EEVblog Electronics Community Forum
Products => Test Equipment => Topic started by: dxl on December 21, 2014, 07:54:06 pm
-
Hi All,
i've read several threads here about Tektronix scopes. I bought one a while ago (a TDS754D). That unit had a broken display (CRT was so weak, you couldn't read anything). I replaced that with a TFT LCD, so that problem is solved now. However, the processor board lost all of it's CAL constants, and
the Acquisition board had two failed Input Attenuator Hybrids. The latter one was easy to fix, i had another Acquistion board i could take them from.
I'm still working on the re-calibration, and want to share some of the things i learned so far. Software used is the TDS700D field adjustment software.
The software requires an old NI PCII/A GPIB ISA card. As i don't have such a card nor the old DOS PC required, i started to hack up DOSEMU to add
a driver that simulates those card, so i could run everything on Linux with my more modern NI GPIB USB HS Adapter.
The TDS Software actually expects two cards:
a) one at 0x2e1 to connect to the DUT (the oscilloscope)
b) one at 0xe2e1 to connect to all the required Measurement equipment when running in automated mode.
in adj700d.bat, there's a TMODE variable define, which influences the calibration process:
TMODE=M - default setting
TMODE=MA - asks also for humidity
TMODE=MB - exchange the meaning of both GPIB cards
TMODE=MD - prints diagnostic during calibration, i.e. why a calibration step failed
there are probably other settings, but i didn't test every possible combination.
the G_CONFIG file defines the devices present on the GPIB bus - devices where 'INAME' starts with '*' are disabled, and the Software will ask the User to manually set the device to the required setting / read values manually. If you remove the asterisk, the Software will automatically program
the measurement device.
the R_CONFIG file defines the connections between all those devices - you shouldn't change anything in the default R_CONFIG except if you want to have a full automatic calibration setup.
I've spent most of the time figuring out how automatic switching works, so i don't have to switch cables all the time. Here's what i figured out:
You have to add a 'Router' device to G_CONFIG, i added to the end:
CEDAT (
ISYSTEMNO "1"
INAME "Rt1"
IDDRIVER "si5020"
IMODELOPTION "Tektronix SI5020"
IUNIT "1"
IIDNO "n/a"
ICALDATE "n/a"
IDUEDATE "n/a"
IADDRESS " 5"
)
In R_CONFIG, there's a 'Section 3 - Path definitions'. In the manual configuration, every line has a unique number in the 'manual close' column.
To automate a entry in that section, you have to move the unique number to the 'auto close' or 'auto open' section, depending on your switch setup.
In 'Section 4: auto switching commands', you need to add one line for each of the automatic entries from section 3. Syntax is as follows:
1 1:O1,3,4_1:C2,5,6,7,8
The first column is the unique identifier from section 3. After that, the second column tells which GPIB unit should be used, and which relays should be closed and opened for that particular path. In my example above, Relays 1,3 and 4 will be closed, while 2,5,6,7 and 8 will be opened.
I haven't defined that section so far, as i'm still waiting for the HP 75000 system i bought which should do all the switching.
Hope this is helpful anyways.
-
Hi dxl,
I am working on the Calibration for my TDS754D.
Can you tell me the detial of how to hack up DOSEMU to add a driver that simulates those card.
I don't have old PC anf NI PCII GPIB card ,but a modern NI GPIB USB HS Adapter only.
thanks advance.
Roger
-
I've uploaded the code i've written to https://github.com/sschnelle/qemu-gpib/commits/master. However, this only works for the Field Automation Software, other MSDOS software didn't work.
-
dxl,
Thanks for your reply.
I assumpt your are running the DOS on QEMU.
So what I need to do list:
A. Install a linux system on my PC, some OS like Ubuntu, and then install the linux driver for NI GPIB HS Card.
B. Download the QEMU and make it run on linux.
C. Clone qemu-gpib master brunch to local QEMU.
D. Start a DOS emulator on QEMU, like FreeDOS, at https://en.wikibooks.org/wiki/QEMU/FreeDOS.
E. Last step, run the Automating Tektronix Field Adjustment, do everything must to be done......
Correct me if I am wrong.
Roger.
-
Hi All,
i've read several threads here about Tektronix scopes. I bought one a while ago (a TDS754D). That unit had a broken display (CRT was so weak, you couldn't read anything). I replaced that with a TFT LCD, so that problem is solved now. However, the processor board lost all of it's CAL constants, ...
The cal constants are stored on the acquisition board in a pair of EEPROMs. It's odd that you could lose them since they are hardware write protected by the protection switch on the processor board.
-
dxl,
Thanks for your reply.
