TEK DPO7104 looking for flash/eeprom content

[kissmu]

Dear All,

I would like to ask any help to go back to full life my half life DPO7054.
Currently i completly lost the content of my flash (contains serial number, instrument type number, options number). I have flash error message.

I need an original flash of DPO7104 instrument. The serial code, activation code no matter.   

without flash, i can't install my options e.g:SignalVU options.

This is a small lfash chip in the power board: 25p20Vp

The flash chip is on the back side of the power board. I attached an picture.

[kissmu]

some exta inforamtion:

I made same test measurement. The conclusion:
The instrument real max bandwidth is 3.5 Ghz! 
If i let the bandwith limiter in HW mode and i use the channel without PI filter, the bandwidth is at least 3.5 Ghz!

I can see the 2.4 Ghz WiFI signal on the FFT without any down convertersion. After 3.7 Ghz the signal power start to decrease. Approx 3dD
The conclusion. Despite of difference of DPO7054,DPO7104  and DPO7254,DPO7354 acquisition board, the bandwidth capable is same.

In the original case when my flash was good (DPO7054), the 500Mhz bandwidth limit is limited the instrument capabylities.
But in the DPO7104 case only the  1Ghz(DSP) limit the bandwidth to 1GHZ, but the 1GHZ(HW) limit option not limit anything.  You can use the instruments capabyliti.

I already attached many pictures, but my previous post lost. I will ty again.

My plan: open again the whole instrument and read out again the flash.

Other success. I found a core2 motherboard wich can work with the original WinXP image. Only one motheboard. Other isn't work. I don't kow why.  Core2 processor and ssd combination could increase the performance of orginal P4 + HDD combination.

I'm sill looking for a not corrupt DPO7104 flash content.

[kissmu]

The eeprom position is in the picture in the red circle.


just for fun fact: the eeprom is accessible form the top side of power board too.

These pictures was made by thin /xdevs.com

[TiN]

I have few dead DPO7104s I've kept for parts, contact me by email, I'll make a dump for you.

I have doubts that there is 3.5GHz bandwidth of 2-ADC boards (e.g. DPO7054 and DPO7104 without 2SR and lesser ADC hardware present).

[kissmu]

Hi Tin,

I dug in the internet and found some interesting thing.
I sent it for you.

I found several picture on the internet, and try to compare the the acquisition board pictures and, power board pictures.

I found 4 type acquisition board, ad 2 types power boards.
You repaired an DPO7104 but the acquisition board seems first generation. My board has much less component. E.g.:half amount of memory chips, but my DPO has same 250Mb memory length.
1. first type 1. switch and 4 memory management+Adc
2. second. Same then the first type but the half amount of memory chip and management chip is unpopulated
3. My version: Half amount of memory, and only 2 ADC/memory management chip. No unpopulated component. Most simple acquisition board. same than attached picture.
4. C version board, which seems same than mine. If the picture name was correct.
As i see the main difference between the C version and original version is the power board use PCI-e instead of PCI. And the PCI version has dedicated graphic card, the C version uses the motherboards integrated graphic.
When i updated the motherboard in my scope, i found that the not C versions scope works almost perfect without the dedicated graphic card. All process work in the background, but you can't see anything on the screen. But i could use the SignalVu software, and i could see everything (and seems faster than the dedicated video card). The Jitter analysis got back correct report despite of i can't see the measurements  on the screen.

Maybe the non C version are hack-able to C version. The C version software much better then the original one.
My acquisition boards seems new version, or reduced one. This is why i surprised at my scope can manage 3.5 Ghz too not only 1 Ghz. It is mean almost all component are same.

I attached 2 pictures. My acquisition board is same. And it can manage 3.5 Ghz

I will post some own pictures, the result of my corrupt flash.
But without flash chip the instrument isn't start.

Kind regards,
Gabor

[kissmu]

Here is some pictures abut the bandwidth.

I aware of my signal forms not always correct.
Because i just remove the PI filter from the signal path. I aware of the transmission line without any filter can make unwanted effect.
But I haven't got known fast square shape pulse generator, to check the signal form.

1Ghz is square wave the 2 GHz and above sinus.

So i listen all opinion.

[kissmu]

700 MHZ square+flash error

[d37duck]

Hi kissmu,

I hope the SPI Bus Flash Memory you mentioned is accessible by executing a script.  Whatever the process, please tell me how to read and write it.  I'll try to follow the procedure and if it works, I will put the memory contents into an archive file (rar or zip) an email it you.  I will post it along with whatever comments I have about how to read it.

If it doesn't work, I'll ask questions.

Let us hope for data,

[kissmu]

Hi s37duck,

Thank your effort.
I thank you all possible help.
You are right this flash can accessible by software, because the tekscope.exe can read, and write it.

But I don't know any other option to read it and save without tekscope.exe.
I could read this flash with CH341a flash reader. But i use incorrect flash size during reading, so the result isn't correct.
I could read this flash with removable clips connector.

But if you want to read it in this way you have to tear down the all unit.

Kind regards,
Gabor

[charlyd]

i can also post some picture starting of with a DPO7254 acq board. 
@kissmu the numbering should be a great one to add.
679-1859-03 /655-1859-03
more and better will follow here or in a separate post

[calibrationfixture]

Hi,

@ « Reply #4:

I think the Chinese(?) Picture of the Board is from an early DPO7054. These early ones were 10 GS/s Boards. In those days you could also order a DPO7054 Option 2SR (20 GS/s). Later (2010) DPO7000 Datasheets don't show Option 2SR for DPO7054 Scopes anymore. Only DPO7104's had this Option. In addition the Sampling Rate of DPO7054's has increased to 20 GS/s. Looking into the 071-1740-02 Service Manual you also see that the Boards of the DPO7054 and DPO7104's have the same PN. In addition: early or late. Look at the production dates of the parts on the boards.

