Electronics > Repair
TDS3014 adventures
<< < (28/34) > >>
sprit:
Hi Sicco. Thank you for your contributions. Hope you have a nice day.
I tried pressing the B-Trig button but everything is still the same. Looks like my DS1742 has some problem or is broken. I tried taking it apart and the scope still has the same problem-white screen or stuck on logo . Can you tell me if I can get a DS1742 from another range instead and reprogram it? I only have the RT4232 USB. Thank you very much.
Sincerely
JingFeng
sicco:
JingFeng,

Options are:
* The james_s DS1744 adapter board.
* Replacement units such as https://www.ebay.com/itm/293776182478
* The ‘second life’ budget board that plugs into the 100 pin connector.

Advantage of the ‘second life’ board is that it gets you lots of diagnostics from a tds3000 board that does not boot ok.  It enables reading/writing the RTC data via BDM via USB. It also enables capturing of the VxWorks system boot log.



DC_to_Light:
Looks like I am joining the party, with a TDS3054B and a DS1742W that has lost its mind.

I've extracted the DS1742W, milled away 0.030" of the top plastic to get to the battery.
The top terminal of the battery is GND and connected to package pin 12.
I used a hot soldering iron (to soften the potting compound) and various picking tools to
dig down in the area between pin 13 and the battery perimeter, till I got to the battery
positive terminal.

The positive terminal is also exposed as the shell of the battery. My battery measures
0.673 mV, and at such high impedance that my 10 MOhm/V multimeter causes the voltage
to slowly drop. I soldered a red wire to the exposed positive terminal of the battery, and
cut the negative side of the battery terminal at the point where it gets thin. Unfortunately
I had not connected the new battery yet, and lost the  "NV"RAM contents.  |O   :-//
Anyway, I added a CR2032, restarted the scope with B-Trig, and after warm up, successfully
ran SPC.  This passed, and the clock now keeps time reasonably accurately.
What does not work is ethernet, and I have the same issues as other people. From my
reading, it seems I need to load a valid image into the DS1742W to restore the ethernet
functionality.

1)  Is the 3054 image supplied at the end of article 99 of this thread the image I need,
     and if not, where do I get it?
2)  How do people load the image into a repaired DS1742.
     My programmer does not know about the DS1742W, but does know about the DS1220AB
     Unfortunately all versions of DS1220xx are 5V parts, so my programmer (Advin P44+)
     will set VCC to 5V, and the signal thresholds appropriately. This could destroy my DS1742W.

     A)  Is there some other suggested device that has the same pinout, but is 3.3V?

     B)  Or do I get a 3.3 V microprocessor, build an interface to a 24 pin ZIP socket, and write
           a reader/writer program, to load the image into the DS1742W

Are the locations for power cycles and operational hours known, and what are the formats.
Currently my scope is reporting that it has been turned on for  -2,147,483,648 hours

Thanks for any guidance.

Philip
sicco:
This C code tells you where to find MAC and 'engine hours' in the DS1742W memory. Engine hours is specified in minutes. MAC is just 6 binary bytes. But they must start with 0x08, 0x00, 0x11 as that's what the firmware checks as allowed "Tektronix Inc" MAC addresses. The next three bytes: best to use a random number generator so that not all devices that we fix get the same MAC address as the one that was published as valid image in the post that you referenced.

To answer the question:

#define ENGINE_HOURS_IN_NVRAM   0x07E0 - 4 bytes uint32_t, minutes not hours
#define MAC_ADDRESS_IN_NVRAM    0x06F0 - 6 bytes
No checksums, crc's  or anything to check data integrity for these fields...

A corrupted / erased DS1742W can be reloaded in situ via the BDM interface (100 pin expansion port plugin) module and PC software for that. I have a few boards left at present. 100 EUR.
But you can also unsolder the DIP24 module and use a programmer with ZIF socket. No, better not 5V programmers.