I assumpt your are running the DOS on QEMU.
So what I need to do list:
A. Install a linux system on my PC, some OS like Ubuntu, and then install the linux driver for NI GPIB HS Card.
B. Download the QEMU and make it run on linux.
C. Clone qemu-gpib master brunch to local QEMU.
D. Start a DOS emulator on QEMU, like FreeDOS, at https://en.wikibooks.org/wiki/QEMU/FreeDOS. (https://en.wikibooks.org/wiki/QEMU/FreeDOS.)
E. Last step, run the Automating Tektronix Field Adjustment, do everything must to be done......
Correct me if I am wrong.
Roger.
Yes, those steps are right. I digged and found the MSDOS image i used for calibrating my TDS754D. I've uploaded them to http://stackframe.org/qemu-gpib/. (http://stackframe.org/qemu-gpib/.) Just download and gzip -d the msdos_gpib file. The msdos_gpib.sh contains the commandline required to start qemu with gpib support. And yes, the first version was running on dosemu, but qemu/kvm is much faster when it comes to process all the FFT stuff that's done inside of the Field Adjustment software. So i switched to QEMU.
-
I had downlaod it.
I have everything need for the Cal. of my TDS754D........ :-+
Thanks so much.
-
One thing i forgot to mention - in the QEMU GPIB code, there's a function gpib_map_commands(), which does some translation of the GPIB commands for my Test equipment. If you have all the equipment Tek wants, you can remove that function.
The current function translates the commands so that the FAS can work with my equipment, which is:
- a Fluke 3330 calibrator with own GPIB interface
- a Rohde & Schwarz SMIQ03 RF generator
- a PREMA 6.5 digit DMM
- an HP75000 based switching system to run the full test suite automated.
-
Got it.
:)
-
BTW,
Actually, I don't have the equipment tek recommented.
I am going to calibrate it manually.
refer to the service manual of TDS700D, there are 3 cal. test:
1) Voltage Reference
2)Frequency Response
3)Pulse Trigger
I have two 6.5 digit DMM,HP3456 and HP3457A, and RF singal generator of MT8801C.
there will be no problem with Voltage Reference / Frequency Response cal.
for Pulse Trigger, I plan to buy a "Pulser, Tunnel Diode",Tektronix part number
067-0681-01.
thanks.
-
hello i am also busy try to cal. my TDS754D but get erros while doing voltage calibration.
anyone ever had that ? (i have my Processor board fail still ( i keep that in mind)
could there be a link?
-
The software requires an old NI PCII/A GPIB ISA card. As i don't have such a card nor the old DOS PC required, i started to hack up DOSEMU to add
a driver that simulates those card, so i could run everything on Linux with my more modern NI GPIB USB HS Adapter.
...
I've uploaded the code i've written to https://github.com/sschnelle/qemu-gpib/commits/master
Awesome work on qemu ! I had started to do the exact same thing a few months back : for some reason I never found this thread until very, very recently. I also spent much time analyzing the TDS700.exe binary, and went down a slightly different path.
As you stated, the field adjustment software needs either an ISA, NI GPIB-PCII or PCIIA card, which are getting hard to come by. These cards are based on a NEC7210-compatible IC which implements a set of 8 registers. One difference between PCII and PCIIA cards is the mapping of these registers in the x86 IO address space. Otherwise they behave pretty much the same, as far as the field adjustment software (can I call it just FAS ?) is concerned.
Now, as it turns out, many ICs have implented a 7210-compatible interface or just cloned it altogether. Anything NAT4882-based necessarily has a 7210 mode, and this means many many ISA cards could *potentially* be used with the FAS. The caveat of course being that the FAS needs to be modified to use the proper IO address mapping.
Here's a table that hopefully explains better than me.
index : 7210 register #
name : 7210 register name
*_mapping : IO port used to access the register on a certain card type (AT is GPIB-AT, not sure about GPIB-AT/TNT)
index name PC2_mapping PC2A_mapping AT_mapping
0 CDOR 02B8 02E1 02C0
1 IMR1 02B9 06E1 02C2
2 IMR2 02BA 0AE1 02C4
3 SPMR 02BB 0EE1 02C6
4 ADMR ...
5 AUXMR ...
6 ADR ...
7 EOSR ...
Here's the relevant section of code in the FAS that generates the IO port mappings:
;Dissassembly from TDS700.exe near file offset 0x346CD
;
;This code path parses the "GPIBn=PC2A [dmach] [irq] [DIPswitch]" environment variable
;(set in ADJ700.bat)
;
;gpib_cardID is "n" in "set GPIBn=...", so 0 or 1.
