Author Topic: Just got a Tek 2465A, couple questions (how I screwed the calibration data)!!  (Read 7351 times)

0 Members and 1 Guest are viewing this topic.

Offline MarkL

  • Supporter
  • ****
  • Posts: 1627
  • Country: us
...
I'm at loss how it got scrambled so badly?
...
SRAM contents are random after being powered up.  The value is dependent on tiny process variations for each bit cell.
 

Offline alpher

  • Regular Contributor
  • *
  • Posts: 228
  • Country: ca
I added a diode in series with vcc pin just in case programmer does something silly, like grounding the pin before reading, just being extra careful here.
One resistor pulls the  WE pin high also as a precaution, the other is needed because I'm reading it as a plain 27C64 eprom, and pin 26 is not connected there, but on uPD4464 pin 26 is a second chip select CE2 ant it must be high for reading.
Somehow my programmer doesn't have an option to read 4464 it can only write!!
 

Offline alpher

  • Regular Contributor
  • *
  • Posts: 228
  • Country: ca
...
I'm at loss how it got scrambled so badly?
...
SRAM contents are random after being powered up.  The value is dependent on tiny process variations for each bit cell.

I beg to differ here, static ram sometimes can retain their data even after complete power loss, especialy in low temperature. We're talking relatively short periods of time here, seconds.
 

Offline MarkL

  • Supporter
  • ****
  • Posts: 1627
  • Country: us
Perhaps you missed this question...

Are you sure that screw pad you soldered to is connected to the ground of the board?  Some of those pads could be floating.
 

Offline alpher

  • Regular Contributor
  • *
  • Posts: 228
  • Country: ca
I've checked the resistance, dead short to GND.
Something else must have happened, my best guess is that I may accidently somehow touched the vcc pin or anode of the CR2770 to the aluminum standoff while mounting the board back.
I was trying to be extra carefull, but who knows.
Other than that maybe some sort of static discharge while soldering/desoldering ?, it is pretty dry here in winter.
I don't really know.
Was hoping somehow that I be able to figure it out from the memory dump (it would be doable if perhaps one byte was bad), but with so many bytes evidently wrong I'm at loss, I think it's hopeless. :'(

Anybody knows the way to calibrate these "on a cheap" ?
 

Offline MarkL

  • Supporter
  • ****
  • Posts: 1627
  • Country: us
I've checked the resistance, dead short to GND.
Oh well, I thought I had a good guess.  Those top two screw pads are floating on my 2465 board, but it's obviously a different design.
 

Offline z01z

  • Regular Contributor
  • *
  • Posts: 146
If it helps, these are the constants from a 2465A, written down from the screen (so there may be some errors).
 

Offline alpher

  • Regular Contributor
  • *
  • Posts: 228
  • Country: ca
If it helps, these are the constants from a 2465A, written down from the screen (so there may be some errors).

Wow, thanks man !! :) :)
Much appreciated, will try them over the weekeend, now I have to figure out how to calculate "spiral" checksum.
 

Offline MarkL

  • Supporter
  • ****
  • Posts: 1627
  • Country: us
Much appreciated, will try them over the weekeend, now I have to figure out how to calculate "spiral" checksum.
Here's a starter for you.  I already figured out the "spiral-add" for the 2465.  With any luck it's not too different from the 2465A:

  https://www.eevblog.com/forum/testgear/tektronix-2445-2465-cal-settings-earom-er1400/msg927144/#msg927144

It's just the assembly code that does the spiral-add translated into C.  No points for efficiency.
 

Offline alpher

  • Regular Contributor
  • *
  • Posts: 228
  • Country: ca
Thank you Mark, now I remember I read your thread awhile ago, if I remember right you were having a similiar issue
only with a plain 2465, how did it end up for you?
Must reread your thread.
 

Offline alpher

  • Regular Contributor
  • *
  • Posts: 228
  • Country: ca
Quote
A "spiral-add" checksum for all the cal data is stored at location 0x00.  So, if we know the checksum and we know there's only one bad word, it might be possible to reconstruct the bad word.  I don't know exactly what algorithm they mean by "spiral-add", but it could be figured out.  But then the problem is how to write the correct word back to the EAROM at 0x4C.  That could be done too, but it's not trivial.

