Tektronix TDS3012B repair help needed - Page 1
Forum section: electronics / repair

author: cpuchip
author_rank: Contributor
timestamp: November 17, 2020, 02:15:47 am
content: So, I have this old scope that I inherited from my dad, I know it's way out of support, but I don't want the thing to go to a land field. Please help!The device was working last month, and then it locked up on me while measuring a 3 MHz signal and rebooted, now it's stuck on the "scope man" boot screen, when the scope works fine I hear relays that trigger on boot, and then click off?? But that no longer happens.I have since taken the thing apart following the posted service manual to check if the Power Supply is bad, it’s not, it has the 15v supply across pins 1 and 6 to the battery board. I’ve also successfully powered the scope (to the frozen boot screen) using an external 12v supply to the battery terminals on the back. This is an old scope ( going on 20 years? ) I read several forms that the boot issue could be bad NVRam battery in the RTC that corrupts the ethernet settings enough to prevent the scope from booting. So I ordered a replacement remanufactured dallas ds1742w NVRam and swapped it in. I’ve tried holding down b-trig on boot to “clear” the NVRam, but it’s still stuck on the “scope man” boot screen.I’ve gotten it to boot once, but then it locked up when the relays click again.I have tested with another oscilloscope ( the venerable TBS1052B since that’s what a neighbor had that I could borrow) and have verified that the two crystals on top of the main board (48MHz and 75.757575Mhz both ring true to their markings ) I noticed on the forms that that is another failure point is the 75MHz crystal goes bad.I’ve noticed several test points on the main board and was wondering if I could get documentation on what they are so that I can probe them, or if there is a diagnostic Serial port on the board I can tap into to see if there is an error message being outputted. I’ve noticed that on TP7 I get a 25.252525Mhz signal, TP8 give a bit stream of sorts for a few seconds on startup and then quiets down sometimes, or has a repeating pattern other timesTP2 and TP3 has a digital signal out for a blip on startup then remains static. TP4 has a voltage of 3.09v which I think corresponds to max708s power line watch dog chip.I’m starting to think the flash chips U610/U620 may have been corrupted?Thanks for any trouble shooting help so I can get this scope back up and running.Useful info:Main board schematic, Test point definitions, serial/debug/j-tag pin locations.I've followed along these threads for trouble shooting help, but they didn't solve my issueshttps://www.eevblog.com/forum/repair/tds3014-adventures-(seeking-75-75mhz-oscillator)/Replaced Dallas 1742w with this ebay part:https://www.ebay.com/itm/Tektronix-TDS3000-TDS3000B-exact-functional-replacement-for-DS1742W/293776182478?hash=item44666cccce:g:U~gAAOSwjfBfgfa1

author: james_s
author_rank: Super Contributor
timestamp: November 17, 2020, 06:29:32 am
content: The TDS3000 series are fantastic instruments and still quite desirable and valuable, even a dead parts unit will usually fetch a few hundred bucks. Unfortunately the big problem with these is that documentation is virtually nonexistent. Tek never released any sort of schematics and the service manual is a joke. If there's a debug console somewhere like the older TDS scopes have I'd love to know, I have a parts unit that is stuck in a reboot loop, I bought it for the cosmetic parts since I had a working scope that had become so brittle that it was falling to pieces. I'd love to figure out what's wrong with it though since I've heard of others with the same problem. I was thinking about replacing the RAM and seeing if that resolved it. Bad flash is another possibility, these are right about at the age where flash is approaching the minimum spec'd data retention.

author: Shiv
author_rank: Regular Contributor
timestamp: November 17, 2020, 10:40:31 am
content: May be a dumb answer, but did you tried to update it?I don´t remember if updating it will boot from disk or loading other "things"...

author: sicco
author_rank: Regular Contributor
timestamp: November 17, 2020, 12:58:09 pm
content: I found something of a backdoor serial port to the TDS3000 main board. The 100 pin connector has pins 13 and 14, tied to the PowerPC CPU SMRXD1 and SMTXD1. See picture how I wired it up on a plug-in module to a FTDI FT232-TTL unit. Could have soldered on the mainboard just as well. These appear TTL level serial at 38400,n,8,1. When booting up, it spits out this without asking. Also when there is no DS1742W fitted (which also prevents a full normal boot up).sysClkRateSet using 25 MHzexcInit calledAnd then nothing. After that it echoes every character that I typed in. In an intelligent way, like adding a ^ for control characters.Except when bombarding it with ESC, CR, or any other letter while it boots - then it no longer echoes at all. But the scope works.One character does respond differently: CTRL-X. Then it saysCalling romInitWhich was scary as I feared it would now erase my ROMs - but it didn't. Well, not yet, I opted to power off immediately and then back on, and all was still alive. Maybe this was a Dallas serial rom init procudure - google hints.So it is something VxWorks as google drives me to VxWorks when searching on what it says.Must have something secret to make it work like a true VxWorks console - if anyone knows the magic keystrokes to get there then let me know please!

author: cpuchip
author_rank: Contributor
timestamp: November 17, 2020, 07:13:06 pm
content: Wow Sicco! That's exactly what I wanted to know. I don't have a com board to put in so I'll have to tie off of the main connector directly on the main board. I'll try that later today when I have the scope uppin 13 is PPC RX and pin 14 is PPC TX?Shiv I did updated it last year to 3.41 because it was acting unstable then, crashing after triggering on a wave form, and that seemed to help but (crash less often after update), but it would still crash every now and again, but would recover each time, until last month. The crashing while triggering on a wave form before and less after is what is making me think it's a firmware corruption problemJames I've thought about parting it out after a few months if I can fix it. Since the rest of the scope is in fantastic shape. I didn't check before I lost the contents of the NVRam but I'm sure the thing has less then 1000 hours on it.