;Notice this pattern:
; lea ax, [di+2E1h]
;which does "ax = di + 0x2E1", where di is generated based on the DIP switch setting.
;We recognize 2E1 as the base address for register CDOR on the PCIIA cards !
3B14:017F mov si, [bp+gpib_cardID]
3B14:0182 shl si, 1
3B14:0184 mov es, seg_77546
3B14:0188 mov di, es:[si+big.GPIB_DIPswitch]
3B14:018D mov cl, 0Dh ; shift DIPswitch setting to set address bits A14..A13
3B14:018F shl di, cl
3B14:0191 lea ax, [di+2E1h]
3B14:0195 mov es, seg_77548
3B14:0199 mov es:[si+big.DIR_CDOR], ax
3B14:019E lea ax, [di+6E1h]
3B14:01A2 mov es, seg_7754A
3B14:01A6 mov es:[si+big.ISMR1], ax
3B14:01AB lea ax, [di+0AE1h]
3B14:01AF mov es, seg_7754C
3B14:01B3 mov es:[si+big.ISMR2], ax
; ... and so on.
I had difficulty finding an inexpensive GPIB-PCII board, so after realizing this I bought a GPIB-AT . Then I have patched the FAS to use the correct addresses (as well as the shift constant to use the "DIPswitch" value correctly) . So far it seems to be working - I've been able to connect to the DUT (my TDS744A) ! Note, for lack of cal equipment, I haven't actually tried any of the steps yet but I see this as a very good sign.
TLDR : here's a summary of the possible methods to run the field adjustment software for these TDS scopes:
- basic setup : native DOS machine with an ISA card either GPIB-PCII or GPIB-PCIIA; this means nothing more recent than roughly Pentium III for the last ISA motherboards.
- dxl's neat qemu layer : DOS running in qemu, modern host computer with a modern USB-GPIB device
- native DOS machine + an ISA-GPIB card that claims to be PC2-compatible : looking at the list of supported devices in linux-gpib shows some names that also pop up on ebay, like "CEC PC 488", "cb7210", and some others. It's likely some of these will indeed be perfectly PC2 / PC2A compatible and not require patching the FAS.
- native DOS machine + an ISA-GPIB that is *not* PC2 compatible, but based on a controller IC such as NAT4882 which implements 7210 registers. The GPIB-AT is one of these. This requires patching the FAS which is fairly straightforward.
I've been running my tests on freeDOS running on an old dual-P3 server motherboard; I don't think it's necessary to suffer needlessly and run plain MS-DOS. But, as I mentioned I haven't tried the cal process, only the initial connection.
For those also wanting to do a native DOS + ISA card setup, I did some research to catalog NI ASSY # for these products. NI has many different hardware revisions for each product name, so it can be hard to identify the product based just on PCB photos.
ASSY : printed on component side of PCB. Back side often / always has a different number.
Some of these don't make sense to me, but I'm fairly confident anything with a 7210 or NAT4882 can be made to work with the FAS.
ASSY Model Controller Notes
180100-02H GPIB-PC D7210C #180102-02 backface; "GPIB-PCII" printed near conn ??(datecode 0989)
180100-02H GPIB-PC D7210C #180102-02 backface; (datecode 0587)
180210-01 GPIB-PC2A? D7210C #180212-01A backface (dc 1485). no RTC
180210-02 GPIB-PC2A? D7210C #180212-01A backface (dc 1485). RTC
181060-01C AT-GPIB NAT4882+TURBO4882 PLCC sticker "AT-GPIB" near conn ??
181060-01E AT-GPIB NAT4882+TURBO4882
181065J-01 GPIB-PCII/IIA NAT4882
-
The github link does not work anymore, is there a chance I could get that content for some tests with my 754D?
-
Hello, I was reading your post after searching for GPIB PCIIA ISA card, and I wonder whether you finally had a chance to grab one of these. I need to calibrate a Keithley unit, and software requires such card. I got one on ebay, but it did not come with the DOS diskette to install it. Do you know any source to download the PCII/PCIIA software?
Thank you!
-
http://www.ni.com/product-documentation/54558/en/?OpenDocument (http://www.ni.com/product-documentation/54558/en/?OpenDocument)
-
Hi
I would be interested too in the qemu-gpib.
Anybody?
-
dear friend, who has the calibration software? could you give me a copy? and firmware updater disk?thanks.
-
i can help you out.. please pm me
-
Looking for the contents of https://github.com/sschnelle/qemu-gpib/commits/master as it is no longer a valid link--hopefully someone has it?
-
Unfortunately I can't find my fork of qemu-gpib, but I was able to rescue the essential files.
