There are two hardware revisions of the TI USB Graph Silver Link cable: "A" and "B" as denoted by the last character of its production code. Most graph link cables contain a production code of the following format: F-MMYYH with the following decoding:

• F - Factory: I (Inventec, Taiwan), S (Inventec, Shanghai, China), N (Nam Tai, China), P (Inventec, Pudong, China)
  
• MM - Month of manufacture
  
• YY - Year of manufacture
  
• H - Hardware revision: either A or B or absent (see description below)
  

From sometime in the early 2000s through March 2003, the "A" version was manufactured using a Cypress CY7C64013 chipset. Starting around April 2003 through 2010, the "B" hardware version using the TI TUSB3410 was manufactured in various factories. Around 2006, the B hardware revision code was dropped from the production code.
Edit: updated factory list thanks to information from womp below :)

I studied the PCB layouts and captured almost complete schematics for both the "A" and "B" SilverLink boards. The only pieces missing are the capacitor values as these are not labeled and I have no means to measure them. There is always a possibility of schematic error due to inner layers of the PCB.

Silver Link "A": Cypress CY7C64013
The "A" hardware uses the Cypress CY7C64013C chipset which is a 5V Full-speed USB controller containing a 12MHz custom "M8" 8-bit CPU, 256 bytes RAM, and 8KB PROM (sometimes listed as EEPROM). I have so far been unable to dump the PROM data from inside the chip. The documentation references using the Hi-Lo System-Cypress USB Programmer (CY3649) along with an adapter base board (CY3083-SC28), but I have yet to come across documentation on the programming sequence for this model for use with 3rd-party programmers. The only thing I've been able to deduce is that Vpp should be tied to 12V during the programming sequence. In the pursuit of knowledge, I have sacrificed an "A" SilverLink to move the CY7C64013C to a breakout board for further probing. If anyone has more details on the programming and verification sequence of this chipset, please let me know.


"A" Schematic


Silver Link "B": TI TUSB3410
The "B" hardware uses the TI TUSB3410 chipset which is a 3.3V USB 2.0 Full-Speed controller containing an integrated 24MHz 8052 microcontroller, 256 bytes of Data RAM, 2KB shared RAM, 10KB of ROM, and 16KB of Code RAM for loading firmware from an externally attached EEPROM. The EEPROM is attached via an I2C bus and the ROM code contains a bootloader to read the header from the EEPROM and automatically load and start running the firmware. This makes it easy to dump the firmware by simply observing the I2C accesses off the EEPROM pins upon powering it up.


"B" Schematic


The KiCad schematics and the "B" revision 8052 firmware disassembly are included in a repository for preservation. Perhaps it is useful for recovering SilverLink whose EEPROMs have failed over their lifetime or for people wanting to design their own clones. To understand it better, I am working on decompiling the "B" micro-controller firmware. I'll post updates here if I uncover anything. https://github.com/queueRAM/ti_graph_link

Very nice! Always nice to see that others are out there documenting these things.
According to my docs, there's a pre-A revision made by Inventec Shanghai in 2006
New ones are also pre-A but manufactured by Nam Tai.

Interesting, thanks for sharing

Cool, it's nice to have design information for an "official" silverlink to complement the clone that exists.

Have you considered sharing your schematics and perhaps the ROM in the archives?

Thanks for this info! By "pre-A" do you mean just not listed A or B? In my search, I observed the P and S lacking the hardware revision letter, but actually containing the TI TUSB3410 chipset used in the B revision. I had not come across any N. How did you deduce the origin of who manufactured it?

From my notes, I have seen the following labels:

• No production code: Cypress chipset, clear USB and graph link connectors
  
• I-0502A
  
• I-0602A
  
• I-0702A
  
• I-0802A
  
• I-0303A
  
• I-0403B
  
• I-0503B
  
• I-0603B
  
• I-0803B
  
• I-0304B
  
• I-0904B
  
• I-0105B
  
• I-0205B
  
• I-0505B
  
• S-0806: TI chipset
  
• P-0310: TI chipset
  
• N-0818: TI chipset?
  