author: james_s
author_rank: Super Contributor
timestamp: November 17, 2020, 08:32:53 pm
content: Be very careful, the expansion connector is wired directly to the CPU and is not buffered, it is not likely to be forgiving to wiring errors or ESD. It is deeply recessed into the back of the scope and not intended to be touched by anything other than approved expansion modules. Buy the correct connector, somebody identified it in one of the other threads.I think I will try replacing the DRAM chips on my dead board, I can do that with minimal risk to anything else but of course they are obsolete so I'll have to find a source. I did find a cross reference somewhere and I saw some ebay sellers with SIMMs containing one of the supposedly compatible chips so that is an option. I have a nifty old DRAM tester so I could solder the original chips back on the SIMM board and test them even. If that doesn't work then the next thing to try is pull the flash chips and get a test adapter for my TL866. The issue though is getting a known good image of the contents to compare with, I don't know if anyone has figured out how to get that from the firmware disk images. I'm pretty good with a hot air station but given the value of these instruments I'm very hesitant to mess with the ROMs on a working one. Perhaps we could find someone who has one with a blown up front end that still boots and extract the ROM from that.

author: YetAnotherTechie
author_rank: Regular Contributor
timestamp: November 17, 2020, 08:42:15 pm
content: I have a dump of the 2 roms somewhere, but it contains the serial number...

author: james_s
author_rank: Super Contributor
timestamp: November 17, 2020, 08:56:44 pm
content: Quote from: YetAnotherTechie on November 17, 2020, 08:42:15 pmI don't see that as a big issue, it would still be sufficient for troubleshooting purposes and it's possible that the serial number could be altered fairly easily. These scopes are all discontinued, out of production and out of support, the serial number is all but irrelevant. Few are going to care if the serial number in ROM doesn't match what is on the back of the scope if their dead scope is revived.

author: sicco
author_rank: Regular Contributor
timestamp: November 17, 2020, 09:11:17 pm
content: YetAnotherTechie - would you also by any chance have a dump for the ROM inside a TDS3EM Ethernet module?cpuchip - on what was TTL Tx and Rx, 13 or 14, i’d think the scope transmits on its pin 14, receives on its pin 13.The way it was in the snapshot that i added, it worked. FTDI 6 pin header connector wire color coding athttps://www.ftdichip.com/Support/Documents/DataSheets/Cables/DS_TTL-232R_CABLES.pdfpage 11, 12.Don’t forget a ground wire as well.

author: mankan
author_rank: Regular Contributor
timestamp: November 17, 2020, 09:18:32 pm
content: I used this connectorhttps://www.digikey.com/en/products/detail/te-connectivity-amp-connectors/1-1734099-0/1121334to for the expansion port.

author: YetAnotherTechie
author_rank: Regular Contributor
timestamp: November 17, 2020, 10:35:39 pm
content: Quote from: sicco on November 17, 2020, 09:11:17 pmSorry i don't have any modules, and it's B version, so ethernet is build in, i don't remember seeing a diferent flash chip for it...

author: Shiv
author_rank: Regular Contributor
timestamp: November 18, 2020, 07:53:01 am
content: Quote from: cpuchip on November 17, 2020, 07:13:06 pmI´m saying you maybe could do it again.If you are lucky, the first boot section is ok and it could be upgraded to write on a new firmware and rip the corruption.It´s just a try

author: sicco
author_rank: Regular Contributor
timestamp: November 18, 2020, 03:00:10 pm
content: YetAnotherTechie: If the ROM hex image is for TDS3012b then I’d suspect it contains the code that the TDS3012 not-b would otherwise get from the ROM on the Ethernet module TDS3EM. So I’d like to check that out.Other experts: would a firmware upgrade/downgrade with the 5 floppy disks also reflash the Ethernet code on the TDS3012b, and therefore also on the TDS3012 TDS3EM if that was the hardware in place inside a TDS3012?I’m speculating here that the newer TDS3012b went to double size flash ROM chips, and therefore could embed the TDS3EM ethernet code on their mainboard by just adding PHY chip. And that in the TDS3012, the code space above its flash ROMs was mapped to /CE1 or /CE2 in the memory map, so that it could physically reside on a plugin module. Maybe?

author: cpuchip
author_rank: Contributor
timestamp: November 18, 2020, 10:07:37 pm
content: Quote from: mankan on November 17, 2020, 09:18:32 pmThanks Mankan I'll get one on order, one day I might even design a board if I ever get this scope up and running.Quote from: sicco on November 17, 2020, 09:11:17 pmThanks I'll try this when my port header comes in!Quote from: Shiv on November 18, 2020, 07:53:01 amI'll try that next, but last I remember when I had the floppy drive installed it was not showing any signs of life, like seeking or such. I've pulled down somewhere else on this form the 3.39 firmware version that I can put to some floppies, I was fortunate enough to get a stash from all of my neighbors last time I upgraded the firmware on this scope.

author: YetAnotherTechie
author_rank: Regular Contributor
timestamp: November 18, 2020, 11:53:01 pm
content: Hope it helps

author: james_s
author_rank: Super Contributor
timestamp: November 19, 2020, 12:35:05 am
content: The dead one I have shows the splash screen for several seconds, then it flashes briefly and continues to do this. I believe what is happening is the boot process is starting then something fails and it reboots and just keeps doing this over and over. Since I don't have a console showing the boot process I have no idea what is actually happening, it never tries reading the floppy or shows any error messages. In searching for information all I've found is a few other people with the same problem and no solution. I think if we can narrow this down it's likely to be the same problem happening in many of these.

author: cpuchip
author_rank: Contributor
timestamp: November 19, 2020, 12:58:14 am
content: Quote from: YetAnotherTechie on November 18, 2020, 11:53:01 pmHey! how did you get this dump? I have a TL866II+ but the AM29LV160DB-90EC (16 Megabit ( 2 M X 8-bit/1 M X 16-bit ) CMOS 3.0 Volt-only Boot Sector Flash Memory) aren't on the list. And thank you!!! It'll be fun just parsing through the hex! So thank you very much.Quote from: james_s on November 19, 2020, 12:35:05 amI think so too. I've reached out to TEKtronics and haven't gotten anything back from them. They did a few nice things when they retired this scope, but honestly I feel like companies should practically open source their old defunct products so as to reduce e-waste. It's a shame that we cannot easily fix these scopes!