I have created a branch with those files, but it will NOT compile, and will NOT work without some work :
1- original code was ported on a qemu tree from around 2012 that I can't find in current master repo
2- qemu codebase has changed a lot since 2012
If anyone's interested in working on this, I made a quick commit with just the files here:
https://gitlab.com/fenugrec/qemu/-/tree/gpib_pciia
-
I updated the patch in the beginning of the year, and iirc it worked: https://github.com/svenschnelle/qemu/tree/pciia
-
I updated the patch in the beginning of the year, and iirc it worked: https://github.com/svenschnelle/qemu/tree/pciia
Hi,
that's awesome !! I didn't know you were still following this thread. Thanks again for sharing this.
-
Not really following, but once a year or so i stop by ;-)
-
I finally calibrated my 744A last week, and discovered a few things while doing so , and decided to share a few tips in a video https://youtu.be/wSqTj4gGCJU (https://youtu.be/wSqTj4gGCJU)
Here are the main points :
- Supported ISA GPIB cards : https://www.eevblog.com/forum/testgear/automating-tektronix-field-adjustment-software-for-tds-oscilloscopes/msg1388658/#msg1388658 (https://www.eevblog.com/forum/testgear/automating-tektronix-field-adjustment-software-for-tds-oscilloscopes/msg1388658/#msg1388658)
- CVR calibration does NOT absolutely require a metrology-grade DC calibrator like the DP8200, EDC 501 etc. But does need something better than just a lab PSU
- CVR calibration needs +- 9.5V at the highest setting (not 104V as the service manual indicates) ; look at your "CVRCAL.500" file to confirm
- HF cal needs 505MHz for a 500MHz scope, at +16 to +17 dBm. Many signal generators cannot do this, but a simple RF amplifier will do the trick.
- HF cal : watch out for lossy coax cable (e.g. RG58 ) ! Even 0.6dB of loss caused problems. Manually compensating that loss worked OK.
-
Hello dxl,
How is you project for automating the FAS 'Router' advancing?
Do you have any news, more details?
-
Hello,
As i need to calibrate my newly acquired TDS744 after input relays replacement, I was hoping to get FAS working.
I was trying to get qemu gpib layer compiled and working, so far without any success.
Older (2021) branch will not compile anymore, trying to apply changes to the new qemu branch will fail to compile. Patching it requires more knowledge than i have. :-[
Anyone have up to date qemu with gpib patch or at least working branch?
I have also built an PII computer with ISA hoping it will run with CEC PC-488 8bit ISA card. This card have different IO port mapping, which i realized shortly after reading available documentation and ofc., ebay parcel arrival :palm:
fenugrec
could you please share your patched TDS700 executable for GPIB-AT (i'll buy this card if it will work, PCII/PCIIA are just too expensive) or even better, if possible publish the patching procedure so i can try to patch executable for CEC PC-488 card?
Thanks!
-
or even better, if possible publish the patching procedure so i can try to patch executable for CEC PC-488 card?
You have seen this post ? : https://www.eevblog.com/forum/testgear/automating-tektronix-field-adjustment-software-for-tds-oscilloscopes/msg1388658/#msg1388658 (https://www.eevblog.com/forum/testgear/automating-tektronix-field-adjustment-software-for-tds-oscilloscopes/msg1388658/#msg1388658)
Granted the details are bit vague if you're not used to reversing software. You need to
- find the docs for your ISA card and find the addresses of the control registers. See the table in the post I linked above
- is your address map more similar to a PC2 or PC2A ? i.e. a xxx8, xxx9, xxxA sequence vs 02xx,04xx,06xx ? pick one. I used PC2A; PC2 will require slightly different modifications
- Optional, if yours is going to be based on the PC2A : near file offset 0x6dcd1, modify two occurences of "PC2A" to an arbitrary string that you will use in the config file. I used just "AT".
Remember, you can't change the length of the .exe file, and string needs to be 0-terminated.
- tweak the code near file offset 0x346D1 . Any hex editor will do but it helps to look at disassembly to validate. See screenshot below; patched version is on the right.