Thanks, I uploaded an archive there as well, pending approval: https://www.cemetech.net/downloads/files/2129/x2302

Yes, by pre-A, I mean no revision.
Here are the datecode ranges in the sheet:

• pre-A S 0806
  
• pre-A N 0818
  
• A I 0402-0303
  
• B I 0403-0105

The factories are documented. "I" is Inventec, Taiwan and "P" is Inventec, Pudong
Looks like your I-0505B extends the range by a few months.
Do you happen to have a screenshot of the P-0310? I don't recall ever seeing a graphlink from Pudong.

Thanks for the info. I actually picked up the P-0310 recently. I haven't cracked it open yet, but here are some pictures showing that it is based on the TI chipset. I will take some more of the PCB when I open it to dump the firmware.

Oh god, womp is going to start making me send him pics of my SilverLink PCBs...

I-0402A here, so right within the existing datecode range.

Dumping "B" Firmware
For the B hardware with the TUSB3410 chipset, the firmware is stored in the external 24LC64 (PDF) EEPROM. To dump the firmware, you could connect up an I2C host and read it out, but I found it easier to connect a logic analyzer to the I2C pins as the TUSB3410 reads header and firmware out from the EEPROM at boot. Pin 4 is the GND, pin 5 SDA, pin6 SCL. Since it is the SOIC package, it was easy to use test hooks to grab onto the pins.


The bus is operated at 400kHz and takes about 0.25 seconds to read out the header and the 0x1400 byte firmware.


The TUSB3410 bootloader read the first two bytes, confirms they are 0x10, 0x34, then reads the remaining 4 bytes of the header. The header contains the type, size, and checksum of the payload. It then reads the entire payload in one burst. In the USB graph link's case, the payload is 0x1400 bytes and checksum is 0x5A (least-significant byte of the sum of payload bytes).

Code:


Dumping "A" Firmware
I haven't gotten far with dumping the A firmware. The CY7C64013 has an internal PROM where the firmware is stored and is allegedly write-once. The documentation references using the Hi-Lo System-Cypress USB Programmer (CY3649) along with an adapter base board (CY3083-SC28). I have not found documentation on the programming sequence for this model for use with 3rd-party programmers.

All I know is Vpp must be pulled up to 12V. Since it is grounded on the PCB and I may have to sequence other pins, I sacrificed one I-0502A and desoldered the CY7C64013 and mounted it on a breakout board. I lack the proper tools, so the graph link PCB is no longer usable, but posting a picture here so people can see the traces underneath which I used to complete the schematic.


It's looking unlikely I'll be able to dump the CY7C64013 firmware, but I'll post an update if I ever do. I would love to hear if anyone knows about CY7C64013 programming or Cypress PROM chips in general.

I had a go at looking for information on programming CY7C chips and didn't find anything useful. It's not clear if they ever published programming specifications, and if they did they've been lost in various website reconfigurations.

I did find evidence that at least a few "universal" programmers support these chips, but they're quite expensive: Xeltek's SUPERPRO 6100/N specifically lists CY7C64013 support but sells for upwards of $1500. eeTools' TopMaxII also seems to support CY7Cxxx devices according to the accompanying software manual and costs about half as much (still a lot), but it's unclear if that support includes older PROM-based devices or only newer ones.

Since I had a couple of TUSB3410 micro controllers laying around, I bread boarded the B version of the Silverlink to see what would happen. It worked! Here it is attached to the TI-83 Plus:



A close up of the bread boarded circuit:



I should point out some changes I made in order to accommodate the components I had at hand:

For the crystal oscillator I used 22pF instead of 33pF.
Used the 1N4148 diode instead of the BAS16W.
For the USB connector I used 27Ω instead of 22Ω resistors.
For the 1.8V voltage divider I used 15kΩ and 18kΩ instead of 90.5kΩ and 100kΩ.
For the resistor between pins 1 and 9 I used 33kΩ instead of 32.4kΩ;.
The 3.3V voltage regulator I used is the MCP17003302E as I don't have the TPS71533.
Instead of the IMH8A I used a couple of PN2222A transistors.
The I2C EEPROM I used is the 24LC256 instead of the 24LC64.
The schottky diodes I have are the MBR150, so I used those instead of the RB471E.
The TUSB3410 datasheet makes a big deal of using a decoupling capacitor between VDD18 and ground. So I placed a 0.1uF capacitor between pin 4 and ground.
I didn't include the inductor/capacitor filter that goes to the 2.5mm connector wire. Actually connecting the TIP and RING wires directly to the TUSB3410 seems to work also.
I also added a green LED + 330Ω; resistor so I know the USB cable is connected to the computer.
I left the WP pin of the EEPROM unconnected, so to prevent potential memory corruption during testing.