author: YetAnotherTechie
author_rank: Regular Contributor
timestamp: November 19, 2020, 01:26:14 am
content: Quote from: cpuchip on November 19, 2020, 12:58:14 amsame programmer, i used AM29LV160BB to readMaybe you could try to modify the dump program that's around here for the tds3xx series so it works with 3000, removing the chips to find differences is not very safe or productive, because the scope writes a log of the scpi commands and errors, so a lot of the dump changes.

author: cpuchip
author_rank: Contributor
timestamp: November 19, 2020, 04:09:11 am
content: Do you think this would be an okay substitute?https://www.digikey.com/en/products/detail/macronix/MX29LV160DBTI-70G/2744817What adapter did you use? because that's a 48 pin part, and the TL866II+ is a 40 pin dip.Never mind, i see I need the tsop48 sn001 adapter board.

author: shakalnokturn
author_rank: Super Contributor
timestamp: November 19, 2020, 04:23:03 am
content: If this is of any help... Sending "i" (LF/CR) to VxWorks over the serial debug port should prompt it to return the active processes.Attached a list of the VxWorks symbols for a TDS 420, I expect a fair deal should be common.I also seem to remember reading somewhere on here that some TDS scopes (TDS 210/220) would output early boot diagnostic information in form of different frequencies on the probe compensation no idea if that applies to the TDS 3012.

author: sicco
author_rank: Regular Contributor
timestamp: November 19, 2020, 04:28:18 pm
content: Sending "i" did nothing on my TDS3054.All I'm getting after a reboot is still just this on that first TXD1, RXD1 TTL pins 13,14 serial engineering/debug(?) port at 38400,n,8,1. This is from when booting up 4 times in a row:osysClkRateSet using 25 MHzexcInit calledsysClkRateSet using 25 MHzexcInit calledsysClkRateSet using 25 MHzexcInit calledsysClkRateSet using 25 MHzexcInit calledCTRL-X is the only 'command' that makes it do something else then just echoing what I type in. It has Xon/Xoff protocol rules active it seems.CTRL-X gives this. And leads to just a reboot.cacheDisable (0);Calling romInitHad that in v3.39, and it's the same in firmware version 3.41.So no real progress today yet I'm afraid.Well, did get an order in with JLCPCB for another 10 of the DS1744W rear expansion port adapter boards, now with flash ROM for Ethernet, for which I don't have HEX code yet. But I'm betting that the firmware floppies have it. My hope stems from the fact that when upgrading, it sort of skips the bulk of the first two floppies in my TDS3054 that has no Ethernet and no TDS3EM. So maybe those first two disk have the Ethernet ROM image. Maybe...But if anyone has the ROM hex image for the TDS3012-b, any TDS30xx-b, or -c, or for the TDS3EM module, then please can I you share?From the firmware floppies, .DAT file sizes  are:3.39 3.41Disk1 513 513Disk2 145 145Disk2a 234 234Disk3 1421 1421Disk4 785 789Total 3098 3102But that might be compressed - so not sure really what this means and how much is boot ROM that never gets updated - maybe...

author: shakalnokturn
author_rank: Super Contributor
timestamp: November 19, 2020, 05:22:00 pm
content: It would be good to have the boot log from a working scope to compare.It looks like either corrupt firmware, or basic hardware fault.Extract from the VxWorks BSP developer's guide:2.2.4 Detailed Boot SequenceThe following is a step-by-step description of a generic boot sequence.Step 1: Execute romInit( )At power-up (cold start), the processor begins execution at the romInit( ) entrypoint, located in romInit.s. For resets (warm starts), the processor begins executionat romInit( ) plus a small offset (see sysToMonitor( ) in target/config/sysLib.c).The romInit( ) routine must be written in assembly language.The purpose of this routine is to initialize the CPU and some portion of memory. Itdoes the absolute minimum amount of initialization—that is, the initialization ofessential hardware only—before jumping to romStart( ). If romInit( ) is workingcorrectly, the memory from LOCAL_MEM_LOCAL_ADRS through(LOCAL_MEM_LOCAL_ADRS + LOCAL_MEM_SIZE) should be readable andwritable. If this is not the case, romInit( ) is not working properly.In addition to initializing memory as described above, the romInit( ) routine mustalso disable interrupts and clear caches. romInit( ) then configures the boot type(cold or warm) to be a subroutine argument and branches to romStart( ) inbootInit.c. For more information on configuring the boot type, see 2.3.7 HardwareConsiderations, p.42.romInit( ) must do only as much device setup as is required to start executing Ccode. Hardware initialization is the responsibility of the sysHwInit( ) routine intarget/config/sysLib.c, which is called later during the boot sequence.________Extract from VxWorks architecture supplement (WRT PPC/MPC processors):In a standard VxWorks image, excVecInit( ) and excInit( ) install the defaultexception and interrupt handlers, along with the stub for the entry and exit code,by calling the connect routines described previously._________An interesting detail from:https://www.ee.ryerson.ca/~courses/ee8205/Data-Sheets/Tornado-VxWorks/vxworks/ref/excLib.html"Exceptions or uninitialized interrupts that occur after the vectors have been initialized by excVecInit( ), but before excInit( ) is called, cause a trap to the ROM monitor."