Mark this is a quote from you on the older thread on 2465 earom, there checksum is located at 0x00 could you elaborate a little what it means?
What I'm driving at is, the location 0x00 is it somehow relative to the location of constants within the earom or is it an "absolute" first location in the chip?
I'd like to know, cause in my case memory dump at 0x00 changes from read to read, in case of 2465A would make more sense to dedicate the whole last 512 Bytes of ram to storage of constants and checksume this area only storing checksum at the end or the beginning.
Do you think that's the case here?
Why it matters ? Cause if that's the case the values that z01z posted should contain the checksum allready since there are a full 512 bytes there.

Here's the z01z data in different form, I marked the first AA constants in red since manual says that many there are,
my guess is that the remainder is for the differnt options perhaps?

Code: [Select]
Offset(h) 00   02   04   06   08   0A   0C   0E   10   12   14   16   18   1A   1C   1E
[color=red]
00000000  005B 0675 266A 264D 0637 2627 082E 0822 280B 27FB 0830 0218 221A 221A 2216 2229
00000020  21F7 21FE 01FF 01FC 0212 0068 001F 0020 0023 0020 1C18 3CA8 1D1C 1D94 1FAC 3FA8
00000040  3FA1 3F79 1FB4 0236 0236 2232 2231 1E13 3CA1 3CDA 1000 3FAB 3FA2 3FAB 3FA2 3FAE
00000060  02E4 02E4 02E1 22E0 075C 2834 083C 082B 081B 0839 2823 2065 0836 283B 282F 2820
00000080  2834 081E 2063 2344 0334 2335 2672 2660 2672 065E 02F9 22DC 186B 0E8D 0E90 0724
000000A0  071E 0214 220D 015F 2146 23A9 040F 239A 0326 03D0 0345 230F 0456 0370 02FC 23A6
000000C0  2249 0531 250A 23D4 2596 04B2 04AA 06EC 04D7 03A1 2563 2297 00BF 00C4 20A9 AA66
000000E0  7DA2 032D 851B E8FD 2D47 919F 0440 A1AB 6B25 38B7 DA04 07D6 C003 0484 E87E 6C70
00000100  C76B 9550 6A81 537B F911 3038 D00C 442E 8508 12CE C57E EA21 1421 22FA 3CD5 9DE9
00000120  D8AC 2106 B052 36F9 3FD0 30EB F44E E5AD CB25 08EE E154 0859 BB11 5C93 98CA 844C
00000140  763E F08F 00E8 80C5 764A F152 6E0A 1F6D FA63 7CFD[/color] 4190 E2BA 7B01 30F5 F78E C63F
00000160  F7A8 A479 A4D8 0C53 DE26 14DA 1930 0156 C844 15EC F706 076F A7C8 68DE 6630 FE3F
00000180  FC5B 25B6 6F5B 09F9 0B3B 2D47 2AB8 DC9A 7C29 19FB 93B1 C0F6 03C5 6C9F FF19 1CB1
000001A0  B3C4 9973 FF40 3291 9A10 DACF F98C 88CF BE02 47D7 BE10 089A D46C 0EFB D752 D0FC
000001C0  C73D 28A7 8473 A467 3042 3BCC 9F2A 28FB 838A 148A 9F88 88F8 7F86 F07D 5936 AB8F
000001E0  A7AF C67C 7F64 003E DD5A 2422 322A F7D4 F238 8821 3311 D43B E804 AE72 00CB 0000
 

Offline MarkL

  • Supporter
  • ****
  • Posts: 1627
  • Country: us
Thank you Mark, now I remember I read your thread awhile ago, if I remember right you were having a similiar issue
only with a plain 2465, how did it end up for you?
Must reread your thread.
In that thread there was a user who had one bad value in their 2465 earom (maybe it was a 2445?).  We managed to find which value it was, and further what that calibration constant did (something to do with delta-V cursors).

