


EDIT>>>>>>>>>>>>after closer inspection, pin 14 of the m29w is what gets powered when pin 2 of the CPU goes high, or 3.3v is applied to the trace cut..........MY APOLOGIES to anyone who read different........I was able to trace it much better with better light and magnification.........

[m5runner]

i have been saying the same thing from day 1. i was the one that even mentioned pin 14. honestly, i don't even know why this thread is still alive.


M5

[skinerd]

i have been saying the same thing from day 1. i was the one that even mentioned pin 14. honestly, i don't even know why this thread is still alive.


M5

It's alive because the M29W problem is still there..

You mention of pin 14 concerned the M28W, which protects fine, so does the Intel, but protecting the M29w still is a problem.

Let's keep this about the M29W, please......

[skinerd]

I have had an opportunity to look closer at the traces on a RGA with the M29W chip. Pin 14 of that chip is what gets turned on off by powering or grounding the trace from pin 2 of the CPU........
It is pulled low by a resistor when no power is applied to the trace from pin 2 of the CPU.......

So all the posts I made about grounding it seperately were in error, it will do nothing that cutting the trace and grounding it will do............

If anyone did ground the place I showed in a photo, or grounded, pin 14 directly, don't worry about it, either case there will be no harm to the receiver.

So here where I stand on the M29W problem............It will erase while there is no power to pin 14 (ie, trace cut and or grounded) but will not reprogram........the normal trace cutting and grounding, grounds pin 14 through a 10k resistor, there is appearantly no hardware lock for the m29w chip, at least I can't determine one............ according to the data sheet, the blocks can be locked by software commands................if anyone wants to do further testing, please do...........BUT test don't speculate....




I edited several posts in this thread, as they were incorrect.........