author: sicco
author_rank: Regular Contributor
timestamp: November 19, 2020, 10:45:06 pm
content: The scope that I was playing with is a working one - it's cpuchip who started this thread who has a failed one.It's just that I don't know yet how to exploit its backdoor - how the get anything more than just CTRL-X being romInit()...It feels like we're getting close to really opening up the debug/monitoring port. But there is a hurdle still to take.Just found the TDS3012b ROM images shared by YetAnotherTechie, pasted the two 16 bits wide files into one 32 bit file, and then see interesting text in the lower part of the code. Clearly looks like messages for detailed self tests, with pass/fail strings that would end up somewhere. But where is that somewhere, how to read / log / print that??000000: 00000006 fffebbdc fffeea4c fffea074 fffe0040 ffff4420 ffff92e4 dcc50a57 ...........L...t...@..D .......W000020: ffc00100 00002114 9da76212 00000000 ffc40000 001dbdbd 64a3bb00 00000001 ......!...b.............d.......000040: ffc3ec58 00001004 9366a332 00000000 ffc04000 0003ac54 674b8add 00000001 ...X.....f.2......@....TgK......000060: ffe1bdd0 00047724 00000000 00000000 ffffffff ffffffff ffffffff ffffffff ......w$........................000080: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ................................0000a0: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ................................0000c0: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ................................0000e0: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ................................000100: 3cc0ffc0 38c60128 3ce0ffc0 38e70100 3d00ffc0 39080100 7cc73050 7cc64214 <...8..(<...8...=...9...|.0P|.B.000120: 7cc803a6 4e800020 48000055 48000059 436f7079 72696768 74203139 39372054 |...N.. H..UH..YCopyright 1997 T000140: 656b7472 6f6e6978 2c20496e 632e436f 70797269 67687420 31393834 2d313939 ektronix, Inc.Copyright 1984-199000160: 35205769 6e642052 69766572 20537973 74656d73 2c20496e 632e0000 38a00002 5 Wind River Systems, Inc...8...000180: 48000009 7c651b78 4800000d 480008d0 48000000 3c600000 60631002 7c600124 H...|e.xH...H...H...<`..`c..|`.$0001a0: 7c7b03a6 38000000 7c788aa6 60680000 3c600400 7c788ba6 3c80ff00 60840000 |{..8...|x..`h..<`..|x..<...`...0001c0: 7c9e9ba6 3c60ffff 6063ff88 90640004 3c600000 60630000 3ca00001 60a50000 |...<`..`c...d..<`..`c..<...`...0001e0: 90a40ab8 90640abc b0640964 b0640960 b0640962 b0640970 90640ac4 3c600000 .....d...d.d.d.`.d.b.d.p.d..<`.....001f20: afdd0c3a 5f3aafbd 7fbdb082 5f8247f8 3e303430 34343737 abf7bf9b 994b4fbd ...:_:....._.G.>0404477.....KO.001f40: bd599493 349fff37 fb9b177d d9936956 bbfdd697 bdd2fd11 31db9bb3 63139637 .Y..4..7...}..iV........1...c..7001f60: 93733693 193137f7 331737af 7bb9b999 bb197957 7fdfd3d5 73b773f7 37933b99 .s6..17.3.7.{.....yW...s.s.7.;.001f80: 1d115316 99315315 31694bf4 fbdbd359 31497353 76956d69 7b9d9693 13131979 ..S..1S.1iK....Y1IsSv.mi{......y001fa0: 79376935 426f6f74 20666c61 73682063 6865636b 73756d20 4f4b0a0d 002a2a2a y7i5Boot flash checksum OK...***001fc0: 426f6f74 20666c61 73682063 6865636b 73756d20 4641494c 45442a2a 2a0a0d00 Boot flash checksum FAILED***...001fe0: 436f6465 20666c61 73682063 6865636b 73756d20 4f4b0a0d 002a2a2a 436f6465 Code flash checksum OK...***Code002000: 20666c61 73682063 6865636b 73756d20 4641494c 45442a2a 2a0a0d00 20627974 flash checksum FAILED***... byt002020: 6573206f 66205241 4d20666f 756e640a 0d003078 00202a2a 2a200020 2a2a2a20 es of RAM found...0x. *** . ***002040: 4d616368 696e6520 43686563 6b206475 72696e67 206c696e 65206368 65636b20 Machine Check during line check002060: 61742000 202a2a2a 20416464 72657373 2f446174 61206c69 6e652046 41494c45 at . *** Address/Data line FAILE002080: 44206174 20004452 414d2061 64647265 7373206c 696e6520 63686563 6b204f4b D at .DRAM address line check OK0020a0: 0a0d0044 52414d20 64617461 206c696e 65206368 65636b20 4f4b0a0d 004e5652 ...DRAM data line check OK...NVR0020c0: 414d2061 64647265 7373206c 696e6520 63686563 6b204f4b 0a0d004e 5652414d AM address line check OK...NVRAM0020e0: 20646174 61206c69 6e652063 6865636b 204f4b0a 0d005442 43204143 51205352 data line check OK...TBC ACQ SR002100: 414d2061 64647265 7373206c 696e6520 63686563 6b204f4b 0a0d0054 42432041 AM address line check OK...TBC A002120: 43512053 52414d20 64617461 206c696e 65206368 65636b20 4f4b0a0d 00544243 CQ SRAM data line check OK...TBC002140: 20446973 706c6179 20535241 4d206164 64726573 73206c69 6e652063 6865636b Display SRAM address line check002160: 204f4b0a 0d005442 43204469 73706c61 79205352 414d2064 61746120 6c696e65 OK...TBC Display SRAM data line002180: 20636865 636b204f 4b0a0d00 53757065 72492f4f 20494420 00200a0d 004c6f61 check OK...SuperI/O ID . ...Loa0021a0: 64696e67 20496d61 67650a0d 00556e63 6f6d7072 65737369 6e672063 6f646520 ding Image...Uncompressing code0021c0: 66726f6d 20002073 697a6520 00206578 70656374 65642000 20616374 75616c20 from . size . expected . actual0021e0: 00206174 74656d70 74696e67 20636f64 65207265 636f7665 72790a0d 00537461 . attempting code recovery...Sta002200: 7274696e 6720426f 6f742043 6f646520 61742000 ffffffff ffffffff ffffffff rting Boot Code at .............002220: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ....................................So close...

author: cpuchip
author_rank: Contributor
timestamp: November 20, 2020, 12:29:02 am
content: I've just tried downgrading my firmware from 3.41 to 3.39 and I got no life out of the floppy disk drive. Still trying other things! I want to check the console output next.Thanks for all of your Reponses guys! I starting to feel like I'm understanding this scope a bit. I wish the TEKtronics over lord would bless us with a schematic or repo to play in. but that's wishful thinking.