Maybe this decompiled code will help understand what happens there :
iVar6 = strcmp_0d84(..., "PC2A");
if (iVar6 == 0) {
/* PC2A addresses */
p_bigstruct = (big_struct *)(iVar3 * 2);
iVar6 = p_bigstruct->GPIB_DIPswitch << 0x0d;
p_bigstruct->gpib_CDOR = iVar6 + 0x2e1;
p_bigstruct->gpib_IMR1 = iVar6 + 0x6e1;
p_bigstruct->gpib_IMR2 = iVar6 + 0xae1;
p_bigstruct->gpib_SPMR = iVar6 + 0xee1;
p_bigstruct->gpib_ADMR = iVar6 + 0x12e1;
p_bigstruct->gpib_AUXMR = iVar6 + 0x16e1;
p_bigstruct->gpib_ADR = iVar6 + 0x1ae1;
iVar6 = iVar6 + 0x1ee1;
}
else {
/* PC2 addresses */
tmp2 = (big_struct *)(iVar3 * 2);
uVar5 = *(undefined2 *)0x2e78;
tmp2->gpib_CDOR = tmp2->GPIB_DIPswitch << 3;
tmp2->gpib_IMR1 = *(int *)(iVar3 * 2 + 0x4a) + 1;
tmp2->gpib_IMR2 = *(int *)(iVar3 * 2 + 0x4a) + 2;
tmp2->gpib_SPMR = *(int *)(iVar3 * 2 + 0x4a) + 3;
tmp2->gpib_ADMR = *(int *)(iVar3 * 2 + 0x4a) + 4;
tmp2->gpib_AUXMR = *(int *)(iVar3 * 2 + 0x4a) + 5;
tmp2->gpib_ADR = *(int *)(iVar3 * 2 + 0x4a) + 6;
iVar6 = *(int *)(iVar3 * 2 + 0x4a) + 7;
}
}
[EDIT - typo in addresses]
-
I have seen that post, however never worked with disassembler in any way, nor patched an DOS MZ executable. Your reply was more clear now, thanks for explanation.
What can go possibly wrong to at least try, right?
CEC PC-488 have factory default starting address 0x2B8, used range is 2B8-2BF according to manual.
After watching some tutorials, managed to patch exe in RAW mode using ghidra. Executable must be opened in RAW mode so it can be exported back to DOS MZ executable correctly.
After a few HW configuration trials, some patches/exports, finally managed to get instrument detected :-+
Btw, couln't find PC2A refference around offset 0x346b2, is the offset correct??
Few notes:
- PC2A card is selected in startup batch
- CEC PC-488 *MUST* have IRQ enabled in my case (IRQ7)
- I'm getting "Spurious SQR error" which so far have no impact to functionality
I'm not sure if it's allowed to attach TEK FAS executables, so I'll share it upon request :-/O
-
After watching some tutorials, managed to patch exe in RAW mode using ghidra.
Excellent work !
Btw, couln't find PC2A refference around offset 0x346b2, is the offset correct??
Oops, copypaste error; 2 occurences are at 6dcd1 and 6dce1. But it's purely cosmetic.
SRQ error : that's weird. I don't remember it being a problem, but the error message looks vaguely familiar. Also I don't remember if I had to do anything for IRQ settings; I'd have to reconnect + boot the temporary DOS machine I built just for this.
Re sharing patches : I want to try https://github.com/pR0Ps/pycrk to generate / apply human-readable binary patch files. Not a fan of python venv stuff which is why I haven't tried yet, but I'm not aware of many tools for this kind of thing.
-
I'm not sure if it's allowed to attach TEK FAS executables, so I'll share it upon request :-/O
I uploaded my patch for GPIB-AT and instructions for creating / applying similar patches here :
https://github.com/fenugrec/tdsutils/tree/master/tds700adj_patches
If you want, grab xdelta3 (a brilliant tool) to produce a delta-diff - smaller and not problematic to share , and I could also add it to my repo.
-
Nice!
Patch for CEC PC-488 attached, uses "PC2A" for card type configuration in batch.
-
7z file was missing for some reason... :wtf:
-
Cool, will add to my repo.
Looks like your card uses the same addresses as PC2, did it not work as-is with the unpatched exe ? Oh I see you also tweaked the GPIB_DIPswitch << X line too..
-
I tried to use PC2 settings for PC488 but without any success, afterwards i decided to patch exe.
It seems there is something different for PC2, maybe different DIP mask value would work :-//
-
Dear participants of this thread, a group of incurable optimists has started the effort of fully reversing the Tek FAS and redo it for a more modern and affordable infrastructure in this thread:
https://www.eevblog.com/forum/testgear/tektronix-tds-scope-field-adjustment-software-reverse-engineering/ (https://www.eevblog.com/forum/testgear/tektronix-tds-scope-field-adjustment-software-reverse-engineering/)
If your available time and interests allows, kindly please have a look and contribute, your expertise is invaluable in putting the project on the road.
Also, is this FAS sw (DOS version) available somewhere and did anybody confirm if the FAS software uses the CEC library ?
Thanks and cheers,
DC1MC