--- Code: ---int TDS3000_get_battery_flag ()
{
    int battery_flag;
    battery_flag = GetDS1742W (0x7fc) >> 7;
    return battery_flag;
}

void TDS3000_read_RTC (int *array)
{
    int i=0;

    SetDS1742W (0x7f8, 0x40);
    array[i++] = HexByteToDec(GetDS1742W (0x7f9) & 0x7f);
    array[i++] = HexByteToDec(GetDS1742W (0x7fa) & 0x7f);
    array[i++] = HexByteToDec(GetDS1742W (0x7fb) & 0x3f);
    array[i++] = HexByteToDec(GetDS1742W (0x7fc) & 0x07);
    array[i++] = HexByteToDec(GetDS1742W (0x7fd) & 0x3f);
    array[i++] = HexByteToDec(GetDS1742W (0x7fe) & 0x1f);
    array[i++] = HexByteToDec(GetDS1742W (0x7ff) & 0xff);
    array[i++] = HexByteToDec(GetDS1742W (0x7f8) & 0x3f);
    SetDS1742W (0x7f8, 0x00);
}

void TDS3000_show_RTC ()
{
    int array[8];
    TDS3000_read_RTC (array);
    printf ("TDS3000 RTC reads date/time %02d/%02d/%04d %d:%02d.%02d \n", array[4], array[5], 100*array[7] + array[6], array[2], array[1], array[0]);
}

void TDS3000_clear_RTC ()
{
    int i, k=0;
    int v = 0xff;
    printf ("clearing NVRAM in DS1742W/DS1744W chip at 0x%08x\n", base_DS1742);
    printf (" to 0x");
    scanf ("%x", &v);
    for (i=0; i<0x7f8; i++)
    {
        if (v < 0)
        {
            SetDS1742W (i, k);
            k -= v;
        }
        else
            SetDS1742W (i, v);
    }
    printf ("done\n");
}

void fill_buffer_random(unsigned char *buffer, unsigned int len)
{
    unsigned int i;
    srand(time(0));
    for (i=0; i<len; i++)
        *buffer++ = rand() & 0xff;
}

#define test_bytes_size 6
//#define test_bytes_size 256

int check_RTC_DS1742 (unsigned int test_at_address)
{
    int i, r = 1;
    unsigned int backup_address = base_DS1742;
    int array[8];
    int array2[8];

    base_DS1742 = test_at_address;
    TDS3000_read_RTC (array);

    unsigned int random_bytes[test_bytes_size];
    unsigned int backup_array[test_bytes_size];

    srand(time(0));
    for (i=0; i<test_bytes_size; i++)
        random_bytes[i] = rand() & 0xff;

    for (i=0; i<test_bytes_size; i++)
        backup_array[i] = GetDS1742W (i);

    for (i=0; i<test_bytes_size; i++)
         SetDS1742W (i, random_bytes[i]);
/*
    for (i=0; i<test_bytes_size; i++)
    {
        printf ("%02x=%02x ", GetDS1742W (i), random_bytes[i]);
        if ((i & 0x1f) == 0x1f)
            printf ("\n");
    }
*/
    for (i=0; i<test_bytes_size; i++)
        if (GetDS1742W (i) != random_bytes[i])
            r = 0;

    if (r)
    {
        int retry = 0;
        do
        {
            TDS3000_read_RTC (array);
            WaitMilliSeconds (1200); // it must have ticked one second within 1.2 seconds lapsed in PC
            TDS3000_read_RTC (array2);
            if (array[0] != array2[0])
                r |= 2;
            else
            {
                printf ("It did not tick... Trying to start DS174xW RTC clock\n");
                TDS3000_set_time_date (); // attempt to make it go
            }
        } while (retry++ < 2);
    }

    if (r==3)
    {
        if (TDS3000_get_battery_flag ())
            r |= 4;
    }