author: cpuchip
author_rank: Contributor
timestamp: November 20, 2020, 01:18:32 am
content: OKAY I was adventurous..... I figured I had a dead scope anyway and desided to solder right to the mainboard pins 13 (scope TX) / 14(scope RX) and 1 (gnd) for a serial consol this is my outputQuoteSo.. heh. CTRL-X didn't seem to do anything and mine wasn't echoing but I'm still playing with it. maybe I don't have a good connection on rx

author: james_s
author_rank: Super Contributor
timestamp: November 20, 2020, 01:50:14 am
content: Well that suggests that the ROM is ok since it says the checksum is good but I'm not sure how it checks that. I also have no idea how thorough the RAM check is, it may only do just enough to determine that all of the address and data lines are working and not necessarily test the entire range of memory.

author: cpuchip
author_rank: Contributor
timestamp: November 20, 2020, 05:14:23 am
content: Quote from: james_s on November 20, 2020, 01:50:14 amWell I pulled the NVRam module out and it still registered it as check OK on both address and data lines. so... I think it might be looking for shorts there? as appose to actually having a chip to talk to.I still haven't gotten it to respond to any input from serial. I'll have to verify my connection.. and I really need to order that connector.... I just got super impatient. I really want this darn thing to work!

author: james_s
author_rank: Super Contributor
timestamp: November 20, 2020, 05:22:12 am
content: Yeah that really doesn't give me a great deal of confidence in the usefulness of the self tests.Sure would be nice if the boot ROM was socketed, that might make it feasible to develop a diagnostic ROM, some have been made for various vintage computers that will boot even with minimally functional hardware.

author: sicco
author_rank: Regular Contributor
timestamp: November 20, 2020, 09:57:58 am
content: Well, i see progress. Strange that my unit, not a -b version but older, only gives the last two lines instead of the whole lot that Mr. cpuchip gets.The UUUUU at the beginning - possibly to assist auto baudrate?On the main board roms and no socket: as with the DS1742, many pins are also wired to the 100 pin expansion connector, the first rom all relevant pins except /CS, the second ROM all but D0-15, /CS, and /WE I think. The XPC860 in reset state makes it release the bus, so via an adapter in the expansion port and a few more patch wires, it’s maybe possible to read and/or reprogram the two AM29LV160 ROMs?Before going there, let’s probe a bit deeper and see if the VxWorks monitor/debug backdoor cannot be unlocked any wider. Maybe there’s an Ethernet backdoor option also?

author: sicco
author_rank: Regular Contributor
timestamp: November 20, 2020, 12:43:29 pm
content: Aha - there is another huge backdoor potentially! Studied the XPC860 datasheet, it has JTAG, BSD, and guess what, the 100 pin connector has 3 pins that connect to the XPC860 JTAG pins.SRESET = 65TCK = 64 (H16 of XPC860)TDI = 63 (H17 of XPC860)TDO = 62 (G17 of XPC860)But then pin 61 I found at IRQ6, G3 of the XPC860. Maybe that's hard wired also to TMS, G18 of XPC860.https://www.nxp.com/docs/en/reference-manual/MPC860UM.pdf, chapter Part VIII, System Debugging and Testing Support.Quoting: "...dedicated user-accessible test access port (TAP), which is fully compatible with the IEEE 1149.1 Standard Test AccessPort and Boundary Scan Architectur..."So that's how they program the flash roms in factory quite likely.So, a JTAG adapter that ties into the 100 pins connector as per the above, and then...But I don't have a JTAG probe or a JTAG / BSD / IEEE 1149.1 PC environment at hand... Are those just the 5-20$ USB modules listed on eBay when searching for JTAG? And then what software to support it?

author: cpuchip
author_rank: Contributor
timestamp: November 20, 2020, 04:42:42 pm
content: I don't have a JTAG probe either, though it sounds like you can take a generic stm32 dev board and flash a jtag opensource firmware too it. I was thinking of picking up this little guy:https://www.amazon.com/gp/product/B07ZK4LFTQ/ref=crt_ewc_title_dp_1?ie=UTF8&psc=1&smid=A28U2Z9L46X7LPOkay sicco, how are you figuring out which pins on the XPC860 connect to the 100 pin expansion port?! I'm super impressed.In a short few days I'd have to say this is the most informative TDS30xyz thread on here. Thank you so much for sticking with it I'm actually hopeful about reviving our scopes.

author: sicco
author_rank: Regular Contributor
timestamp: November 20, 2020, 07:41:22 pm
content: On how i figured out the pins - long story, but since you asked.... pmercier on forum elsewhere did the first 50+ pins, and I wanted to get a TDS3GM module for my TDS3034. Working as hobby project on a new plugin module that has a DS1744 for DS1742 replacement. Then I noticed on eBay the Israeli trader that had lots of ‘for spares’ ‘slightly’ damaged TDS3012, 3014, 3034, 3054 units for 200-600 EUR each. Dozens. Some with adapter boards in them. So I took a chance. And got a good TDS3EM module for 300 EUR. And a not working TDS3012 that came with it. I now know what de-militarized means. Thats what this lot from Israel is. Purposely damaged, axed, but also electrically demolished inside from the outside as I now know. Because others just like me (see post from madeo, Germany) suddenly needed a replacement TDS3012 front panel, because the NEC 78011 microcontroller on it that also does the 1 kHz probe calibration front panel signal, and all keys and knobs and leds, is dead. Dead I think because the demilitarizing basterds from Israel must have put AC mains or worse on that probe cal 1 kHz TTL clipon pad. In my case, also the mainboard must have died from that surge shock. Because swapping front panel with my good TDS3034 did not fix it. Except for no front panel, the Israeli scope seemed to worked ok though (gave good traces after providing external trigger signal by touching 50 Hz into its BNC EXTTRIG input, and a good single ch1 trace after fitting a blank DS1742.). So started to dig into how overvoltage into front panel pcb could damage also the mainboard. The I2C and other traces ended in 74LC86 that still looked good, and under the XPC860 BGA. I have an infrared rework station.... And guts. No guts no glory. eBay had XPC860 for 20 EUR from Poland. Never did BGA357, but decided it was time to go for it. Got the old XPC off ok. Sort of. But no joy yet getting a new one back in place. 357 pins is a lot. So that’s how i got the opportunity to beep from the BGA pins to the 100 pins connector.