We then tried to work backwards to replace the bad value by computing trial values with the right parity that would also match the spiral-add checksum for the whole earom.  But because Tek truncated the checksum to 8 bits before storing it, it left many possible combinations for correct solutions.  There was no way to know which match was the original value.

In short, it was a fun exercise but it didn't end up solving the user's issue.  And before anyone says it, yes, a re-cal would have been easier.  But you're missing the word "fun".
 

Offline MarkL

  • Supporter
  • ****
  • Posts: 1627
  • Country: us
Quote
A "spiral-add" checksum for all the cal data is stored at location 0x00.  So, if we know the checksum and we know there's only one bad word, it might be possible to reconstruct the bad word.  I don't know exactly what algorithm they mean by "spiral-add", but it could be figured out.  But then the problem is how to write the correct word back to the EAROM at 0x4C.  That could be done too, but it's not trivial.

Mark this is a quote from you on the older thread on 2465 earom, there checksum is located at 0x00 could you elaborate a little what it means?
What I'm driving at is, the location 0x00 is it somehow relative to the location of constants within the earom or is it an "absolute" first location in the chip?
For the 2465, the checksum is stored at an absolute location of 0 in the EAROM.  The EAROM (ER1400) is a bit of an odd thing.  It has 100 locations of 14 bits each and is addressed serially with BCD digits.  It's not in the processor's address space like on the 2465A.

Quote
I'd like to know, cause in my case memory dump at 0x00 changes from read to read, in case of 2465A would make more sense to dedicate the whole last 512 Bytes of ram to storage of constants and checksume this area only storing checksum at the end or the beginning.
Do you think that's the case here?
Why it matters ? Cause if that's the case the values that z01z posted should contain the checksum allready since there are a full 512 bytes there.
I think that's inconsistent with the 2465, assuming location 0 is the checksum on the 2465A.  As I recall, the checksum on the 2465 was static.

But you might be right that all you need to do is copy z01z's data to 0x1E00.  Caveats:  There has to be no mistakes in the data, and also that a single capture is consistent with itself (e.g., location 0x00 is not changing while you're capturing everything else, assuming that 0x00 is either the actual checksum, or 0x00 is included in the checksum it if it lives somewhere else).
Quote
Here's the z01z data in different form, I marked the first AA constants in red since manual says that many there are,
my guess is that the remainder is for the differnt options perhaps?
...
It could also be settings for the scope that need to be remembered between power ups.  Maybe they're not included in the checksum because if a knob setting is not restored it's not as important, and it's annoying to recompute the checksum every time someone tweaks a knob.  Just a guess.
 

Offline alpher

  • Regular Contributor
  • *
  • Posts: 228
  • Country: ca
Reacalibration easier?  :o Gues if I had necessary gear, maybe.
Anyway here's the z01z's calibration data in a differnt format, (guess you cannot color within code brackets).
I marked the firts AA contants, according to the service manual there shoul be AA 14bit constants in the 2465A ram CMOS memory.
What worries me is that starting from 6F there are some bigger that that ?  :-//
Should I worry or the manual is wrong here?

Offset(h)     00     02     04     06     08    0A    0C     0E     10    12     14    16     18    1A     1C     1E