Greetings,

Calibrationfixture

[mikehank]

I cant speak to the BW testing mentioned but I do know the components by the red arrow are compensation networks.  A dpo7104 will have different values than a DPO7254 and DPO7354.  These networks are coming out of the track&hold to the A2D's.  The new DPO7K's removed the T&H altogether but the compensation networks are still present between the preamps and the A2D.

[kissmu]

Hi!

These are bad news.
Exately this is my unit:Board is from an early DPO7054. These early ones were 10 GS/s Boards. In those days you could also order a DPO7054 Option 2SR (20 GS/s).

The conclusion is: my unit maximum sampling rate is 20 GS/s as TIN mentioned earlier.

I noticed that the 500Mhz limit was software limit in the DPOs. The 1Ghz limit is an hardware PI filter limit.

I read the corrupted eeprom, and i noticed that i lost my unit internal serial number. (and maybe another error, but i can't copare it with another one)
This serial numer isn't same like the number on the back of the machine.
So if i got an other serial numer my unit can be anything.  This serial numer is a coded one so i can't geneate new one.
Now i haven't got any serial number, therefore the software use tde default settings: DPO7104 20GS/s, without any options

I use my unit for testing my VNA (try to repair) and lean other RF black magic.
So i happy with extra bandwidth. But i need internal serial number for installation usefull software.

So i don't worried about different unit numer for example DPO7354/7254/7104. The better would be the 7104.
But i would try anything, maybe help.

[coromonadalix]

Would be fun to extract the fw  thru vxwork commands or other tek included software ....

i recall theses attached files ...   not sure it helps in any way   

It was for the mobo  bios dump  etc ...

I have a 7254 at my job, and did some backups and file copy on a usb key,  just can't do an hdd iso

[kissmu]

Thank you,

I think these are windows base settings.

I need the content of this chip:
https://www.eevblog.com/forum/index.php?action=dlattach;topic=318913.0;attach=1457488;image

It contains, the all data of the instrument: Serial number, unit number (e.g.:DPO7104), installed options settings, and so on. It is the real bios of this instrument.

Your data maybe good for motherboard replacement.

[kissmu]

sorry for the image size 

I already posted this picture earlier:
Here is the correct one

[coromonadalix]

still the wrong size of image,  way too small ??

[kissmu]

here is the correct link:

here is my original post with correct size of pictures:https://www.eevblog.com/forum/repair/tek-dpo7104-looking-for-flasheeprom-content/msg4105765/#msg4105765

[veegee]

I'm having a hard time comprehending the broken English... But I'm thinking about buying a DPO7054 I found on ebay for a good price. Apparently it's an older model that has the 2SA option installed. The only thing holding me back is not knowing whether or not I can hack it to get at least 1GHz bandwidth.

From what I read in this thread so far, this is my understanding:

- The 500MHz limit is purely in software and can be removed to get at least 1GHz fairly easily.
- Above 1GHz, some hardware modification needs to be done to get higher bandwidths. Apart from the compensation network, what other hardware differences are there between the models?

Is this correct?

I'm pretty good with hacking software. Not so great with the hardware side of it yet. I'll be glad to help once I get my DPO7054 if someone can confirm my understanding above.

[kissmu]

Hi veegee,

You are almost correct.
But the software bandwidth hacking isn't easy. You have to changed your instrument internal identification number.

In my case my eeprom was broken, and my unit (DPO7054) became DPO7104 (this is the default setting) . But i lost the all possible options. But i need these option e.g:signalvu.
The hardware hacking seems easy: remove PI filter.

The instrument internal id was encoded. So you have to find the way to decoded id. After change the unit name  you have to encode it again, and write into the eeprom.

[veegee]

If the firmware is available, it should be possible to decompile and find the subroutine that encodes/decodes the eeprom data. From there, it's trivial to write whatever we want into the eeprom.

As far as the licence keys go, we should also be able to dig into their code and trace the subroutines which map serial numbers to features and other things like IDs. Is it possible to install third party software like IDA pro on the scope itself? That would make debugging far easier since we can get a live view of what's going on.

[kissmu]

The option codes was cracked already.

The scope software is avaiable separately. The eeprom contains only the option list, the instruments id and instruments number e.g.:dpo7104 or dpo7054 ...

The cope calibration data is in different eeprom.

I think the coded instrument number use similar code type than the option code.
The optyon finder source code is avaiable. It is an 2.7 python code.

Tin already collected huge amount software for this scope.

I think not nevessary disassembling the whole code just the instrument code.

[lecatron07]

hello all

i will try to get the flash content for you
would you show me where is the tool that generate option keys because i couldn't find it

my scope have a problem all channels work nice except the last channel it show this weird noise in it but when i push gently under the scope the noise disappear any idea of what should i do
how to fix it

[calibrationfixture]

Hi lecatron07,

Your "Problem" resembles:

https://www.eevblog.com/forum/repair/tektronix-dpo-6ghz-scope-issue-broken-bga-ball-connection/

Fixing it could be a difficult.

Succes,

Calibrationfixture

[lecatron07]

yes i was going to send my scope to reball the adc chips but im scared it will create bigger problem since the board size is big and not every one have a big heating plate for this type of board
but i got an idea from a friend to put something that will keep pressure on the chip as it is mentioned in  the post you provided . this will be more convince because my scope need a light touch to make the channel work perfectly

what do you think ?>
do you have any idea or someone you trust to re-ball the chips im in michigan USA   
im open to any idea