TDS3014 adventures

[Maxis]

Hello Sicco!

Thank you for your detailed reply!

I would use your board with the pleasure, but I'd like to do my learning kinda hands on the project.
There are a few points which are not quite clear yet:

1. As you have kindly explained - the information in the Dallas chip is vital for proper Ethernet functioning.
But the question is - how these bytes made its way into the Dallas at the first place?
Normally if I just borrow TDS3EM from someone it will work straight away, right? If so, then I can assume that beforehand I can check whether the settings are correct with the stock TDS3EM and only then use your baseline schematics.
Also what I know there is no need in "harmonizing" Dallas prior to installation of TDS3EM module. Otherwise Tek would supply the floppy with the specific license installer to perform Dallas NVRAM "harmonization" (often this is how it's done on Agilent equipment).
If all the above fails with the stock TDS3EM, then I can assume that the NVRAM is corrupted and then I need to use your NVRAM image, right?

2. You have mentioned that I can use the BDM port to program. By looking at the connector pinout on your schematics I've got to use not only JTAG lines (TCK, TDO, TDI + Hard Reset + Soft Reset + IRQ6), but also I need to connect the TXD_SM and RXD_SM UART lines, right? Cause as you mentioned all the FW debug messages are communicated via the UART SM port.

3. The option module already has everything loaded thanks to the awesome contributors of this forum! However, I wonder how do you get a transparent access to the devices connected to PowerQuicc via BDM. Do you need to load a debug portion of the code into PowerQuicc prior to it, or BDM uses the bit-banging protocol like in the case of JTAG? Have you developed the tools to emulate the bus access via PowerQuicc pins or you used the standard facilities of the BDM debugger?

Thank you very much for your help!

[sicco]

Maxis,

If you plug in a working borrowed-from-someone- TDS3EM then your TDS3000 may or may not work. If the scope’s NVRAM no longer has its original ex-factory ethernet config bytes properly set then it (ethernet) will not work. A dead battery in the NVRAM means original settings data is lost.

To get the NVRAM reloaded with a working image, it’s either eject from a DIP 24 socket (which i envision you have by now) or desolder the DIP24 DS1742W and use an old EPROM programmer, or use BDM. There might be utilities using floppy disks, maybe serial port backdoors, but i’m unaware of those.

The BDM port is explained in some detail in the NXP datasheet / XPC8xx user manual. It shares some but not all of the JTAG pins. The serial port (UART1 or 2) is not needed. But BDM is a legacy. Initially JTAG was for testing hardware pins, while BDM was for in circuit debugging. Nowadays JTAG is for everything. But not yet on this CPU. BDM for this CPU is more about pushing opcodes into the CPU that the PowerPC then executes, single step, when halted. Hardware needed for BDM to USB to PC is just an FTDI2232 or FT4232 with its eprom, xtal etc. Software is a lot more...

[Maxis]

Hello Sicco,

Thank you for clarifying the subject. In my scope the NVRAM is still alive and kicking. So, I'll try with its stock content hoping that everything will work w/o its reprogramming. I'll post here any updates on this subject!

[james_s]

Surely there's a way to write to the NVRAM using GPIB or serial commands? Of course you'd have to know the address where the relevant info is stored.

[SMdude]

Hi Guys,

Does anybody have any info on the battery gas gauge used in the li-ion packs?
After buying one from ebay and having it confiscated by the "global shipping program" (yes I got a full refund, but I still don't have a battery!) I have now resigned to the fact that I will just have to build a battery for it instead. So it would be nice for completeness sake if the fuel gauge would work. I'll probably start a new thread for it in the coming weeks, just trying to gather as much info in the mean time.
Looking at the available space a 4s3p pack/setup will fit nicely with room for the protection cct and charger board.
Housing will be 3d printed.

Any photos or info would be greatly appreciated.

Cheers

[rauldm]

I changed battery to nvram in a TDS3014b, ethernet configuration is not work today, i clear nvram with trig b and I go to devel mode with select button to start, this cleared hours, power on counter and errors, but ethernet still Is not working.

[sicco]

That’s consistent with what i wrote in my earlier posts in March. It can be fixed. Load the binary images as provided in those posts  into your DS1742.

The ‘TDS3000 second life light’ plugin boards that i made enable in-situ DS1742W editing from a PC over USB.
If you find my ‘second life’ boards too expensive then desolder the DS1742W NVRAM ic from the tds3014b mainboard and get an old style DIP24 eprom programmer that programs/writes 3.3V DIP24 chips like the DS1742W.

I have seen no options yet for editing the DW1742W in-situ via GPIB or RS232 or printer port.

(ps the ‘second life boards’ also have board space for a DS1744W that can take over the role of the old DS1742 that can stay on the main board - but right now you don’t need this. All you need now is an easy way to edit the DS1742 that you’ve revitalised with a new battery. The second life boards with BDM interface provide that)

[james_s]

IIRC it is possible to write to memory locations via GPIB, but I have no idea where the NVRAM sits in the address space.