author: cpuchip
author_rank: Contributor
timestamp: November 21, 2020, 01:51:37 am
content: wow Thank you for going through all that trouble to get the pin out on that TE header sicco. I've gone ahead and order my TE connectors and that JEFF probe jtag prob.but today my scope is acting differing. I here a single relay click in and then out and now I have the 1KHz calibration port working the scope.Interestingly enough when I boot the scope powering from the battery bay it draws 12v 1.28a 15w. but when the one relay (I only here one I think, I don't hear two) it jumps to drawing 20w 1.74a 12v. Interesting indeed.also I am using PlatformIO's serial monitor this time and the scope is echoing what I type on the serial console and ctr-x does somethingQuotebefore I was using putty.

author: cpuchip
author_rank: Contributor
timestamp: November 21, 2020, 03:41:09 am
content: So... I have the TDS3012B scopewhen I have the ethernet ribbon cable de-attached to J910 I get what you got sicco on the serial portQuoteBut if I attach the the J910 Ethernet ribbon cable from the battery board to the main board I get this serial output, but my serial isn't echoedQuoteDo I have a bad battery board?

author: Jwalling
author_rank: Unknown
timestamp: November 21, 2020, 12:28:08 pm
content: Here a couple of console outputs. One from a working scope, one not.TDS3054B unknown firmware version, hangs at splash screen, no relays click, no floppy access:QuoteTDS3054B Firmware 3.41 (working OK) Unit has TDS3GV module installed.QuoteSAME working unit, running full self test from utility menu:QuoteSPC produces no output.Interesting to note that if I remove the dallas chip, there is no change to the console output on the bad unit.It still says:QuoteMust not be much of a test...

author: cpuchip
author_rank: Contributor
timestamp: November 23, 2020, 02:05:06 am
content: Quote from: Jwalling on November 21, 2020, 12:28:08 pmHave you tried pulling the J910 ethernet ribbon cable like I did and get a different result on the serial debug console?Quote from: Jwalling on November 21, 2020, 12:28:08 pmI'm guessing it's not either. Though I'm tempted to short like A0 and A1 together to see if it fails that test...? is that a stupid idea?All of this Jwalling is super helpful to see what a normal scope looks like on it's output! I really appreciate it.Is there a github project that's compiled some of this information? has someone started a KiCad or easyEDA project on a home brew TDS adapter board. My skills are not great yet, but I'm up for trying to create a debug board with a beefy STM32 processor that connects to ALL of the io lines available on the 100 pin TE connector. Has this been done before? If I can get my scope working it'd be fun to take it farther and make a useful board that has wifi (maybe an esp32, like a project I saw on another thread here)Either way I feel like truly understanding what going on here is going to take quite a bit of input data from that connector board.

author: james_s
author_rank: Super Contributor
timestamp: November 23, 2020, 02:14:50 am
content: Don't try shorting anything together. Those address lines are driven directly by the CPU, some chips can tolerate shorted outputs but it's not guaranteed and if you blow out one of the address lines on the CPU it's game over. What would you expect to learn by doing that anyway? We already know the self test is not very useful.

author: cpuchip
author_rank: Contributor
timestamp: November 23, 2020, 05:21:57 am
content: You're right, I'm just trying to think of ways to validate that it's actually doing something.

author: james_s
author_rank: Super Contributor
timestamp: November 23, 2020, 05:30:09 am
content: You could put a logic analyzer on it and see what it's doing. I might try that at some point, I just have too many projects to go down that rabbit hole right now.

author: Jwalling
author_rank: Unknown
timestamp: November 23, 2020, 09:56:59 am
content: Quote from: cpuchip on November 23, 2020, 02:05:06 amI have not, but I could. Which scope would you like me to try this on?

author: sicco
author_rank: Regular Contributor
timestamp: November 23, 2020, 01:17:06 pm
content: I'm diving into JTAG basics right now. Never did that before, but now that I've retired from oil and gas, it's about time I did, and sharpen up my 30 years of aged electronics hardware skills. Just started KiCAD two months ago... The plug-in board that I'm progressing is now at rev 4, it now got JTAG 10 pins header ports and I think I can even do a JTAG USB adapter with the FT232R chip that I had in it already for the serial port over USB. IF all goes well, then with this board plugged in, we can read and write any pin on the XPC860 CPU on the main board, and also read, erase, write the full flash ROMs (so including the boot loader that a firmware update by floppies does not I think).To keep james_s from shooting: it has isolated JTAG, so we're unlikley going to damage hardware. But yes, once we erase the ROMs and fail to reprogram, yes, then of course...Seeon what we'd possibly open up if this JTAG backdoor with a JTAG connector, possibly with the USB-JTAG dongle on the same Tektronix TDS3000 rearside panel plug-in board already!Still looking for the JTAG BSDL file for the MCP860. Used to be a download from Freescale according to the MPC860UM manual. It states "45.7 Freescale MPC860 BSDL DescriptionThe most current revision of the BSDL file for the MPC860 PowerQUICC is available at the Freescale web site (www.freescale.com)." But that was 20 years ago... Have asked on he NXP community forum, but no replies yet. Anyone has that BSDL file maybe?Have put my hopes onhttp://www.topjtag.com/.1 of my 20 'for free' trial days has lapsed... Would be great if that works (then no need to push/pull 100 pins connector pins from yet another STM32 or so, because the XPC860 will do that over JTAG? Is OpenOCD a better shot? What about Intellitech? Did order a "Altera Mini Usb Blaster avec Câble pour CPLD FPGA NIOS JTAG Altera Programmeur" as it looks like there's FT2232 and FT232 incompatibilities that might bite... Takes another 1 or 2 weeks before I have it...Only thing that's a bit of a stumbling block now: there is no JTAG TMS pin on the 100 pins connector. Only TDI, TCK, TDO, HRST, SRST. It seems that TMS is hard wired to VDDL on the scope main board, right under the BGA, impossible to cut that track unless you'd de-solder the 357 BGA pins. So TMS hard wired to +3V3. What does that mean? Just that I cannot debug, but still can do flash and NVRAM and RAM read/writes? That would be good enough for me for now but is that what it is?