    for (i=0; i<test_bytes_size; i++)
         SetDS1742W (i, backup_array[i]);

    base_DS1742 = backup_address;

    return r;
}

uint32_t Get_DWORD_DS1742W (uint32_t address)
{
    uint32_t lw = 0;

    uint8_t *p = (uint8_t*)&lw;
    p += 3;
    for (int i=0; i<4; i++)
       *p-- = GetDS1742W (address++);

    return lw;
}

void Set_DWORD_DS1742W (uint32_t address, uint32_t lw)
{
    uint8_t *p = (uint8_t*)&lw;
    p +=3;
    for (int i=0; i<4; i++)
       SetDS1742W (address++, *p--);
}


#define ENGINE_HOURS_IN_NVRAM   0x07E0
#define MAC_ADDRESS_IN_NVRAM    0x06F0

void edit_hours()
{
    int32_t minutes;

    minutes = Get_DWORD_DS1742W (ENGINE_HOURS_IN_NVRAM);

    printf ("engine hours now is %d minutes = %1.2f hours\n", minutes, ((float)minutes)/60.0);
    printf ("enter new value in hours or enter 0 to skip: ");
    scanf ("%d", &minutes);
    if (minutes > 0)
        Set_DWORD_DS1742W (ENGINE_HOURS_IN_NVRAM, 60 * minutes);
}

void copy_MAC_to_NVRAM (uint8_t *six_bytes)
{
    int i;
    uint32_t address = MAC_ADDRESS_IN_NVRAM;

    printf ("old values: ");
    for (i=0; i<6; i++)
        printf ("%02x:", GetDS1742W (address++));
    printf ("\nnew values: ");
    address -= 6;

    for (i=0; i<6; i++)
        SetDS1742W (address++, *six_bytes++);

    address -= 6;
    for (i=0; i<6; i++)
        printf ("%02x:", GetDS1742W (address++));
    printf ("\n");
}



.....
            case '$':
                srand(time(0));

                random_bytes[0] = 0x08;     // Tektronix Inc MAC addresses must start with 080011
                random_bytes[1] = 0x00;
                random_bytes[2] = 0x11;

                for (i=3; i<6; i++)
                    random_bytes[i] = rand() & 0xff;

                for (i=0; i<6; i++)
                {
                    printf ("%02x", random_bytes[i]);
                    if (i<5)
                        printf (":");
                }
                printf("\n");

                F = fopen (TDS3EM_FlashRomFileName, "wt");
                for (i=0; i<6; i++)
                {
                    fprintf (F, "%02x", random_bytes[i]);
                    if (i<5)
                        fprintf (F, ":");
                }
                fprintf (F, "%c", 0);
                i = 12+5+1;
                while (i++ < 32)
                {
                    fprintf (F, "%c", 0xff);
                }
                fclose (F);
                printf ("new file %s is created - but not yet programmed!\n", TDS3EM_FlashRomFileName );

                printf ("copy it to NVRAM? (y/n)");
                ch = getch();
                printf ("%c\n", ch);
                if (ch == 'y')
                {
                    copy_MAC_to_NVRAM (random_bytes);
                }
                break;


....

--- End code ---
lern01:

--- Quote from: sicco on December 05, 2023, 02:15:45 pm ---This C code tells you where to find MAC and 'engine hours' in the DS1742W memory. Engine hours is specified in minutes. MAC is just 6 binary bytes. But they must start with 0x08, 0x00, 0x11 as that's what the firmware checks as allowed "Tektronix Inc" MAC addresses. The next three bytes: best to use a random number generator so that not all devices that we fix get the same MAC address as the one that was published as valid image in the post that you referenced.

To answer the question:

#define ENGINE_HOURS_IN_NVRAM   0x07E0 - 4 bytes uint32_t, minutes not hours
#define MAC_ADDRESS_IN_NVRAM    0x06F0 - 6 bytes
No checksums, crc's  or anything to check data integrity for these fields...

