Tektronix TDS8000 - Backup calibration parameters and other important stuff - Page 1
Forum section: electronics / testgear

author: wevie
author_rank: Newbie
timestamp: December 19, 2024, 09:23:57 pm
content: Hi all,New to this forum (unbelievable, right?), and I’d like to thank everyone for the great info shared here already.I’m a proud new owner of a Tektronix TDS8000 scope, which I purchased as “broken” on eBay (the issue was with the display, which I’ve already fixed). While waiting for the replacement part to arrive, I’ve read through a lot of threads and noticed that many problems with these devices seem to arise due to the loss of NVRAM and CMOS contents caused by dead batteries and even the loss of CPLD contents.I count myself very lucky, as my unit doesn’t show any errors and passes compensation, etc.I want to ensure that I back up as much as I can from this device before I risk losing anything critical, like calibration constants. Here’s my plan:- Dump the hard drive contents and create a raw copy.- Dump the BIOS to preserve its current state.- Dump the CPLD contents with a Xilinx JTAG programmer I have laying around.What I’m less certain about is the proper way to back up the NVRAM contents. Could anyone advise on the best approach?- Is the NVRAM and its battery seated in a socket, so I can remove the combo from the board and read it our externally? (I have hardware for reading chips directly.)- If not, is it possible to perform an in-circuit dump of the NVRAM with the same chip-reading hardware?- I’ve noticed the VxBoot bootloader offers memory-dumping options. Would this provide a way to access and back up the NVRAM?- For the 5000 series scopes, there’s a tool called Savecal5k (https://www.eevblog.com/forum/testgear/savecal5k-calibration-backup-disk-for-tektronix-tds5000-oscilloscopes/). Does anything similar exist for the 8000 series?Any advice would be greatly appreciated. I’m more than willing to share my findings and dumps to help others maintain their scopes as well.Thanks in advance!

author: colorburst
author_rank: Regular Contributor
timestamp: December 20, 2024, 01:26:21 am
content: Congrats on your purchase! I got your private message but am posting here to support the discussion. I don't have such a behemoth to experiment on, so this is all theoretical. It's also specific to TDS8000.Before a non-invasive method is figured out, I suggest making a direct dump from the chip. This is good both as a backup (there are functions that write the nvram), but also to confirm completeness of your copy. This was my approach with TDS5000, I had a dump from the hardware to verify I'm reading the EEPROM correctly.If you have a way of calling functions, perhaps by editing bootdio.vsh after the "ld < rtlLibTarget.o" line, the following calls should print the "calibration constant containers" one by one (skip the comments, they may not parse correctly):Code:calCompAcqNvDump__Fii(0, 0) # ACQCALINFO; image offset 0x0calCompAcqNvDump__Fii(1, 0) # ACQCALCONST; 0x100calCompAcqNvDump__Fii(2, 0) # ACQ8200CALCONST; 0x10500calCompAcqNvDump__Fii(5, 0) # ACQCOMPDATAFAC; 0x500calCompAcqNvDump__Fii(6, 0) # ACQCOMPDATAUSER; 0x8500calCompAcqNvDump__Fii(9, 0) # ACQTP8200COMPDATAUSER; 0x10600Then you can assemble a complete image using those offsets. There will be holes but they *probably* don't contain anything useful, a direct dump would be handy to confirm this.Alternatively, if you can allocate a buffer and then print its contents, you can the following with nvramAddr = 0, nBytes = 0x20000 would capture the entire region:Code:int acqLibReadNVRAM(int nvramAddr, byte *buffer, uint nBytes)It appears the vsh script has access to the Windows file system via the DIO driver, so it might be possible to write the nvram contents straight to the C:\ partition with the right incantations, but I am out of my depth here.