author: cpuchip
author_rank: Contributor
timestamp: November 23, 2020, 05:40:10 pm
content: Quote from: Jwalling on November 23, 2020, 09:56:59 amBoth ideally, but at you're leisure since I'm in no rush on this (I figure it's going to take months to get this scope up, it's just something I work on every few days as a hobby)Quote from: sicco on November 23, 2020, 01:17:06 pmI've been following Phil's Lab, did you have any helpful resources? Because.. you're design looks awesome. and... way ahead of mine (non-existent since I'm still just learning, and I have a full time Software Engineering job)Quote from: sicco on November 23, 2020, 01:17:06 pmI found you're query here, I'm looking too. hopefully we'll fine ithttps://community.nxp.com/t5/PowerQUICC-Processors/BSDL-file-for-MPC862P/m-p/995749

author: cpuchip
author_rank: Contributor
timestamp: November 23, 2020, 06:09:27 pm
content: I think in this list, the file we're looking for is near the bottomhttps://www.nxp.com/search?keyword=MPC860&start=0&category=softwarebut I cannot download it.https://www.nxp.com/webapp/sps/download/license.jsp?colCode=MPC860BSDL&location=nullit's just a blank page.

author: cpuchip
author_rank: Contributor
timestamp: November 24, 2020, 04:47:37 am
content: Sicco, for good measure I submitted a support request from NXP for the missing/broken link on their website for the MPC860 BSDL file.I will say this. I never want to use NXP processors. THEIR support pages and support process is 'your' company and product based and all of their IDE tools are behind pay walls. I much prefer other brands, like STM32 or even microchip, which seems to be much more open about the whole thing.

author: cpuchip
author_rank: Contributor
timestamp: November 24, 2020, 04:52:34 am
content: I think this is the file. WOW they did respond fast. within a few minutes.

author: james_s
author_rank: Super Contributor
timestamp: November 24, 2020, 06:06:08 am
content: Quote from: cpuchip on November 24, 2020, 04:47:37 amIf you think that's bad try Broadcom. Even just getting datasheets usually requires NDAs.

author: sicco
author_rank: Regular Contributor
timestamp: November 24, 2020, 09:19:56 am
content: OK, so we have the BSD file now. That's progress. I renamed the MPC860BSDL.txt to MPC860BSDL.bsd, and then it was 'approved' when importing by the TopJTAG programs that I use. 18 days left of my free period from TopJTAG friends... Still no Altera_USB_Blaster in the post today though. What's worse, I'm learning now that the MPC860 has two different 'engineering' back doors, one is JTAG= IEEE 1149.1=test access port (TAP), the other is background debug mode (BDM), and was more proprietary Motorola and sort of preceded JTAG. They share the same pins - sort of. But only JTAG uses the TMS pin. And that is the pin that is pretty solidly hard wired to VDDL via a TDS3000 main board PCB track right under the BGA. So I fear JTAG is pretty much a dead end now. Unless someone is wiling to x-ray the main board right under the XPC860 BGA. I fear lots of mutilayer tracks will get hurt if I'v drill a hole from the bottom to reach this hidden pin TMS at BGA pin location G18 for adding a patch wire... Hmm. Do I really want to go there? Anyone any better idea? Like is that BDM interface (which I believe has all its pins on the 100 pin expansion connector) good enough to access the ROMs and RAMs, and to flash re-program the ROMs? Would expect so, because how else would Tektronix have flashed the ROMs at production time? But what hardware and software PC tools does that then require??

author: Jwalling
author_rank: Unknown
timestamp: November 24, 2020, 10:27:59 am
content: Quote from: cpuchip on November 23, 2020, 05:40:10 pmWith the ethernet flat cable disconnected, nothing at all is outputted from the console port on the scope that hangs.On the working scope:QuoteThat's it. I was rather surprised at this... The scope finishes booting as well.

author: YetAnotherTechie
author_rank: Regular Contributor
timestamp: November 25, 2020, 12:13:11 am
content: Quote from: sicco on November 24, 2020, 09:19:56 amBDM was pretty popular to debug all kinds of embedded motorola chips likw 68hc11 and 68hc900 family. What came up while searching for BDM info a long time ago were programmers that i think were basically a level converter for uart, but sold for hundreds $ because of the software that came with them for "bad stuff" like car radio decode and odometer programming.You need dig back well into the nineties to find info.