[sicco]

It’s at byte address 0x02800000 of the PowerPC physical memory map. You think there’s a peek and poke for its bytes via GPIB? I’d be surprised, but maybe…

[rauldm]

Sicco, I'm from México, how can Buy your secondlife board?, I like because it has vga Port right?

[rauldm]

Can You sell in Amazon?, Amazon is very safe un México. Regards.

[james_s]

Well you can write values to change the model number to upgrade the bandwidth, I just assumed it was possible to write to other locations as well.

[sicco]

@Raulm, I have 4 boards left with only the FTDI4232 chip for USB to BDM populated. With those you can edit the DS1742W content in-situ. Or reflash the entire TDS3000 ROMs. Or use the two serial ports as USB COM ports.

These 4 boards are not 100% perfect yet: without a PC connected that runs the program that I attach here, it blocks booting of the scope after a power on. That's because without initialisation, the FTDI4232 chip that I use forces a BDM pin high that normally is pulled low when its not connected... Should not be a problem for you because I'd expect you only use the board to edit what's in your DS1742W, and then unplug it again.

Here's how you'd use it:
1. Insert in the board in the scope expansion connector, components side of the board facing down (important!).   
2. Wire micro USB cable to Windows PC, PC powered on.
3. Power on the scope. It will give a white screen, because the CPU is held in waiting for BDM mode (as per problem/hardware bug mentioned above).
4. Run from command prompt the utility BDM.EXE (it's in the zip attached, under \bin\Release - but C source code is in the zip. It's a Code::Blocks project).
5. If FTDI drivers are OK, then tool finds the FT4232H chip, senses the PowerPC CPU and tells you what it sees as DS1742W chip, battery status, and gives a menu of options after you hit <enter>.
6. The TDS3000 will boot up normally after you type H (capital h). That's a hard reset for the PowerPC.
7. Quit (type q) and restart the BDM.exe tool.
8. First thing to do: back up your flash ROM, back up your NVRAM. That's option r for the ROMs and when it's done with that (~5 minutes), pick option c for the NVRAM. You get a time/date stamp in the .BIN file names that it makes for you.
9. To overwrite the NVRAM, copy the binary data that you want in it to a file named tekRTC_DS1742W.bin and pick option w. The default one that's in the zip does correct your Ethernet issue.

Overwriting the entire flash ROMs (say you have a v3.41 firmware in a TDS3014, so with only 100 MHz scope bandwidth, but would prefer your scope to behave as a TDS3054 with 500 MHz bandwidth) then then tool allows you to do so, in a bit more brute force way then the BULLDOG trick over its serial or GPIB port. This should work for the newer -c TDS3000 models also, but I have not had the opportunity to try it out. Also I do not have those rom images yet.

Likewise, if you'd like to have your option module(s) edited to TDS3ENG, then the tool can do so for you with the option modules in-place in the front/side panel.

Check first if you can run this code at your end. So without a USB plugged in. Because if not then there's no point shipping boards...
Finally, no need necessarily to use 'my' boards, you can also get a 'FTDT2232H mini module' and manually solder the 7 or so BDM wires on the 100 pins main board connector. 

[rauldm]

I found in other post, the serial port I think is uart level because original tds modules comes with uart-rs232 IC, is located on
68 TxD
69 RxD
70 RTS
71 CTS
from expansion connector, with BDM.exe program and uart USB converter can be program the NVRAM?

[rauldm]

I read more about topic, the FT2232H is for access with JTAG, I hacked my oscilloscope because is coming with old firmware, after, I updated to 3.41 and change the floppy for USB emulator, I like ethernet interface for get images to PC, but I think only work with USB now. I hope find a FT2232H. I have also the TDS3ENG, I programed an eeprom that I got from old ram memmory, I wrote it with Arduino. I have two tds, 3012b and 3014b, first is only 800 hours and still works the NVRAM battery, I got the 3014b with 11000 hours, the battery was near to dead, but still kept SPC constants and some settings, each reboot I lost the backlight setting and time/date.

[sicco]

[ Specified attachment is not available ]Raulm, you're on the right track I think. Just to clarify a bit more: the FTDI USB chips are generic units that can be used as UARTs, or as JTAG, or as BDM ports. Or I2C or SPI or whatever. Or as a mix thereof. The FT2232H has two 8 bits ports, the FT4232H has 4. So if you have two serial ports and a BDM port, and want to use them all at the same time, then the FT4232H is the best choice. For now I think you only need the BDM function with maybe one serial port (because you like to copy screen dumps to your PC?).

JTAG is irrelevant here even though the legacy PowerPC CPU XPC860 has JTAG, you cannot really use it in a TDS3000 because there's a pin for it (TMOD) soldered to a power supply rail, right under the BGA, so pretty much impossible to cut that line. But the BDM (a legacy Motorola/Freescale/NXP backdoor debug port, somewhat like JTAG but not quite...) interface does has its pins wired to the expansion connector. So that we use. As per the schematics shared in this forum, but here it is again in pdf attached. Be aware of different styles for pin numbering - that's because it's a PCB edge connector in this design, not the official 100 pin Molex connector.

