TDS3014 adventures

[lecatron07]

HELLO ALL

I HAVE A TDS3034 SCOPE AND THE SCOPE IS STUCK AT THE FIRMWARE UPDATE SCREEN I TRIED FIRMWARE UPDATING IT KEEP SAYING COULDN'T READ THE FIRMWARE FROMM FLOPPY DISK
IT DOESN'T PASS THE SCREEN (IT USED TO PASS IT SOMETIMES)
IS THERE ANY WAY I CAN FIX THE PROBLEM IN THE SCOPE

[coromonadalix]

pls dont write in capital letter, it sound like  yelling  loll


an a tds3k, i had to find an used usb to floppy drive and format floppies, to be sure they where okay it created a set of floppies

[lecatron07]

hahaha .. i was excited when i was writing ..

i used a dpo7104 as a floppy writer, 4 floppy disks are ready
but the scope is not accepting them or for some reason is not reading them as in the pictures



 

[rauldm]

You can try depress and hold select key or b-trig when you turn on the scope. With select key you can access to devel menu

[sicco]

If new diskettes and a new floppy disk drive do not solve the issue, and/or,
if upgrading the 1.44" disk drive to a USB drive adapter does not solve it, then,
you might try the BDM adapter discussed extensively in this forum thread. That allows for a complete erase of the flash rom chips, and then a reprogramming of them. That will get your scope running again.

The firmware upgrade via diskettes is only modifying the application program, but keeps the VxWorks bootloader rom section as-is. The BDM backdoor adapter allows for a full wipe and re-imaging of the TDS3000 motherboard flash rom.

[lecatron07]

rauldm i tried that it doesn't boot
it stays at the update stage

sicco  i tried the floppy but i will try your BDM
i may buy a FTDI4232  board and test with your software

[sprit]

Hello, have a good day everyone.

I know this topic is quite old but I just encountered a problem and hope you can help.
I have a TDS3032B scope, after the DS1742W battery died, I tried to replace the CMOS battery for it and then I got this situation. The display is blank or stuck at the welcome screen. I don't know what's wrong with it...
I don't have a TDS3GM/GV card, I'm ordering the FT4232 controller board, it should arrive in a few days. But when looking at this pinout I got confused, does anyone know how to arrange their numbers? I don't know the location of pins 2,3,4,...etc, except for pin 1, which I guess is a square pinout like the picture. Can anyone help me? Thank you very much <3
Sincerely,

JingFeng

[picburner]

The pinout is as per the attached pic.

[sicco]

The formal pin numbering is as in the previous post.
However, the ‘budget version’ plugin board that i designed uses a different numbering convention. That’s because the budget board uses pcb edge connector instead of the https://eu.mouser.com/ProductDetail/TE-Connectivity/1-1734099-0?qs=sGAEpiMZZMvlX3nhDDO4AKFmralhIPMMK7YJ2cTxry4%3D.

PS pressing the B-Trig button while scope powers up may also reset the NVRAM to a state where boot procedure does work. But ethernet MAC address will not be restored.

[sprit]

Thank you very much <3

[sprit]

Hi Sicco. Thank you for your contributions. Hope you have a nice day.
I tried pressing the B-Trig button but everything is still the same. Looks like my DS1742 has some problem or is broken. I tried taking it apart and the scope still has the same problem-white screen or stuck on logo . Can you tell me if I can get a DS1742 from another range instead and reprogram it? I only have the RT4232 USB. Thank you very much.
Sincerely
JingFeng

[sicco]

JingFeng,

Options are:
* The james_s DS1744 adapter board.
* Replacement units such as https://www.ebay.com/itm/293776182478
* The ‘second life’ budget board that plugs into the 100 pin connector.

Advantage of the ‘second life’ board is that it gets you lots of diagnostics from a tds3000 board that does not boot ok.  It enables reading/writing the RTC data via BDM via USB. It also enables capturing of the VxWorks system boot log.