author: calibrationfixture
author_rank: Regular Contributor
timestamp: December 21, 2024, 10:03:59 am
content: Hi to both,This discussion is also started on TekScopes. Making dumps seems rather easy. Done that for my TDS7404B. By the way I use Macrium Reflect to clone my HDD's. Highly recommended.https://www.eevblog.com/forum/testgear/tektronix-tds6000b7000b-series-nvram-dump-script/Calibrationfixture

author: colorburst
author_rank: Regular Contributor
timestamp: December 21, 2024, 04:46:22 pm
content: The TekScopes thread is worth reading. I want to point out this comment in particular:Quote from: OzanMy understanding is there are two kinds of "nvram", the Dallas block maintaining the boot config and a vxworks-local copy of the scope state, and a small I2C EEPROM holding the factory cal. The Dallas block can be rebuilt from scratch as has been documented elsewhere and is perhaps less important to back up; the cal constants are specific to your acq HW.I was kindly pointed to some topScript-based dumping methods developed by flyte and WORP3, and it appears they both only get a copy of the Dallas NVRAM. However, they provide an excellent starting point for capturing the factory cal EEPROM as well. Ozan's method fits TDS7000, for TDS8000 I'd adapt it as follows (untested, try at your own risk):Code:tempBuf=malloc(0x20000)acqLibReadNVRAM(0,tempBuf,0x20000)fdescriptor=open("c:/eepromdump.bin",0x0202,0777)bytesWritten=write(fdescriptor,tempBuf,0x20000)close(fdescriptor)

author: coromonadalix
author_rank: Super Contributor
timestamp: December 21, 2024, 06:19:57 pm
content: normally on many tek pc based scopes, backing some drive folders helped a lot, and theses scripts to dump the famous dying nvram helped a lotcloning the drive when possible is the perfect solution, more would be : to see the vxwork boot process (when power pc equipped) or read it and take notes of the settings / names etc ...i had a crashed nvram on one, with an acq eeprom error, and a full re install on another, it took a long time to understand all of this lolldo it when you can, the best answer you can get ... or give you

author: wevie
author_rank: Newbie
timestamp: December 22, 2024, 12:47:11 am
content: Thanks all!! Your info is really helpful already!I expect an Amazon delivery tomorrow, including a mini-IDE to USB converter, as I didn't have one laying around anymore.Getting the HDD backed up is the first goal now.I'll keep you all posted.

author: wevie
author_rank: Newbie
timestamp: December 22, 2024, 01:28:56 pm
content: Okay, HDD was dumped correctly.I already loaded some of the object-files in Ghidra, we are very lucky all debug symbol are still inThis means that with a normal boot-trace of the PPC it shouldn't be too hard to follow what is going on and at what locations data is actually read.

author: wevie
author_rank: Newbie
timestamp: December 23, 2024, 12:10:39 pm
content: With your instructions I was able to dump the calibration constants !I will try to update the dumper scripts already available to support the TDS8000; but for now I'm really happy !

author: wevie
author_rank: Newbie
timestamp: December 23, 2024, 05:18:25 pm
content: Steps I did on my TDS8000, I hope it might be useful to somebody in the future:Code:#PPC BoardnvrBase=0xfd0e0000nvrSize=0x20000tempBuf=malloc(nvrSize)memcpy(tempBuf,nvrBase,nvrSize)fdescriptor=open("dbfs:c:/tds8000_ppc_nvramdump_full.bin",0x0202,0777)bytesWritten=write(fdescriptor,tempBuf,nvrSize)close(fdescriptor)#ACQ BoardnvrSize=0x20000acqLibReadNVRAM(0,tempBuf,nvrSize)fdescriptor=open("dbfs:c:/tds8000_acq_nvramdump_full.bin",0x0202,0777)bytesWritten=write(fdescriptor,tempBuf,nvrSize)close(fdescriptor)Happy I was able to store the calibration constants on my device, thanks again

author: charlyd
author_rank: Frequent Contributor
timestamp: January 12, 2025, 10:15:53 pm
content: Hi did you manage to export the eeprom. i worked on it with worp3 in those days hé s a friend of mine.but i am curious to the content of the eeprom

author: fdavalos1
author_rank: Newbie
timestamp: March 25, 2025, 11:04:56 pm
content: Could someone share with me their ppc_nvramdump ?I have a TDS7104 with a non-working console port so I'm unable to reset the boot values.

author: wevie
author_rank: Newbie
timestamp: July 27, 2025, 05:32:06 pm
content: I have just stored the dumps from my TDS8000 on xdevs. For those attempting a repair on their unit: I really hope these files are useful!