Besides BDM, the TDS3000 100 pin expansion connector has two TTL level serial ports. One is without CTS/RTS handshake lines and is a VxWorks monitoring / ex factory testing line, the other is the serial (RS232) port that's on user i/o modules like TDS3VM and others. The latter is what you listed. It's also the port for a serial printer and for https://www.eevblog.com/forum/testgear/tds-1000-2000-3000-bw-hack/. That's a hack at application level. The BDM port is about diving at a much lower, deeper level, peeking and poking right into the hardware, halting and single stepping the PowerPC CPU. Or reflashing the ROMs. Or peeking into the other i/o on board. Or pinging its I2C bus that goes to the front panel.

If for you it's only about editing the NVRAM via BDM, then you don't need any of these serial ports now. Just BDM.

The relevant pins for BDM are: TDO, TDI, TCK, SRST, HRST, IRQ6 and GND. Those go to a MAASP port on the FTDI chip. The program I shared assumes you wire the 8 TTL level bidirectional I/O lines from either a FT2232H or a FT4232H, like this:
ABUS0 -> TCK
ABUS1 -> TDI
ABUS2 -> TDO
ABUS3 -> not used
ABUS4 -> SRST
ABUS5 -> IRQ6
ABUS6 -> HRST
ABUS7 -> not used
GND -> GND
 
Or, as it's coded in the .h file,
#define MASK_DSCK   0b00000001
#define MASK_DSDI   0b00000010
#define MASK_DSDO   0b00000100
#define MASK_SRESET 0b00010000
#define MASK_FRZ    0b00100000
#define MASK_HRESET 0b01000000
#define MASK_NEN245 0b10000000

I've mixed up naming conventions for JTAG and BDM - the XPC860 uses many of the same pins for either BDM or JTAG. But you get the idea I think.

 second_life_tds3000_light_FT4232H.pdf (320.37 kB - downloaded 187 times.)

[rauldm]

I can't to run de BDM.exe Windows says it want  libwinpthread-1.dll to run, I install codeblocks ando doesn't work too. I found also some generic FT2232H from Aliexpress looks fine.

[sicco]

The DLL missing from MinGW / gcc is a common issue. Do a quick Google search on the DLL that was missing.

See also https://stackoverflow.com/questions/18138635/mingw-exe-requires-a-few-gcc-dlls-regardless-of-the-code

I think you just need to download the DLLs and place them in same folder as where your bdm.exe is.

[rauldm]

@sicco I put DLL in same folder and works now, I will buy  a FT2232H from aliexpress. My scope rebots when I select DHCP mode in ethernet, my other oscilloscope TDS3012B can be configured in DHCP, if not is assigned IP address only I get a leyend on screen.

[Jarek]

Hello everyone
I also had a problem with the ethernet connection on my TDS3032. For me, it was helpful to connect the TP-Link WA855RE WIFI amplifier to the oscilloscope.
It was enough to log in (DHCP mode  in oscilloscope). Test conection was OK
Enter the address returned by the oscilloscope in the webb browser.

[rauldm]

Thanks Jarek, but, are you changed battery inside of NVRAM? when you changing the battery you corrupting nvram information for ethernet

[Jarek]

I did not replace the battery yet , but I could not connect to the network, only what I wrote helped.
(TDS3032B Model)

[sicco]

Oops - an error in the schematics that I shared as pdf last month: the SN74LVC245ADWR IC3 that I added in the TCK (DSCK) and TDO (DSDO) lines: forget that buffering. First error: I mixed up in and out: the second buffer should have been in the TDI line, not in TDO. Second error: the IC3 SN74LVC245ADWR appears not to have enough muscle to decently pass a logic  high level to the XPC860 CPU input which has a pull down resistor on the main board.

PS Note the ESP32 DEVKITC U1 and U9 and U10 and U11 are not needed - they are for WiFi/Bluetooth and for an attempt to restore a dead battery DS1742W via yet another trick: not adding the DS1744W U2, but instead leave and keep using the existing dead battery DS1742W but overwrite its content via the BDM interface at power on reset time, setting the clock from another RTC on this board. And then catching every write cycle over BDM with breakpoints - so let an Arduino program do all that from the EPS32 - but that was all a bit too much for now, so did not finish that.   

@Rauldm: did you get it working ok now with your AliExpress FT2232 module?

[rauldm]

Hi Sicco still doesn't arrive my package.
Regards.

[sicco]

Here's an update of my TDS3000 BDM backdoor USB FT4232 interface PC control program. With a bit of user instructions. Ping me with a PM if you want source code. I've omitted the TDS3K binary rom images in this zip - they are 4MB each and that made it too large to post here...

Plug-in board hardware details shared before in this thread - no big change there except for the fact that I decided to power all FT4232 VDD pins from the USB connector instead of partly from/by the scope.
Starting to also better understand now how the Tektronix DPO acquisition concept works and what those Micron MT 128k  SRAMs do for video display and acquisition RAMs, and where those sit in the MPC860 PPC memory map. But still frustrated that we cannot find anywhere the super secret NS datasheets anywhere for the MM9595 ADG360C ADG460C ADG365 361 etc. Anyone out there that has these?