Tektronix TDS8000 - Backup calibration parameters and other important stuff

[wevie]

Hi all,

New to this forum (unbelievable, right?), and I’d like to thank everyone for the great info shared here already.

I’m a proud new owner of a Tektronix TDS8000 scope, which I purchased as “broken” on eBay (the issue was with the display, which I’ve already fixed). While waiting for the replacement part to arrive, I’ve read through a lot of threads and noticed that many problems with these devices seem to arise due to the loss of NVRAM and CMOS contents caused by dead batteries and even the loss of CPLD contents.

I count myself very lucky, as my unit doesn’t show any errors and passes compensation, etc.

I want to ensure that I back up as much as I can from this device before I risk losing anything critical, like calibration constants. Here’s my plan:

- Dump the hard drive contents and create a raw copy.
- Dump the BIOS to preserve its current state.
- Dump the CPLD contents with a Xilinx JTAG programmer I have laying around.

What I’m less certain about is the proper way to back up the NVRAM contents. Could anyone advise on the best approach?

- Is the NVRAM and its battery seated in a socket, so I can remove the combo from the board and read it our externally? (I have hardware for reading chips directly.)
- If not, is it possible to perform an in-circuit dump of the NVRAM with the same chip-reading hardware?
- I’ve noticed the VxBoot bootloader offers memory-dumping options. Would this provide a way to access and back up the NVRAM?
- For the 5000 series scopes, there’s a tool called Savecal5k (https://www.eevblog.com/forum/testgear/savecal5k-calibration-backup-disk-for-tektronix-tds5000-oscilloscopes/). Does anything similar exist for the 8000 series?

Any advice would be greatly appreciated. I’m more than willing to share my findings and dumps to help others maintain their scopes as well.

Thanks in advance!

[colorburst]

Congrats on your purchase! I got your private message but am posting here to support the discussion. I don't have such a behemoth to experiment on, so this is all theoretical. It's also specific to TDS8000.

Before a non-invasive method is figured out, I suggest making a direct dump from the chip. This is good both as a backup (there are functions that write the nvram), but also to confirm completeness of your copy. This was my approach with TDS5000, I had a dump from the hardware to verify I'm reading the EEPROM correctly.

If you have a way of calling functions, perhaps by editing bootdio.vsh after the "ld < rtlLibTarget.o" line, the following calls should print the "calibration constant containers" one by one (skip the comments, they may not parse correctly):

Code: [Select]

calCompAcqNvDump__Fii(0, 0) # ACQCALINFO;     image offset 0x0
calCompAcqNvDump__Fii(1, 0) # ACQCALCONST;               0x100
calCompAcqNvDump__Fii(2, 0) # ACQ8200CALCONST;         0x10500
calCompAcqNvDump__Fii(5, 0) # ACQCOMPDATAFAC;            0x500
calCompAcqNvDump__Fii(6, 0) # ACQCOMPDATAUSER;          0x8500
calCompAcqNvDump__Fii(9, 0) # ACQTP8200COMPDATAUSER;   0x10600

Then you can assemble a complete image using those offsets. There will be holes but they *probably* don't contain anything useful, a direct dump would be handy to confirm this.

Alternatively, if you can allocate a buffer and then print its contents, you can the following with nvramAddr = 0, nBytes = 0x20000 would capture the entire region:

Code: [Select]

int acqLibReadNVRAM(int nvramAddr, byte *buffer, uint nBytes)

It appears the vsh script has access to the Windows file system via the DIO driver, so it might be possible to write the nvram contents straight to the C:\ partition with the right incantations, but I am out of my depth here.

[calibrationfixture]

Hi to both,

This discussion is also started on TekScopes. Making dumps seems rather easy. Done that for my TDS7404B. By the way I use Macrium Reflect to clone my HDD's. Highly recommended.

https://www.eevblog.com/forum/testgear/tektronix-tds6000b7000b-series-nvram-dump-script/


Calibrationfixture

 

[colorburst]

The TekScopes thread is worth reading. I want to point out this comment in particular:

Factory calibration data is stored on a separate X24165 EEPROM on TDS7104.  I was able to dump it to a file using vxWorks:
======
Allocate tempBuf as above with malloc, at least size of 0x800

Code: [Select]

nvMem_read(0,tempBuf,0x800)
fdescriptor=open("dbfs:c:/vxBoot/eepromdump.bin",0x0202,0777)
bytesWritten=write(fdescriptor,tempBuf,0x800)
close(fdescriptor)

========

My understanding is there are two kinds of "nvram", the Dallas block maintaining the boot config and a vxworks-local copy of the scope state, and a small I2C EEPROM holding the factory cal. The Dallas block can be rebuilt from scratch as has been documented elsewhere and is perhaps less important to back up; the cal constants are specific to your acq HW.

I was kindly pointed to some topScript-based dumping methods developed by flyte and WORP3, and it appears they both only get a copy of the Dallas NVRAM. However, they provide an excellent starting point for capturing the factory cal EEPROM as well. Ozan's method fits TDS7000, for TDS8000 I'd adapt it as follows (untested, try at your own risk):

Code: [Select]

tempBuf=malloc(0x20000)
acqLibReadNVRAM(0,tempBuf,0x20000)
fdescriptor=open("c:/eepromdump.bin",0x0202,0777)
bytesWritten=write(fdescriptor,tempBuf,0x20000)
close(fdescriptor)

[coromonadalix]

normally on many tek  pc based scopes,  backing some drive folders helped a lot,  and theses scripts to dump the famous dying nvram  helped a lot

cloning the drive when possible is the perfect solution,   more would be :  to see the vxwork  boot process (when power pc equipped) or read it and take notes of the settings / names  etc ...

i had a crashed nvram on one, with an acq eeprom error,    and a full re install on another,   it took a long time to understand all of this  loll   

do it when you can, the best answer you can get ... or give you   

[wevie]

Thanks all!! Your info is really helpful already!

I expect an Amazon delivery tomorrow, including a mini-IDE to USB converter, as I didn't have one laying around anymore.

Getting the HDD backed up is the first goal now.

I'll keep you all posted.

[wevie]

Okay, HDD was dumped correctly.

I already loaded some of the object-files in Ghidra, we are very lucky all debug symbol are still in 
This means that with a normal boot-trace of the PPC it shouldn't be too hard to follow what is going on and at what locations data is actually read.

[wevie]

With your instructions I was able to dump the calibration constants !

I will try to update the dumper scripts already available to support the TDS8000; but for now I'm really happy !

[wevie]

Steps I did on my TDS8000, I hope it might be useful to somebody in the future:

Code: [Select]

#PPC Board
nvrBase=0xfd0e0000
nvrSize=0x20000
tempBuf=malloc(nvrSize)
memcpy(tempBuf,nvrBase,nvrSize)
fdescriptor=open("dbfs:c:/tds8000_ppc_nvramdump_full.bin",0x0202,0777)
bytesWritten=write(fdescriptor,tempBuf,nvrSize)
close(fdescriptor)

#ACQ Board
nvrSize=0x20000
acqLibReadNVRAM(0,tempBuf,nvrSize)
fdescriptor=open("dbfs:c:/tds8000_acq_nvramdump_full.bin",0x0202,0777)
bytesWritten=write(fdescriptor,tempBuf,nvrSize)
close(fdescriptor)

Happy I was able to store the calibration constants on my device, thanks again