[DC_to_Light]

Looks like I am joining the party, with a TDS3054B and a DS1742W that has lost its mind.

I've extracted the DS1742W, milled away 0.030" of the top plastic to get to the battery.
The top terminal of the battery is GND and connected to package pin 12.
I used a hot soldering iron (to soften the potting compound) and various picking tools to
dig down in the area between pin 13 and the battery perimeter, till I got to the battery
positive terminal.

The positive terminal is also exposed as the shell of the battery. My battery measures
0.673 mV, and at such high impedance that my 10 MOhm/V multimeter causes the voltage
to slowly drop. I soldered a red wire to the exposed positive terminal of the battery, and
cut the negative side of the battery terminal at the point where it gets thin. Unfortunately
I had not connected the new battery yet, and lost the  "NV"RAM contents.     
Anyway, I added a CR2032, restarted the scope with B-Trig, and after warm up, successfully
ran SPC.  This passed, and the clock now keeps time reasonably accurately.
What does not work is ethernet, and I have the same issues as other people. From my
reading, it seems I need to load a valid image into the DS1742W to restore the ethernet
functionality.

1)  Is the 3054 image supplied at the end of article 99 of this thread the image I need,
     and if not, where do I get it?
2)  How do people load the image into a repaired DS1742.
     My programmer does not know about the DS1742W, but does know about the DS1220AB
     Unfortunately all versions of DS1220xx are 5V parts, so my programmer (Advin P44+)
     will set VCC to 5V, and the signal thresholds appropriately. This could destroy my DS1742W.

     A)  Is there some other suggested device that has the same pinout, but is 3.3V?

     B)  Or do I get a 3.3 V microprocessor, build an interface to a 24 pin ZIP socket, and write
           a reader/writer program, to load the image into the DS1742W

Are the locations for power cycles and operational hours known, and what are the formats.
Currently my scope is reporting that it has been turned on for  -2,147,483,648 hours

Thanks for any guidance.

Philip

[sicco]

This C code tells you where to find MAC and 'engine hours' in the DS1742W memory. Engine hours is specified in minutes. MAC is just 6 binary bytes. But they must start with 0x08, 0x00, 0x11 as that's what the firmware checks as allowed "Tektronix Inc" MAC addresses. The next three bytes: best to use a random number generator so that not all devices that we fix get the same MAC address as the one that was published as valid image in the post that you referenced.

To answer the question:

#define ENGINE_HOURS_IN_NVRAM   0x07E0 - 4 bytes uint32_t, minutes not hours
#define MAC_ADDRESS_IN_NVRAM    0x06F0 - 6 bytes
No checksums, crc's  or anything to check data integrity for these fields...

A corrupted / erased DS1742W can be reloaded in situ via the BDM interface (100 pin expansion port plugin) module and PC software for that. I have a few boards left at present. 100 EUR.
But you can also unsolder the DIP24 module and use a programmer with ZIF socket. No, better not 5V programmers.

Code: [Select]

int TDS3000_get_battery_flag ()
{
    int battery_flag;
    battery_flag = GetDS1742W (0x7fc) >> 7;
    return battery_flag;
}

void TDS3000_read_RTC (int *array)
{
    int i=0;

    SetDS1742W (0x7f8, 0x40);
    array[i++] = HexByteToDec(GetDS1742W (0x7f9) & 0x7f);
    array[i++] = HexByteToDec(GetDS1742W (0x7fa) & 0x7f);
    array[i++] = HexByteToDec(GetDS1742W (0x7fb) & 0x3f);
    array[i++] = HexByteToDec(GetDS1742W (0x7fc) & 0x07);
    array[i++] = HexByteToDec(GetDS1742W (0x7fd) & 0x3f);
    array[i++] = HexByteToDec(GetDS1742W (0x7fe) & 0x1f);
    array[i++] = HexByteToDec(GetDS1742W (0x7ff) & 0xff);
    array[i++] = HexByteToDec(GetDS1742W (0x7f8) & 0x3f);
    SetDS1742W (0x7f8, 0x00);
}