00000000  005B 0675 266A 264D 0637 2627 082E 0822 280B 27FB 0830 0218 221A 221A 2216 2229
00000020  21F7 21FE 01FF 01FC 0212 0068 001F 0020 0023 0020 1C18 3CA8 1D1C 1D94 1FAC 3FA8
00000040  3FA1 3F79 1FB4 0236 0236 2232 2231 1E13 3CA1 3CDA 1000 3FAB 3FA2 3FAB 3FA2 3FAE
00000060  02E4 02E4 02E1 22E0 075C 2834 083C 082B 081B 0839 2823 2065 0836 283B 282F 2820
00000080  2834 081E 2063 2344 0334 2335 2672 2660 2672 065E 02F9 22DC 186B 0E8D 0E90 0724
000000A0  071E 0214 220D 015F 2146 23A9 040F 239A 0326 03D0 0345 230F 0456 0370 02FC 23A6
000000C0  2249 0531 250A 23D4 2596 04B2 04AA 06EC 04D7 03A1 2563 2297 00BF 00C4 20A9 AA66
000000E0  7DA2 032D 851B E8FD 2D47 919F 0440 A1AB 6B25 38B7 DA04 07D6 C003 0484 E87E 6C70
00000100  C76B 9550 6A81 537B F911 3038 D00C 442E 8508 12CE C57E EA21 1421 22FA 3CD5 9DE9
00000120  D8AC 2106 B052 36F9 3FD0 30EB F44E E5AD CB25 08EE E154 0859 BB11 5C93 98CA 844C
00000140  763E F08F 00E8 80C5 764A F152 6E0A 1F6D FA63 7CFD
4190 E2BA 7B01 30F5 F78E C63F
00000160  F7A8 A479 A4D8 0C53 DE26 14DA 1930 0156 C844 15EC F706 076F A7C8 68DE 6630 FE3F
00000180  FC5B 25B6 6F5B 09F9 0B3B 2D47 2AB8 DC9A 7C29 19FB 93B1 C0F6 03C5 6C9F FF19 1CB1
000001A0  B3C4 9973 FF40 3291 9A10 DACF F98C 88CF BE02 47D7 BE10 089A D46C 0EFB D752 D0FC
000001C0  C73D 28A7 8473 A467 3042 3BCC 9F2A 28FB 838A 148A 9F88 88F8 7F86 F07D 5936 AB8F
000001E0  A7AF C67C 7F64 003E DD5A 2422 322A F7D4 F238 8821 3311 D43B E804 AE72 00CB 0000

« Last Edit: March 28, 2018, 04:04:05 pm by alpher »
 

Offline alpher

  • Regular Contributor
  • *
  • Posts: 228
  • Country: ca


Here's the z01z data in different form, I marked the first AA constants in red since manual says that many there are,
my guess is that the remainder is for the differnt options perhaps?
...
It could also be settings for the scope that need to be remembered between power ups.  Maybe they're not included in the checksum because if a knob setting is not restored it's not as important, and it's annoying to recompute the checksum every time someone tweaks a knob.  Just a guess.

I don't think these are settings of the scope as read the memory many times after I changed the settings, powered it up and down and the last 512 bytes never change.
There's a lot of changes in the lower memory locations though.
I've included a few of the reads in the attached zip file.
 

Offline MarkL

  • Supporter
  • ****
  • Posts: 1627
  • Country: us
Reacalibration easier?  :o Gues if I had necessary gear, maybe.
Anyway here's the z01z's calibration data in a differnt format, (guess you cannot color within code brackets).
I marked the firts AA contants, according to the service manual there shoul be AA 14bit constants in the 2465A ram CMOS memory.
What worries me is that starting from 6F there are some bigger that that ?  :-//
Should I worry or the manual is wrong here?
It wouldn't be the first time the service manual was wrong, and in that paragraph in particular.

At least all the data from 0x01 to 0x6E is within range, which is where the manual says parity is computed.

I would say try z01z's data and see what happens.  It might be good to check the parity on 0x01 to 0x6E for a little bit of a verification on the data.
 

Offline MarkL

  • Supporter
  • ****
  • Posts: 1627
  • Country: us
I don't think these are settings of the scope as read the memory many times after I changed the settings, powered it up and down and the last 512 bytes never change.
There's a lot of changes in the lower memory locations though.
I've included a few of the reads in the attached zip file.
Ok, so it's storing the settings elsewhere.

It doesn't surprise me that other parts of memory are changing.  Other than the 128 bytes in the 6808, this is the THE memory for the system, so the processor is doing whatever the processor usually does in the SRAM.  I agree with your suspicion that the last 512 bytes have been reserved for NVRAM functions, but since the whole memory is battery-backed, the firmware could stick non-volatile values anywhere it wants.