The bread boarded circuit connects just fine to the computer:



TI Connect for the TI-83 Plus works fine with the bread boarded silverlink:



I compiled and generated the binary file for the 24LC256 EEPROM as for the instructions posted in the GitHub repository in the messages above (using sdcc and the 'generate_eeprom.py' script). I used a TL866II programmer to load the binary file into 24LC256 EEPROM. For some reason the binary I created had a checksum of 0x57 instead of 0x5A, but seems to work nevertheless. In the image below notice the 6-byte header with the checksum set to 0x57.

That's pretty cool! Should we conclude that since you haven't noted any further success with dumping the on-chip ROM the device only needs the firmware from external memory to function as expected?

This is indeed great work

Congrats, that's really cool!

For hardware version B, the one with the TUSB3410, it only needs the binary in the external I2C EEPROM.

okrayo, this is absolutely beautiful work and on a very clean bread board too
I looked through your list of part replacements and everything sounds very reasonable. I'd have to admit I'm a little envious of your TUSB3410 stash. I haven't been able to track any down yet, but would love to learn from your process and attempt to recreate your setup when I'm able to. I'll capture the schematic for your setup and add it to the repo in case it helps others.


For direct wiring and short distance, agree the filter isn't required. However, if building for the masses, would want to include this. I don't know too much about filter circuitry, but I simulated this a little bit in SPICE and there was no difference for nominal signals with or without the filter. You definitely need the transistor and diode there so glad to see that included.


Interesting, the repo should build a byte-compatible version of the TUSB3410 firmware and I've successfully tested this on a couple different versions of sdcc and python on Linux and macOS. Which versions are you using and any chance you can send me the resulting binaries so I can inspect? I'm glad it's working, so I assume the checksum is being computed correctly, but I suspect there might be some byte differences in the code emitted.


Exactly, version B uses the TUSB3410 32-LQFP + I2C EEPROM in comparison to version A which uses the Cypress CY7C64013 with integrated PROM. Version B is relatively easy to dump the EEPROM as it is externally connected and is transferred by the TUSB3410 automatically during power-on. I dumped this, and disassembled, and have been annotating the version B TUSB3410 FW in ti_graph_link_silver.asm

I still haven't been able to find a way to dump the FW from CY7C64013 in version A. I experimented briefly with tying the Vpp to 12V, but I don't know more about the programming sequence to request data out of it. If anyone has any ideas, I'm willing to try

Well thanks! I bought a couple of TUSB3410 (LQFP32) from DigiKey many years ago for evaluation. I never used the TUSB3410 for anything as they were too expensive compared to other parts with similar functionality. Until just a few days ago DigiKey still had stock of the LQFP32 but now it is gone. DigiKey still has stock of the 32-QFN package (June 20, 2023), but the TUSB3410 is not longer manufactured, according to DigiKey, and once the stock is depleted it will not longer be available. Mouser, on the other hand, says that they are expecting a shipment of thousands of TUSB3410 next year...



I turned out I was using a very old version of sdcc: 2.9.7. After generating the file with sdcc version 4.2.0 the checksum is indeed 0x5A.

Very nice, glad to hear you figured it out! Oldest sdcc version I tested was 3.8.0 on debian and that seemed to match in binary output and checksum.

I captured the schematic for your breadboard in case it's of use to anyone. It's currently in a branch on my repo, but I'll merge it to main and add notes to the README if you approve. I think I gathered all your changes that you described and from your breadboard picture, except maybe not all the bypass caps on the 3.3V. Hope you don't mind, but I also included your "okrayo" name in there to give credit where it is due

"okrayo" Breadboard Schematic

Nice! Just some corrections:

C2: 1uF
C4: 1uF
Rok1: 330Ω

The MC17003302E datasheet says that 1uF ceramic capacitors must be added both to the input and output.

For good measure I added 4 x 0.1uF ceramic capacitors between the 3.3V rail and ground: two to the left and two to the right.

I approve whatever you want!