void TDS3000_show_RTC ()
{
    int array[8];
    TDS3000_read_RTC (array);
    printf ("TDS3000 RTC reads date/time %02d/%02d/%04d %d:%02d.%02d \n", array[4], array[5], 100*array[7] + array[6], array[2], array[1], array[0]);
}

void TDS3000_clear_RTC ()
{
    int i, k=0;
    int v = 0xff;
    printf ("clearing NVRAM in DS1742W/DS1744W chip at 0x%08x\n", base_DS1742);
    printf (" to 0x");
    scanf ("%x", &v);
    for (i=0; i<0x7f8; i++)
    {
        if (v < 0)
        {
            SetDS1742W (i, k);
            k -= v;
        }
        else
            SetDS1742W (i, v);
    }
    printf ("done\n");
}

void fill_buffer_random(unsigned char *buffer, unsigned int len)
{
    unsigned int i;
    srand(time(0));
    for (i=0; i<len; i++)
        *buffer++ = rand() & 0xff;
}

#define test_bytes_size 6
//#define test_bytes_size 256

int check_RTC_DS1742 (unsigned int test_at_address)
{
    int i, r = 1;
    unsigned int backup_address = base_DS1742;
    int array[8];
    int array2[8];

    base_DS1742 = test_at_address;
    TDS3000_read_RTC (array);

    unsigned int random_bytes[test_bytes_size];
    unsigned int backup_array[test_bytes_size];

    srand(time(0));
    for (i=0; i<test_bytes_size; i++)
        random_bytes[i] = rand() & 0xff;

    for (i=0; i<test_bytes_size; i++)
        backup_array[i] = GetDS1742W (i);

    for (i=0; i<test_bytes_size; i++)
         SetDS1742W (i, random_bytes[i]);
/*
    for (i=0; i<test_bytes_size; i++)
    {
        printf ("%02x=%02x ", GetDS1742W (i), random_bytes[i]);
        if ((i & 0x1f) == 0x1f)
            printf ("\n");
    }
*/
    for (i=0; i<test_bytes_size; i++)
        if (GetDS1742W (i) != random_bytes[i])
            r = 0;

    if (r)
    {
        int retry = 0;
        do
        {
            TDS3000_read_RTC (array);
            WaitMilliSeconds (1200); // it must have ticked one second within 1.2 seconds lapsed in PC
            TDS3000_read_RTC (array2);
            if (array[0] != array2[0])
                r |= 2;
            else
            {
                printf ("It did not tick... Trying to start DS174xW RTC clock\n");
                TDS3000_set_time_date (); // attempt to make it go
            }
        } while (retry++ < 2);
    }

    if (r==3)
    {
        if (TDS3000_get_battery_flag ())
            r |= 4;
    }

    for (i=0; i<test_bytes_size; i++)
         SetDS1742W (i, backup_array[i]);

    base_DS1742 = backup_address;

    return r;
}

uint32_t Get_DWORD_DS1742W (uint32_t address)
{
    uint32_t lw = 0;

    uint8_t *p = (uint8_t*)&lw;
    p += 3;
    for (int i=0; i<4; i++)
       *p-- = GetDS1742W (address++);

    return lw;
}

void Set_DWORD_DS1742W (uint32_t address, uint32_t lw)
{
    uint8_t *p = (uint8_t*)&lw;
    p +=3;
    for (int i=0; i<4; i++)
       SetDS1742W (address++, *p--);
}