In these dumps, location 0x1e00 is always 0xef.  I thought you said it was changing?  Or is there some specific action that makes it change?  Also note that it's an 8-bit value, which is consistent with Tek's checksum algorithm.

Let me rephrase that...  Of course it's 8-bit because that's all I'm looking at.  Duh.  But it's still a consistent 0xef 0x22 in all of the dumps.
« Last Edit: March 28, 2018, 05:12:53 pm by MarkL »
 

Offline MarkL

  • Supporter
  • ****
  • Posts: 1627
  • Country: us
...
I would say try z01z's data and see what happens.  It might be good to check the parity on 0x01 to 0x6E for a little bit of a verification on the data.
Just wrote a quick check.  The parity is good on 0x01 to 0x6E.  FYI.

I can't seem to derive the checksum, though.  It may take disassembling the code for the 2465A.
 

Offline alpher

  • Regular Contributor
  • *
  • Posts: 228
  • Country: ca
0x1e00 is where the calibration constants start, from there on to the very end  512 bytes or 256 words (14bit words if to believe the manual  ;D ).
I'm going to try z01z data mybe even today, anxious to see the outcome .
 

Offline MarkL

  • Supporter
  • ****
  • Posts: 1627
  • Country: us
I did a little disassembly of a 2465A EPROM (160-3303-06) and found checksum code similar to the 2465.  It appears to be checksumming the calibration values from 0x11 to 0xAA, with special processing for locations up to and including 0x6E.  The special processing would be the parity checking.

Unfortunately, I still can't get the computed checksum to match.  Without an actual 2465A to watch with a logic analyzer, it's getting too much in the weeds to figure out.

It could be something I'm doing wrong (very likely), or there's an error in the data (possible).  If anyone else has a second set of Exerciser 02 data from a 2465A I could look at, please post.


Good luck with z01z's data.  Let us know what happens...
 

Offline usuthu65

  • Contributor
  • Posts: 8
  • Country: us
Hello,

I happen to have a still functioning 2465A.  A safety-copy video with the Exerciser 02 data is here:

https://photos.app.goo.gl/g5OUIetQAZVJYZfs2

Sorry that I don't have time to transcribe it but you can pick it off the video.

By the way, I don't have any illusions this scope is still even close to being in calibration so I'm planning in the future to get one done.  I suggest you budget for one as well.  Chuck Harris would be a go-to person for the task and he has all the right gear.

Good luck!


 
The following users thanked this post: MarkL, alpher

Offline alpher

  • Regular Contributor
  • *
  • Posts: 228
  • Country: ca
Thanks Phil, much appreciated. I will transcribe your data and post it later.
For most of the evening I've been fighting  my programmer (wellon vp480) trying to program the SRAM in the scope, so far no-go. :(
It errors out after only a dozen bytes or so, I suspect that the loading on CE2 and/or OE maybe even vcc is too high, may have to cut some traces to isolate the chip.
Have to dig into uPD4464 datasheet. :(
Anybody has a good suggestion as to what chip to use as a template during write?
I've trried dallas ds1225Y, no go even if I slow down the cycle to 1mS, in desperation I even tried to program it as a 28C64 EEPROM  :) .
Somehoe the geniuses at wellon didn't think that writing and reading SRAM can be useful.
The chip is listed as supported but the read button is grayed out and the write button
doesn't actually write the buffer data but performs a test of some sort, damn. >:(
 

Offline alpher

  • Regular Contributor
  • *
  • Posts: 228
  • Country: ca
Hello,

I happen to have a still functioning 2465A.  A safety-copy video with the Exerciser 02 data is here:

https://photos.app.goo.gl/g5OUIetQAZVJYZfs2

Sorry that I don't have time to transcribe it but you can pick it off the video.

By the way, I don't have any illusions this scope is still even close to being in calibration so I'm planning in the future to get one done.  I suggest you budget for one as well.  Chuck Harris would be a go-to person for the task and he has all the right gear.

Good luck!

Thanks again usuthu65, here's your data copied to hex.
Hope there are no errors there, it took me a couple of hours.