A corrupted / erased DS1742W can be reloaded in situ via the BDM interface (100 pin expansion port plugin) module and PC software for that. I have a few boards left at present. 100 EUR.
But you can also unsolder the DIP24 module and use a programmer with ZIF socket. No, better not 5V programmers.


--- Code: ---int TDS3000_get_battery_flag ()
{
    int battery_flag;
    battery_flag = GetDS1742W (0x7fc) >> 7;
    return battery_flag;
}

void TDS3000_read_RTC (int *array)
{
    int i=0;

    SetDS1742W (0x7f8, 0x40);
    array[i++] = HexByteToDec(GetDS1742W (0x7f9) & 0x7f);
    array[i++] = HexByteToDec(GetDS1742W (0x7fa) & 0x7f);
    array[i++] = HexByteToDec(GetDS1742W (0x7fb) & 0x3f);
    array[i++] = HexByteToDec(GetDS1742W (0x7fc) & 0x07);
    array[i++] = HexByteToDec(GetDS1742W (0x7fd) & 0x3f);
    array[i++] = HexByteToDec(GetDS1742W (0x7fe) & 0x1f);
    array[i++] = HexByteToDec(GetDS1742W (0x7ff) & 0xff);
    array[i++] = HexByteToDec(GetDS1742W (0x7f8) & 0x3f);
    SetDS1742W (0x7f8, 0x00);
}

void TDS3000_show_RTC ()
{
    int array[8];
    TDS3000_read_RTC (array);
    printf ("TDS3000 RTC reads date/time %02d/%02d/%04d %d:%02d.%02d \n", array[4], array[5], 100*array[7] + array[6], array[2], array[1], array[0]);
}

void TDS3000_clear_RTC ()
{
    int i, k=0;
    int v = 0xff;
    printf ("clearing NVRAM in DS1742W/DS1744W chip at 0x%08x\n", base_DS1742);
    printf (" to 0x");
    scanf ("%x", &v);
    for (i=0; i<0x7f8; i++)
    {
        if (v < 0)
        {
            SetDS1742W (i, k);
            k -= v;
        }
        else
            SetDS1742W (i, v);
    }
    printf ("done\n");
}

void fill_buffer_random(unsigned char *buffer, unsigned int len)
{
    unsigned int i;
    srand(time(0));
    for (i=0; i<len; i++)
        *buffer++ = rand() & 0xff;
}

#define test_bytes_size 6
//#define test_bytes_size 256

int check_RTC_DS1742 (unsigned int test_at_address)
{
    int i, r = 1;
    unsigned int backup_address = base_DS1742;
    int array[8];
    int array2[8];

    base_DS1742 = test_at_address;
    TDS3000_read_RTC (array);

    unsigned int random_bytes[test_bytes_size];
    unsigned int backup_array[test_bytes_size];

    srand(time(0));
    for (i=0; i<test_bytes_size; i++)
        random_bytes[i] = rand() & 0xff;

    for (i=0; i<test_bytes_size; i++)
        backup_array[i] = GetDS1742W (i);

    for (i=0; i<test_bytes_size; i++)
         SetDS1742W (i, random_bytes[i]);
/*
    for (i=0; i<test_bytes_size; i++)
    {
        printf ("%02x=%02x ", GetDS1742W (i), random_bytes[i]);
        if ((i & 0x1f) == 0x1f)
            printf ("\n");
    }
*/
    for (i=0; i<test_bytes_size; i++)
        if (GetDS1742W (i) != random_bytes[i])
            r = 0;

    if (r)
    {
        int retry = 0;
        do
        {
            TDS3000_read_RTC (array);
            WaitMilliSeconds (1200); // it must have ticked one second within 1.2 seconds lapsed in PC
            TDS3000_read_RTC (array2);
            if (array[0] != array2[0])
                r |= 2;
            else
            {
                printf ("It did not tick... Trying to start DS174xW RTC clock\n");
                TDS3000_set_time_date (); // attempt to make it go
            }
        } while (retry++ < 2);
    }