#define ENGINE_HOURS_IN_NVRAM   0x07E0
#define MAC_ADDRESS_IN_NVRAM    0x06F0

void edit_hours()
{
    int32_t minutes;

    minutes = Get_DWORD_DS1742W (ENGINE_HOURS_IN_NVRAM);

    printf ("engine hours now is %d minutes = %1.2f hours\n", minutes, ((float)minutes)/60.0);
    printf ("enter new value in hours or enter 0 to skip: ");
    scanf ("%d", &minutes);
    if (minutes > 0)
        Set_DWORD_DS1742W (ENGINE_HOURS_IN_NVRAM, 60 * minutes);
}

void copy_MAC_to_NVRAM (uint8_t *six_bytes)
{
    int i;
    uint32_t address = MAC_ADDRESS_IN_NVRAM;

    printf ("old values: ");
    for (i=0; i<6; i++)
        printf ("%02x:", GetDS1742W (address++));
    printf ("\nnew values: ");
    address -= 6;

    for (i=0; i<6; i++)
        SetDS1742W (address++, *six_bytes++);

    address -= 6;
    for (i=0; i<6; i++)
        printf ("%02x:", GetDS1742W (address++));
    printf ("\n");
}



.....
            case '$':
                srand(time(0));

                random_bytes[0] = 0x08;     // Tektronix Inc MAC addresses must start with 080011
                random_bytes[1] = 0x00;
                random_bytes[2] = 0x11;

                for (i=3; i<6; i++)
                    random_bytes[i] = rand() & 0xff;

                for (i=0; i<6; i++)
                {
                    printf ("%02x", random_bytes[i]);
                    if (i<5)
                        printf (":");
                }
                printf("\n");

                F = fopen (TDS3EM_FlashRomFileName, "wt");
                for (i=0; i<6; i++)
                {
                    fprintf (F, "%02x", random_bytes[i]);
                    if (i<5)
                        fprintf (F, ":");
                }
                fprintf (F, "%c", 0);
                i = 12+5+1;
                while (i++ < 32)
                {
                    fprintf (F, "%c", 0xff);
                }
                fclose (F);
                printf ("new file %s is created - but not yet programmed!\n", TDS3EM_FlashRomFileName );

                printf ("copy it to NVRAM? (y/n)");
                ch = getch();
                printf ("%c\n", ch);
                if (ch == 'y')
                {
                    copy_MAC_to_NVRAM (random_bytes);
                }
                break;


....


[lern01]

This C code tells you where to find MAC and 'engine hours' in the DS1742W memory. Engine hours is specified in minutes. MAC is just 6 binary bytes. But they must start with 0x08, 0x00, 0x11 as that's what the firmware checks as allowed "Tektronix Inc" MAC addresses. The next three bytes: best to use a random number generator so that not all devices that we fix get the same MAC address as the one that was published as valid image in the post that you referenced.

To answer the question:

#define ENGINE_HOURS_IN_NVRAM   0x07E0 - 4 bytes uint32_t, minutes not hours
#define MAC_ADDRESS_IN_NVRAM    0x06F0 - 6 bytes
No checksums, crc's  or anything to check data integrity for these fields...

A corrupted / erased DS1742W can be reloaded in situ via the BDM interface (100 pin expansion port plugin) module and PC software for that. I have a few boards left at present. 100 EUR.
But you can also unsolder the DIP24 module and use a programmer with ZIF socket. No, better not 5V programmers.

Code: [Select]

int TDS3000_get_battery_flag ()
{
    int battery_flag;
    battery_flag = GetDS1742W (0x7fc) >> 7;
    return battery_flag;
}

void TDS3000_read_RTC (int *array)
{
    int i=0;

    SetDS1742W (0x7f8, 0x40);
    array[i++] = HexByteToDec(GetDS1742W (0x7f9) & 0x7f);
    array[i++] = HexByteToDec(GetDS1742W (0x7fa) & 0x7f);
    array[i++] = HexByteToDec(GetDS1742W (0x7fb) & 0x3f);
    array[i++] = HexByteToDec(GetDS1742W (0x7fc) & 0x07);
    array[i++] = HexByteToDec(GetDS1742W (0x7fd) & 0x3f);
    array[i++] = HexByteToDec(GetDS1742W (0x7fe) & 0x1f);
    array[i++] = HexByteToDec(GetDS1742W (0x7ff) & 0xff);
    array[i++] = HexByteToDec(GetDS1742W (0x7f8) & 0x3f);
    SetDS1742W (0x7f8, 0x00);
}

void TDS3000_show_RTC ()
{
    int array[8];
    TDS3000_read_RTC (array);
    printf ("TDS3000 RTC reads date/time %02d/%02d/%04d %d:%02d.%02d \n", array[4], array[5], 100*array[7] + array[6], array[2], array[1], array[0]);
}

void TDS3000_clear_RTC ()
{
    int i, k=0;
    int v = 0xff;
    printf ("clearing NVRAM in DS1742W/DS1744W chip at 0x%08x\n", base_DS1742);
    printf (" to 0x");
    scanf ("%x", &v);
    for (i=0; i<0x7f8; i++)
    {
        if (v < 0)
        {
            SetDS1742W (i, k);
            k -= v;
        }
        else
            SetDS1742W (i, v);
    }
    printf ("done\n");
}

void fill_buffer_random(unsigned char *buffer, unsigned int len)
{
    unsigned int i;
    srand(time(0));
    for (i=0; i<len; i++)
        *buffer++ = rand() & 0xff;
}

#define test_bytes_size 6
//#define test_bytes_size 256

int check_RTC_DS1742 (unsigned int test_at_address)
{
    int i, r = 1;
    unsigned int backup_address = base_DS1742;
    int array[8];
    int array2[8];

    base_DS1742 = test_at_address;
    TDS3000_read_RTC (array);

    unsigned int random_bytes[test_bytes_size];
    unsigned int backup_array[test_bytes_size];

    srand(time(0));
    for (i=0; i<test_bytes_size; i++)
        random_bytes[i] = rand() & 0xff;

    for (i=0; i<test_bytes_size; i++)
        backup_array[i] = GetDS1742W (i);

    for (i=0; i<test_bytes_size; i++)
         SetDS1742W (i, random_bytes[i]);
/*
    for (i=0; i<test_bytes_size; i++)
    {
        printf ("%02x=%02x ", GetDS1742W (i), random_bytes[i]);
        if ((i & 0x1f) == 0x1f)
            printf ("\n");
    }
*/
    for (i=0; i<test_bytes_size; i++)
        if (GetDS1742W (i) != random_bytes[i])
            r = 0;

    if (r)
    {
        int retry = 0;
        do
        {
            TDS3000_read_RTC (array);
            WaitMilliSeconds (1200); // it must have ticked one second within 1.2 seconds lapsed in PC
            TDS3000_read_RTC (array2);
            if (array[0] != array2[0])
                r |= 2;
            else
            {
                printf ("It did not tick... Trying to start DS174xW RTC clock\n");
                TDS3000_set_time_date (); // attempt to make it go
            }
        } while (retry++ < 2);
    }

    if (r==3)
    {
        if (TDS3000_get_battery_flag ())
            r |= 4;
    }

    for (i=0; i<test_bytes_size; i++)
         SetDS1742W (i, backup_array[i]);

    base_DS1742 = backup_address;

    return r;
}

uint32_t Get_DWORD_DS1742W (uint32_t address)
{
    uint32_t lw = 0;

    uint8_t *p = (uint8_t*)&lw;
    p += 3;
    for (int i=0; i<4; i++)
       *p-- = GetDS1742W (address++);

    return lw;
}

void Set_DWORD_DS1742W (uint32_t address, uint32_t lw)
{
    uint8_t *p = (uint8_t*)&lw;
    p +=3;
    for (int i=0; i<4; i++)
       SetDS1742W (address++, *p--);
}


#define ENGINE_HOURS_IN_NVRAM   0x07E0
#define MAC_ADDRESS_IN_NVRAM    0x06F0

void edit_hours()
{
    int32_t minutes;

    minutes = Get_DWORD_DS1742W (ENGINE_HOURS_IN_NVRAM);

    printf ("engine hours now is %d minutes = %1.2f hours\n", minutes, ((float)minutes)/60.0);
    printf ("enter new value in hours or enter 0 to skip: ");
    scanf ("%d", &minutes);
    if (minutes > 0)
        Set_DWORD_DS1742W (ENGINE_HOURS_IN_NVRAM, 60 * minutes);
}

void copy_MAC_to_NVRAM (uint8_t *six_bytes)
{
    int i;
    uint32_t address = MAC_ADDRESS_IN_NVRAM;

    printf ("old values: ");
    for (i=0; i<6; i++)
        printf ("%02x:", GetDS1742W (address++));
    printf ("\nnew values: ");
    address -= 6;

    for (i=0; i<6; i++)
        SetDS1742W (address++, *six_bytes++);

    address -= 6;
    for (i=0; i<6; i++)
        printf ("%02x:", GetDS1742W (address++));
    printf ("\n");
}



.....
            case '$':
                srand(time(0));

                random_bytes[0] = 0x08;     // Tektronix Inc MAC addresses must start with 080011
                random_bytes[1] = 0x00;
                random_bytes[2] = 0x11;

                for (i=3; i<6; i++)
                    random_bytes[i] = rand() & 0xff;

                for (i=0; i<6; i++)
                {
                    printf ("%02x", random_bytes[i]);
                    if (i<5)
                        printf (":");
                }
                printf("\n");

                F = fopen (TDS3EM_FlashRomFileName, "wt");
                for (i=0; i<6; i++)
                {
                    fprintf (F, "%02x", random_bytes[i]);
                    if (i<5)
                        fprintf (F, ":");
                }
                fprintf (F, "%c", 0);
                i = 12+5+1;
                while (i++ < 32)
                {
                    fprintf (F, "%c", 0xff);
                }
                fclose (F);
                printf ("new file %s is created - but not yet programmed!\n", TDS3EM_FlashRomFileName );

                printf ("copy it to NVRAM? (y/n)");
                ch = getch();
                printf ("%c\n", ch);
                if (ch == 'y')
                {
                    copy_MAC_to_NVRAM (random_bytes);
                }
                break;


....


Hi, sicco, I am a newbie, how to operate the above C code? I used TL866 to program DS1742W, and an error was reported (see the picture below), and the DS1742W data could not be cleared (stop power supply, and remove the battery). As long as I inserted the TL866 and wrote data, an error was reported saying that the chip data is different from the buffer data.

[sicco]

lern01, I don’t know.
Maybe your DS1742W is dead now because you gave it 5V as VCC. The -W suffix means it’s a 3.3V device…
Maybe it survives that 5V, but does not accept writes when VCC is as high as 5V.
Possibly with a really dead lithium batter inside it does not power the RAM area, despite having VCC of 3 or 5 volts. Cut your way into the DS1742W, from the top, from the pin 12 pin 13 side, find and disconnect the old coin cell inside, and wire a fresh 3V to what used to go to the old battery +. Battery - to GND on pin 12 of the DS1742W,
Maybe it then works again. Maybe not….

The C code that i shared is from the BDM backdoor into the TDS3000. Shared to illustrate what DS1742W memory bytes contain engine hours, mac addrress etc. That code will never run on the sort of programmer that you now use.

[Jarek]

I have a tds3014b, it stops at the start screen.
NVRAM is good.
I thought it was a ROM. I desoldered and read these memories. I am attaching the files, maybe they will be useful to someone.
I programmed new ones using other files from the forum.
Nothing has changed. I'm still looking for the fault.

[sicco]

What does it say on the serial engineering port?
https://groups.io/g/TekScopes/topic/tektronix_tds3034b_boot/104242499?p=,,,20,0,0,0::recentpostdate/sticky,,,20,0,0,104242499,previd%3D1707443608543731339,nextid%3D1707015820604178330&previd=1707443608543731339&nextid=1707015820604178330

[Jarek]

Thank you Sicco for your suggestion.
I read all your posts, you did an amazing job.
I have a TDS3GV card only , I'm ordering the FT4232 controller board and will try to read the serial port.