| Electronics > Repair |
| Reverse engineer Dallas DS1742W? |
| << < (10/15) > >> |
| sicco:
Thank you james_s. Studied the hi-res pictures, almost done reverse engineering the tracks on both sides. A0 from mainboard skipped, A1-A19 on Tek mainboard to A0-A18 of the 16 databits bits wide 29AM008 flash ROM. Still in doubt a little bit on the /CS, /WE, /OE, BYTE/WORD lines for the 29AM008. Would you mind helping me confirm a few tracks where I’m not 100% sure yet? As in beep through from 100 pin connector to the 74LC245 and the 74LC08 chips? Like is it using CE1 or CE2, WE1 or WE2? HRST? And what code goes into the 74LC245 for board ID? No idea yet how to get the hex code. Assuming it is read only in normal use. Speculating the hex file can be read out via the 100 pin connector, and written back via the same route. But i doubt the Tek firmware will do any of that for us. So another project on the horizon, Flash rom copy tool... Will need reflashing anyway as only 20 years data retention is promised by the AMD datasheet :scared: |
| james_s:
Yeah I can take it apart again and check a few things when I have a chance. I'm hoping that it lasts longer than 20 years in the real world, usually this stuff does. Actually this ethernet interface doesn't seem all that useful, I have a GPIB module I usually use instead and if I want to get screenshots off the scope I use the floppy drive. |
| sicco:
James_s, see pictures attached on where I'm not 100% sure yet. I intend to leave out the 74LC245 bufferes and the 74LC08. Can you beep through and check these assumptions: U170 pin 47 goes to VCC or GND or is it left floating? R100 left side goes to U170 pin 11? Or 12? Or elsewhere? U180 pin 15 goes to U150 pin 15 goes to U140 pin 5? U160 is just pass through buffer with pins 11, 12, 13 not used and 10, 5 and 1 to VCC (=14)? Pins 1 and 2 puzzle me here. U110 pin 1 goes to U170 pin 28? And to U140 pin 8? Or is it U170 pin 4 to to U160 pin 3? U140 pin 7 to U160 pin 2? U140 pin 11 to 100pins connector pin 66? U140 pin 12 to 100pins connector pin 81? U140 pin 13 to 100pins connector pin 79? U140 pin 14 to 100pins connector pin 78? U140 pin 15 to 100pins connector pin 76? U140 pin 16 to 100pins connector pin 74? |
| Finderbinder:
Just did RTC battery mod/replacement on my TDS3012B without board removing: |
| sicco:
Nice job Finderinder! I took my plugin board with the DS1744W RTC alternative another step further. Now have the Ethernet (for not -b and not -c models) TDS3EM emulation part working also. The flash eprom on a TDS3EM only has the MAC address in it as ASCII string. So no code for network stacks in there. Just 18 bytes for 00:01:02:03:04:05<null> if the MAC address is 00 01 02 03 04 05... What a waste of flash rom megabytes... Also found out the hard way that the NVRAM (so the DS1742W originally) does hold some Ethernet networking relevant parameters. And those do not get reset-to-good values with holding TRIG-B button at reboot time. Something related to network name and network type. Only loading the NVRAM with the 2kbyte data image as found elsewhere on this forum makes the TDS3EM (/equivalent) network work as advertised. A NVRAM with all zeros or all 0xff bytes does not work properly when ethernetworking! Like DHCP does not work if enabled - the scope goes into cyclic reboots. NB be aware that the scope as web page (e*Scope) only works on the -b and -c models. I used a NI how-to-ethernet-TDS3000 web page that Google hinted at - but that doesn't say it will not work for not -b not -c models... Enabling mechanism for the extensive self-test diagnostics second serial port output is clearer to me also now: the TENA line (pin 17 on 100 pins expansion port) needs a 4k7 pull down to GND. Looks like at boot-up, it's configured as input with weak pull-up, then sensed, and thereafter it becomes a network controller output instead of general purpose i/o pin. Also I noticed that on the original TDS3EM on TX (pin 15) there's a 47k pullup to +5V. Here's what it says on the diagnostics output (TTL serial, 38400,n,8,1, pin 13) when all works finally after reloading the RTC NVRAM with file (bin.bin is the RTC 2k binary data) attached: ▒▒▒UUUUUUUUUUUUUUUUUUUU Loading Image Boot flash checksum OK Code flash checksum OK 0x00800000 bytes of RAM found DRAM address line check OK DRAM data line check OK NVRAM address line check OK NVRAM data line check OK TBC ACQ SRAM address line check OK TBC ACQ SRAM data line check OK TBC Display SRAM address line check OK TBC Display SRAM data line check OK SuperI/O ID 0x000000b2 Uncompressing code from 0xffc40010 size 0x001e0927 Enabling cache Entering usrRoot Enabling the MMU sysClkRateSet using 25 MHz Enabling I/O system excInit called Class 17 Level 3 hwResetTBC(): Installing Machine Check Exception handler. 15:17:52 12/29/2020 (thread: StartUp) Class 7 Level 3 hwI2CAppKeySearch: new device I2C/APPKEY1 slot 1 addr 0xa0 15:17:52 12/29/2020 (thread: StartUp) Class 7 Level 3 hwI2CAppKeySearch: new device I2C/APPKEY2 slot 2 addr 0xa2 15:17:52 12/29/2020 (thread: StartUp) TBC reset count = 2 Class 2 Level 3 acqWaitForAcqDone: timed out, sysjmp = 0x5 15:17:54 12/29/2020 (thread: StartUp) Attaching network interface qu0... done. Attaching network interface lo0... done. NFS client support not included. Starting VXI-11 service...Core channel...Abort channel...ready. Other achievement: can now do a 'no soldering - no main board patch wires' RTC expansion port plug-in module. For that I edited the boot rom code so that CS2 for the NVRAM-RTC at 0x02800000 becomes CS5, and CS5 at 0x05000000 becomes CS2. The nice thing was that the boot rom checksum remains the same despite the edits. The plugin module RTC DS1744 then uses CE1, pin 78. But then we cannot have the TDS3EM Ethernet module emulation because that needs CE1 for its flash rom... Also it appears that once plugin modules are detected at boot-up time, some application code rewrites the PowerPC MMU glue-less registers again, so redefines CS2 and CS5 and then we're lost again. But still, it is possible to do a no-soldering expansion port DS1742W-dead battery to DS1744W-another-10-years, without even opening up the TDS3000 scope! However, on the downside, you do need a BDM interface like the Abatron BDI2000 that I used here. Plus: I have started to offer these "DS1744W-another-10-years" plugin boards on eBay now. So serial, isolated, USB, ESP32-WiFi, ESP32-Bluetooth, RS232, Ethernet - and a 10 pins BDM header (in he next revision). |
| Navigation |
| Message Index |
| Next page |
| Previous page |