Code: [Select]
Offset(h) 00   02   04   06   08   0A   0C   0E

00000000  00CD 06DC 26DB 06C1 268B 265A 06FD 270E
00000010  2702 06F8 06E3 21BA 01C5 21C4 21C1 01DB
00000020  01F3 0203 2204 2202 221A 2081 001C 001A
00000030  001F 201E 1BE3 3D44 1CAC 1D25 1FAC 1FC6
00000040  3FAD 3FA7 1FBD 0247 0247 2237 0242 3CB0
00000050  1E0D 1CF6 1000 3FAD 1FA6 3FB0 1F9F 3FB5
00000060  22E3 22E3 22E0 02DE 071B 084E 283B 282C
00000070  281F 083A 0828 205F 2849 2832 282A 281C
00000080  082E 281C 2060 2344 0331 2330 266C 0654
00000090  266A 0679 229E 22D0 1815 2ED0 0E9C 2726
000000A0  2725 020F 222F 214C 2132 0444 2633 03B3
000000B0  0331 049A 246E 236C 2514 27FE 27FE 27FE
000000C0  039E 059D 03A2 22F1 248A 06F8 0568 2770
000000D0  079F 26EE 27FE 02DD 00BC 00C1 20A5 005F
000000E0  5301 8CFA DC07 A720 5BE5 6556 FA65 188A
000000F0  FA00 40FF FF20 00DE FBC0 009E E620 18AF
00000100  EFC7 23CF B40E EDEA 7130 889E DC52 47DD
00000110  FF31 30FF DB00 86DE F7B2 5CF9 DF24 40F6
00000120  B24B 8E8C FAFC ED7B D91D 83E7 6D81 E1A0
00000130  EF10 6031 FC04 687A FF08 007E DB0A 04DD
00000140  BB24 82D7 EC33 0AD7 2E95 23EC 5F3F 44F1
00000150  B300 01FF 2501 A4F7 3D03 027F FD15 00DF
00000160  22C9 AB16 D60C 0A2B E525 84D5 D241 9E9D
00000170  FF04 00D9 6F1A D5FD 6302 70FD DB80 027D
00000180  86DA 4A9D F656 EED9 A40D 0EC9 BBE2 9CDF
00000190  7218 13FF 7D08 18BB E708 10FE 6D85 20F7
000001A0  EC2A 9C60 F443 0EDC BC6E C59A 873F A2A6
000001B0  FD80 6493 7F01 6963 FB86 0C3F E718 80DF
000001C0  C1A0 C4CF 2588 0553 7351 03FB DF23 A734
000001D0  FF42 44FF DF08 41FF DD80 9186 9F91 04B7
000001E0  E349 A5C4 C1AB 7D0B 3746 429D 7019 E5D3
000001F0  FF84 4EBF FF10 25FF FD04 81BF 1AFE 0000

And here's a full image with your constants inserted.


« Last Edit: March 29, 2018, 05:17:21 pm by alpher »
 

Offline alpher

  • Regular Contributor
  • *
  • Posts: 228
  • Country: ca
OK, I read the 4464 datasheet again, didn't discover anything unusual.
Except maybe a small detail, under "Low Vcc Data Retention " heading noticed that they somehow insist that
"CE2 must be equal to or higher that Vcc-0.2V, or less that 0.2V " while the "normal" Vih calls for just over half of Vcc.
I also noticed that there are 2 resistors 680omhs each in series pulling CE2 to the ground, since I'm feeding it to the Vcc
through 1K no wonder that CE2 stays just below 4 Volts.
Wonder, should I just short the CE2 to Vcc or cut the trace?
 

Offline MarkL

  • Supporter
  • ****
  • Posts: 1627
  • Country: us
...
Wonder, should I just short the CE2 to Vcc or cut the trace?
It looks like shorting CE2 to Vcc should be ok.  I don't see anything pulling it down except R2470 and R2471.  Maybe go to 100 ohms or whatever value gets you above Vcc-0.2V.  I'm not a fan of shorting stuff.
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf