Products > Test Equipment
Tek CSA7404/TDS7000 repair project (Upgraded memory/CPU)
TiN:
This thread is dedicated to Tektronix TDS7000 platform based scopes (TDS7054,TDS7104,TDS7154,TDS7254,TDS7404,CSA7054,CSA7154,CSA7404)
Some information can be useful for newer TDS7000B platform as well, as they are based on similar modules.
Recently I acquired Tektronix CSA7404 scope, bought as dead for parts, at nice price. Unit come in pretty bad physical shape :-BROKE:
All plastic exterior parts except front panel were missing. Outside aluminum shielding/case covers were bent on corners, looked that scope was dropped on angle.
Despite of damages and poor look - it still was able to power on and booting Windows 98 OS. Hard drive had bad SMART status and was making clicking noise, so obviously it's going to be replaced with new HDD as one of first steps of scope restoration.
While machine was able to boot OS without problems, main scope application, TekScope was unable to start. It was just showing welcome splash screen and hanging there. Downloading fresh copy of TekScope 2.5.3 Firmware for CSA7000/TDS7000 from Tektronix site and reinstalling application did not help either.
Before we dig in, let's take a look on high-level block diagram of Tektronix CSA7404 from service manual :
There are four main modules/boards in scope.
x86 PC system (NLX motherboard, Socket 370 Celeron 850/128/100 Coppermine CPU, i810 chipset, onboard VGA, network, USB, SDRAM PC133 x 2 slots (only one used with 256MB DIMM)
PowerPC system (Tektronix custom board with interface to NLX and ACQ board (had installed 256MB DIMM on it))
Acquisition board (ACQ, front-end to scope channels, custom Tektronix high-speed ASICs with dedicated RAM and interface to PowerPC board)
Main power supply board (cross compatible, at least with tested CSA7404 and TDS7704B)
I also had access to working Tektronix TDS7704B, which come handy to check some parts and do board-level testing. Obviously both these scopes use common architecture, and share same power supply board and similar (but not interchangeable) PowerPC/x86 combo. As first measure of any electronic device troubleshooting - check power. Swap whole power supply module from TDS7704B to CSA7404 showed no functional issues or differences, which tells me that power supply to other boards from mains PSU is OK.
Initial testing and debug
First step will be visual inspection of all internals of scope to see, if any components or boards are physically damaged or missing :-/O.
On acquisition board there was missing heatsink on one of big National Semi custom ASICs for channel 3. New heatsink was bought are placed on chip, hoping that it's BGA connection to board is intact.
On x86 board there was leaky output electrolytic capacitor in CPU DC-DC convertor. It was replaced to new one, which is common operation for servicing old computer motherboards already for a while. As a side note, considering cost of such scopes even today it's quite unpleasant to see low-end CapXon capacitors being used.
As was already stated earlier - there were no power supply board problems, as all voltages were present, and no visual damages were observed either. Swapping PSU from another scope did not make scope progress on loading app any further.
Interconnect boards (P200 between PPC board and ACQ, power delivery interconnect boards) were fine too, replacing them to same from TDS7704B did not change anything. So problem lied either in acquisition board, or PowerPC board or interfacing between NLX and PPC boards or PPC/ACQ. Interesting fact, that removing interconnect board P200 from PPC to ACQ on TDS7704B did exactly same - TekScope app stopped working and hung on welcome splash screen. This gives us information, that TekScope app needs to communicate successfully with PPC and ACQ boards to be able to start.
After some checks of x86 side of scope and trying to run few HDDs with Windows 2000 no obvious problems was found. CD-ROM drive was changed to DVD-RW from old laptop. Connection was standard notebook PATA. Original IBM Travelstar DARA-206000 6GB 4200RPM disk was changed to fresh IBM Travelstar IC25N020ATDA04-0 20GB drive. New Windows 2000 SP4 Professional was installed as maximum supported OS on this series scopes. Given current Celeron 850MHz CPU and 256MB this setup should run smoothly for beginning.
Moving our focus to PowerPC board as main suspect. This module There is handy debug 7-segment single digit debug LED, which according to service manual have next codes:
This LED is located on PPC board near riser connector and easily visible even when outer aluminum shell is installed.
Our board during power up and after was rolling from ".8" code to "L", stays there for couple seconds, and then restarting from start again, and doing this infinitely in loops. On working TDS7704B post code LED was going from ".8" to "L", then when OS started goes to "P" and finally to flashing "-", staying there when TekScope application running. Looks like PowerPC board unable to finish it's booting sequence.
NVRAM Failure (Scope boots, OS boots, but TekScope application hangs on welcome splash screens, front panel not responding
Due to age of these machines and usage of battery-backed NVRAM (Dallas DS1245) it's not rare that onboard 3V battery (similar to ones used in usual computers for CMOS data retention) loose it's voltage. Unluckily, boot parameters and configuration is stored in PowerPC NVRAM as well, so after battery failure scope likely to fail, due to inability to load boot ROM from x86 PC system HDD. Visual diagnosis can be done by observing TekScope application to hang on splash screen, and debug POST code indicator rolling codes over and over from 4 to L on PPC board. This is happening because when PPC boot loader lost its boot settings and cannot find correct ROM anymore, it reboots after 10 seconds to try again. That's why it's staying on "L" phase for 10 sec before it repeats loop.
Quickly I found users with very same issues with their TDS7000/CSA7000 series machines here
NVRAM repair solution / fix
First step is to replace faulty battery and allow Dallas NVRAM to be functional again.
Locate NVRAM on PPC board:
On CSA7404 it's near NLX riser connector, and have PowerCAP module on top of DALLAS DS1245YP-100. PowerCAP is just simple PCB with BR1632 battery soldered on and plastic cover. I replaced old battery (voltage on it was 0.7V after removal :bullshit:) with new Panasonic BR1632A/FA. Make sure polarity is correct when soldering battery on. Latch PowerCAP with new battery back on top of NVRAM.
Now we need to reset again correct boot parameters. To do so there are few extra tools are required:
* Serial interface to your host, or RS232-USB dongle
* Few wires for connecting PowerPC debug serial port
* Any terminal software which can work on serial port
I had no RS232 on my PC, but had few UART-USB interface bridges based on Silabs CP2103. RS232 levels are converted from UART by onboard MAX232 Driver IC , which is located near NLX riser connector on PPC board. I connected GND (Pin 15), TX (Pin 11), RX (Pin 12) to Silabs CP2103 dongle inputs and connected terminal at 9600, 8N1 settings.
First boot output with 9600 baud rate, 8N1 settings :
--- Code: ---romPost: MPC106 Walking-one passed.
romPost: MPC106 configuration passed.
romPost: First PCI access passed.
romPost: PC87560 Walking-one passed.
romPost: PC87560 configuration passed.
romPost: DEC21554 configuration passed.
romPost: PERFORMING ROM CHECKSUM TEST...
romPost: ROM checksum passed.
romPost: PERFORMING DRAM CELL TEST...
romPost: Enabling data cache...
romPost: Data cache enabled.
romPost: Enabling instruction cache...
romPost: Instruction cache enabled.
romPost: DRAM Cell test passed.
romPost: Disabling data Cache...
romPost: Data cache disabled.
romPost: Disabling instruction cache...
romPost: Instruction cache disabled.
romPost: PERFORMING DRAM MARCH TEST WITH CACHE OFF...
romPost: Writing address to each *address...
romPost: Reading address from each *address...
romPost: DRAM march test passed...
romPost: PERFORMING DRAM MARCH TEST WITH CACHE ON...
romPost: Enabling data cache...
romPost: Data cache enabled.
romPost: Enabling instruction cache...
romPost: Instruction cache enabled.
romPost: Writing address to each *address...
romPost: Reading address from each *address...
romPost: DRAM march test passed...
romPost: PERFORMING DRAM WALKING-ONE TEST...
romPost: DRAM Walking-one test passed.
romPost: PERFORMING NV-MEMORY WALKING-ONE TEST...
romPost: NV-MEMORY Walking-one test passed.
romPost: Disabling data Cache...
romPost: Data cache disabled.
romPost: Disabling instruction cache...
romPost: Instruction cache disabled.
romPost: Enabling instruction cache...
romPost: Instruction cache enabled.
romPost: POWER-UP DIAGNOSTIC COMPLETE.
Hel
VxWorks System Boot
Copyright 1984-1996 Wind River Systems, Inc.
CPU: Tektronix HPP - PowerPC 740
Version: 5.3.1
BSP version: 1.0.4.0
Creation date: Nov 2 2000, 11:03:34
Press any key to stop auto-boot...
7 6 5 4 3 2 1 0
auto-booting...
boot device : ??D?h?
processor number : 0
flags (f) : 0x0
Network interface D¦h unknown.
Can't load boot file!!
[VxWorks Boot]: Starting at 0xfff00100...
--- End code ---
Then it rebooted and repeated above sequence again, and again, and again.
OK, so now we know that PowerPC board works, but obviously boot device "??D?h?" does not look right, thus it cannot load ROM and boot it's OS.
So let's halt auto-booting process by sending any char to terminal. By doing so we can stop loop and try to interact with PPC system. Now can send "?" command:
--- Code: ---[VxWorks Boot]: ?
? - print this list
@ - boot (load and go)
p - print boot params
c - change boot params
l - load boot file
g adrs - go to adrs
d adrs[,n] - display memory
m adrs - modify memory
f adrs, nbytes, value - fill memory
t adrs, adrs, nbytes - copy memory
e - print fatal exception
n netif - print network interface device address
N - set ethernet address
$dev(0,procnum)host:/file h=# e=# b=# g=# u=usr [pw=passwd] f=#
tn=targetname s=script o=other
Boot flags:
0x02 - load local system symbols
0x04 - don't autoboot
0x08 - quick autoboot (no countdown)
0x20 - disable login security
0x40 - use bootp to get boot parameters
0x80 - use tftp to get boot image
0x100 - use proxy arp
0x1000 - use dio to get boot image
available boot devices: feippc bp sm
--- End code ---
After some experimenting and searching web, I found somebody who had similar issues with CSA8000 oscilloscope. Tried very similar parameters and discovered that they work fine after minor modification for my system:
Send "c" command to set settings:
--- Code: ---[VxWorks Boot]: c
'.' = clear field; '-' = go to previous field; ^D = quit
boot device : sm
processor number : 0
host name : host
file name : c:\vxBoot\vxWorks.st
inet on ethernet (e) : 192.168.0.2:ffffff00
inet on backplane (b): 192.168.0.2:ffffff00
host inet (h) : 192.168.0.1
gateway inet (g) : 192.168.0.2
user (u) : anonymous
ftp password (pw) (blank = use rsh): anonymous
flags (f) : 0x1000
target name (tn) : target
startup script (s) : c:\vxBoot\dio_rst.vsh
other (o) : nvfs=0x1000
--- End code ---
I used path to standard location on my x86 HDD partition, which is hidden folder c:\vxBoot. So if your location different - path need to be corrected. Inet/network addresses are used by internal interface between x86 and PPC. No ethernet cable was connected to either network ports on scope itself.
Now reboot scope.
--- Code: ---...
VxWorks System Boot
Copyright 1984-1996 Wind River Systems, Inc.
CPU: Tektronix HPP - PowerPC 740
Version: 5.3.1
BSP version: 1.0.4.0
Creation date: Nov 2 2000, 11:03:34
Press any key to stop auto-boot...
7 6 5 4 3 2 1 0
auto-booting...
Initializing backplane net with anchor at 0x1e80000... done.
Backplane anchor at 0x1e80000... Attaching network interface sm0... done
done.
Attaching network PC1 dio device driver installed
interface lo0... done.
Attaching DIO client... done.
Loading c:\vxBoot\vxWorks.st...1773516
Starting at 0x200000...
Initializing backplane net with anchor at 0x16e0000... done.
Backplane anchor at 0x16e0000... Attaching network interface sm0... done
done.
PC1 dio device driver installed
Attaching network interface lo0... done.
Adding 6008 symbols for standalone.
]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
]]]]]]]]]]] ]]]] ]]]]]]]]]] ]] ]]]] (R)
] ]]]]]]]]] ]]]]]] ]]]]]]]] ]] ]]]]
]] ]]]]]]] ]]]]]]]] ]]]]]] ] ]] ]]]]
]]] ]]]]] ] ]]] ] ]]]] ]]] ]]]]]]]]] ]]]] ]] ]]]] ]] ]]]]]
]]]] ]]] ]] ] ]]] ]] ]]]]] ]]]]]] ]] ]]]]]]] ]]]] ]] ]]]]
]]]]] ] ]]]] ]]]]] ]]]]]]]] ]]]] ]] ]]]] ]]]]]]] ]]]]
]]]]]] ]]]]] ]]]]]] ] ]]]]] ]]]] ]] ]]]] ]]]]]]]] ]]]]
]]]]]]] ]]]]] ] ]]]]]] ] ]]] ]]]] ]] ]]]] ]]]] ]]]] ]]]]
]]]]]]]] ]]]]] ]]] ]]]]]]] ] ]]]]]]] ]]]] ]]]] ]]]] ]]]]]
]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
]]]]]]]]]]]]]]]]]]]]]]]]]]]]] Development System
]]]]]]]]]]]]]]]]]]]]]]]]]]]]
]]]]]]]]]]]]]]]]]]]]]]]]]]] VxWorks version 5.3.1
]]]]]]]]]]]]]]]]]]]]]]]]]] KERNEL: WIND version 2.5
]]]]]]]]]]]]]]]]]]]]]]]]] Copyright Wind River Systems, Inc., 1984-1997
CPU: Tektronix HPP - PowerPC 740. Processor #0.
Memory Size: 0x2000000. BSP version 1.0.8.0 .
WDB: Ready.
usrNvFsInit: NAME=/nvram BASE=0xfd0ff100 BPB=512 BPT=8 NB=8 BO=0
nvfs: WARNING: Creating new NVRAM file system
tcsTableUnpack: checksum failed on buffer
tcsTableLoadFromNVRAM: tcsTableUnpack failed
tcsSynchronizeSensors: ERROR: Failed to create '/dev/tsAmbAcq'
tcsSynchronize: ERROR: Sensor synch failed
KERNEL: THERMAL CONTROL INITIATED
Executing startup script c:\vxBoot\dio_rst.vsh ...
dbFsIoctl: invalid code 3
cd "pc:c:/vxboot"
value = 0 = 0x0
tcsLoadTableToNVRAM "setup.tcs"
value = 0 = 0x0
#
# hopefully you get this message at the end:
# 'value = 0 = 0x0'
# REBOOT!!!
--- End code ---
Great, now PowerPC board boots (diag POST LED shows "P" after "L" which means boot image is running). Now change dio_rst.vsh script to original top-level script which was recovered from native Win98 HDD folder c:/vxBoot. I renamed topScript.hw to dio_rst.vsh to match boot settings:
--- Code: ---Executing startup script c:\vxBoot\dio_rst.vsh ...
dbFsIoctl: invalid code 3
################### topScript starts ###############################
cd "dbfs:c:/vxBoot"
value = 0 = 0x0
ld < TekScope.o
value = 23662048 = 0x1690de0
ld < TekScopeSM.o
value = 23661408 = 0x1690b60
pDbDev = ramDevCreate(0, 512, 1152, 1152, 0)
new symbol "pDbDev" added to symbol table.
... bla-bla ...
rtlStartup
value = 0 = 0x0
tsComp
value = 0 = 0x0
Done executing startup script c:\vxBoot\dio_rst.vsh
KERNEL: RUNNING TIME SLICED AT 10 TICKS PER SLICE!
->
--- End code ---
Now scope application able to run successfully, and I got first waveforms on screen :).
Also seem like this particular scope got all options enabled, but some applications required for those options are missing, as I had installed fresh OS.
So system/software spec is:
--- Code: ---CSA7404 (4GHz, optical hardware present) running Windows 2000 Pro SP4 Ru
TekScope version 2.5.3
Option 4M: 32 Meg Max 8M/Channel
Disk Drive Measurements 2 (Option 48)
Option 49
USB 2.0 Test package (Option 50)
Option 51
Option 52
Option 53
Option 54
RT-Eye Serial Compliance and Analysis
InfiniBand Compliance Module
PCI-Express Compliance Module
--- End code ---
Pretty nice set got there for use in digital/PC hardware development and debug. Scope input interface for all four channels is proprietary TekConnect, and inputs are all 50 Ohm only. So to be able use regular passive BNC probes high-impedance adapter system TCA-1MEG is required, to use 50 ohm direct interface to target environment one can use TCA-BNC or TCA-292MM or TCA-SMA. As drawbacks of high-performance capabilities of such high-speed scopes special probing accessories are required, increasing total using cost. Passive probes cannot be used without TCA-1MEG.
Already got pair of Tektronix P7380 8GHz Differential probes, which are designed for high-speed signal acquisition with special solder-on tip system. Going to buy some lower speed single-ended active probes as well later.
Using this probe is really using for debug hardware, like DDR interfaces on VGA/DIMMs/MB's:
DDR3 DIMM clock measurement
RT-Eye report:
PCI-Express 1.0 report
Next steps:
* Design and assemble few custom probes for high-impedance environment
* Installing missing options software :-DMM
Bonus:
Replace LEDs behind front panel indicators and push-buttons, just like in newer DSO/MSO series. :-/O
To be continued...
Original wiki page on my site
Thanks for reading 8)
marshallh:
Thanks for posting, neat to see it back in action.
nctnico:
Drool... A wooden casing would be neat 8)
onlooker:
Thanks, for sharing an interesting story. May I ask how much did you pay for it and from where?
free_electron:
Careful swapping that motherboard out. The motherboard uses a custom bios that allows the VXworks to become bus master and take control over the harddisk prior to boot !
Don't make the mistake of flashing a regular bios in there , it will brick the machine. I've been there and done that ! the correct bios can be found on the harddisk as well as the flash utility for it. a stock motherboard will not work. there are only two motherboards that work in this machine and the 810 is the most performant of the two. the other runs win2000....
let it be ...
The other annoyance is loosing the ram contents. it removes the serial number from the machine and disables all options.
There is a way to restore it but you need a gpib adapter and send a commmand to the machine to contact the security manager and give it the root key.
Navigation
[0] Message Index
[#] Next page
Go to full version