    if (r==3)
    {
        if (TDS3000_get_battery_flag ())
            r |= 4;
    }

    for (i=0; i<test_bytes_size; i++)
         SetDS1742W (i, backup_array[i]);

    base_DS1742 = backup_address;

    return r;
}

uint32_t Get_DWORD_DS1742W (uint32_t address)
{
    uint32_t lw = 0;

    uint8_t *p = (uint8_t*)&lw;
    p += 3;
    for (int i=0; i<4; i++)
       *p-- = GetDS1742W (address++);

    return lw;
}

void Set_DWORD_DS1742W (uint32_t address, uint32_t lw)
{
    uint8_t *p = (uint8_t*)&lw;
    p +=3;
    for (int i=0; i<4; i++)
       SetDS1742W (address++, *p--);
}


#define ENGINE_HOURS_IN_NVRAM   0x07E0
#define MAC_ADDRESS_IN_NVRAM    0x06F0

void edit_hours()
{
    int32_t minutes;

    minutes = Get_DWORD_DS1742W (ENGINE_HOURS_IN_NVRAM);

    printf ("engine hours now is %d minutes = %1.2f hours\n", minutes, ((float)minutes)/60.0);
    printf ("enter new value in hours or enter 0 to skip: ");
    scanf ("%d", &minutes);
    if (minutes > 0)
        Set_DWORD_DS1742W (ENGINE_HOURS_IN_NVRAM, 60 * minutes);
}

void copy_MAC_to_NVRAM (uint8_t *six_bytes)
{
    int i;
    uint32_t address = MAC_ADDRESS_IN_NVRAM;

    printf ("old values: ");
    for (i=0; i<6; i++)
        printf ("%02x:", GetDS1742W (address++));
    printf ("\nnew values: ");
    address -= 6;

    for (i=0; i<6; i++)
        SetDS1742W (address++, *six_bytes++);

    address -= 6;
    for (i=0; i<6; i++)
        printf ("%02x:", GetDS1742W (address++));
    printf ("\n");
}



.....
            case '$':
                srand(time(0));

                random_bytes[0] = 0x08;     // Tektronix Inc MAC addresses must start with 080011
                random_bytes[1] = 0x00;
                random_bytes[2] = 0x11;

                for (i=3; i<6; i++)
                    random_bytes[i] = rand() & 0xff;

                for (i=0; i<6; i++)
                {
                    printf ("%02x", random_bytes[i]);
                    if (i<5)
                        printf (":");
                }
                printf("\n");

                F = fopen (TDS3EM_FlashRomFileName, "wt");
                for (i=0; i<6; i++)
                {
                    fprintf (F, "%02x", random_bytes[i]);
                    if (i<5)
                        fprintf (F, ":");
                }
                fprintf (F, "%c", 0);
                i = 12+5+1;
                while (i++ < 32)
                {
                    fprintf (F, "%c", 0xff);
                }
                fclose (F);
                printf ("new file %s is created - but not yet programmed!\n", TDS3EM_FlashRomFileName );

                printf ("copy it to NVRAM? (y/n)");
                ch = getch();
                printf ("%c\n", ch);
                if (ch == 'y')
                {
                    copy_MAC_to_NVRAM (random_bytes);
                }
                break;


....

--- End code ---

--- End quote ---


Hi, sicco, I am a newbie, how to operate the above C code? I used TL866 to program DS1742W, and an error was reported (see the picture below), and the DS1742W data could not be cleared (stop power supply, and remove the battery). As long as I inserted the TL866 and wrote data, an error was reported saying that the chip data is different from the buffer data.
Navigation
Message Index
Next page
Previous page
There was an error while thanking
Thanking...

Go to full version
Powered by SMFPacks Advanced Attachments Uploader Mod