author: sicco
author_rank: Regular Contributor
timestamp: November 25, 2020, 11:31:29 am
content: Another small step forward: I can now get my TDS3054 (once a TDS3034, but now upgraded, so an older model, not a -b or -c, so no Ethernet inside) to say more on the TTL level 38400,n,8,1 on SMTXD1, pin 13 on the 100 pins expansion port. For that to work, I had to link SNI_RX (pin 16) to SNI_TENA (pin 17). With that, it immediately after power on reset emits this which is a lot more than it did before (when it did just two lines, after a wait of 10 seconds or so):UUUUUUUUUUUUUUUUUUUULoading ImageBoot flash checksum OKCode flash checksum OK0x00800000 bytes of RAM foundDRAM address line check OKDRAM data line check OKNVRAM address line check OKNVRAM data line check OKTBC ACQ SRAM address line check OKTBC ACQ SRAM data line check OKTBC Display SRAM address line check OKTBC Display SRAM data line check OKSuperI/O ID 0x000000b2Uncompressing code from 0xffc40010 size 0x001e0927Enabling cacheEntering usrRootEnabling the MMUsysClkRateSet using 25 MHzEnabling I/O systemexcInit calledClass 17 Level 3 hwResetTBC(): Installing Machine Check Exception handler. 12:05:41 11/25/2020 (thread: StartUp)Class 7 Level 3 hwI2CAppKeySearch: new device I2C/APPKEY1 slot 1 addr 0xa012:05:41 11/25/2020 (thread: StartUp)Class 7 Level 3 hwI2CAppKeySearch: new device I2C/APPKEY2 slot 2 addr 0xa212:05:41 11/25/2020 (thread: StartUp)TBC reset count = 2That's more useful! Sending CTRL-X to the SMRXD1 pin 14 makes it reset, reboot. Other than that it only seems to echo - so other than that nothing interactive yet.If I unplug the purple cable to the front panel keyboard, then it says this in Putty:0x0UUUUUUUUUUUUUUUUUUUULoading ImageBoot flash checksum OKCode flash checksum OK0x00800000 bytes of RAM foundDRAM address line check OKDRAM data line check OKNVRAM address line check OKNVRAM data line check OKTBC ACQ SRAM address line check OKTBC ACQ SRAM data line check OKTBC Display SRAM address line check OKTBC Display SRAM data line check OKSuperI/O ID 0x000000b2Uncompressing code from 0xffc40010 size 0x001e0927Enabling cacheEntering usrRootEnabling the MMUsysClkRateSet using 25 MHzEnabling I/O systemexcInit calledClass 17 Level 3 hwResetTBC(): Installing Machine Check Exception handler. 12:04:07 11/25/2020 (thread: StartUp)I2C err I2CER 0x10 I2CAccessInProgress 0 fpStateVal 8 addr 0xee opcode 0x9 NAK 0x3804I2C err I2CER 0x10 I2CAccessInProgress 0 fpStateVal 7 addr 0xee opcode 0xe NAK 0x3804I2C err I2CER 0x10 I2CAccessInProgress 0 fpStateVal 7 addr 0xee opcode 0xf NAK 0x3804Class 7 Level 3 I2C ERROR: Front Panel may not be connected 12:04:07 11/25/2020 (thread: Interrupt)I2C err I2CER 0x10 I2CAccessInProgress 0 fpStateVal 7 addr 0xee opcode 0xe NAK 0x3804Class 7 Level 3 I2C ERROR: Front Panel may not be connected 12:04:07 11/25/2020 (thread: Interrupt)I2C err I2CER 0x10 I2CAccessInProgress 0 fpStateVal 7 addr 0xee opcode 0xf NAK 0x3804TBC reset count = 3Makes sense, it's I2C comms to that front panel board with its NEC78011, which must be the I2C slave at address 0xee. And those before at 0xa0 and 0xa2: My two option modules TDS3FFT and TDS3TRG that also sit on the front panel board. Bingo!With the front panel cable back in, running the Diagnostics from the Utility page on the Tektronix:Class 5 Level 3 Diag: TestCpuCore 12:04:56 11/25/2020 (thread: exec)Class 5 Level 3 Diag: CPURomChecksum 12:04:56 11/25/2020 (thread: exec)Class 5 Level 3 Diag: Boot 12:04:56 11/25/2020 (thread: exec)Class 5 Level 3 Diag: Code 12:04:56 11/25/2020 (thread: exec)Class 5 Level 3 Diag: NV Memory 12:04:56 11/25/2020 (thread: exec)Class 5 Level 3 Diag: TestAppKeyRead 12:04:57 11/25/2020 (thread: exec)Class 5 Level 3 Diag: TestFDDReadWrite 12:04:57 11/25/2020 (thread: exec)Class 5 Level 3 Diag: TestFPAccess 12:04:57 11/25/2020 (thread: exec)Class 5 Level 3 Diag: TestIO 12:04:58 11/25/2020 (thread: exec)Class 5 Level 3 Diag: TestTBCMemory 12:04:58 11/25/2020 (thread: exec)Class 5 Level 3 Diag: Display 12:04:59 11/25/2020 (thread: exec)Class 5 Level 3 Diag: Acq 12:04:59 11/25/2020 (thread: exec)Class 5 Level 3 Diag: TestAcqContinuity 12:04:59 11/25/2020 (thread: exec)Class 5 Level 3 Diag: TestAcqTrigger 12:05:04 11/25/2020 (thread: exec)So on the -b models, the Ethernet signals SNI_TENA and SNI_RX go to another board that has the Ethernet PHY chip. Unplugging that ribbon cable connector likely cuts the signal path SNI_TENA to SNI_RX which on my old scope (still?) go to 100 pins connector pins 17 and 16.If you'd like to play it safe: also a 1 kOhm resistor between SNI_TENA and SNI_RX does the trick. But grounding or tying these pins to +3V3 does not do the trick.

author: james_s
author_rank: Super Contributor
timestamp: November 25, 2020, 07:42:15 pm
content: Now this seems to be getting somewhere. I've added one of the expansion connectors to my cart so the next time I order parts I'll get one of those and can try it in my dead one.

author: cpuchip
author_rank: Contributor
timestamp: November 28, 2020, 02:38:38 am
content: My connectors just arrived today, I'll have to solder on a few wires and then make my own debug board I can solder this too. Does anyone have a starting KiCad project for an expansion board?

author: james_s
author_rank: Super Contributor
timestamp: November 28, 2020, 02:42:01 am
content: I was just going to solder wires to the connector pins and slip a bit of heatshrink over each. I suppose it could be worthwhile to lay out a board with a USB UART, some buffers for the bus and a prototyping area with a grid of holes or something.

author: cpuchip
author_rank: Contributor
timestamp: November 28, 2020, 05:48:03 am
content: I'm putting together something more static that can be used for info on these scopes:https://github.com/cpuchip/TekTDS30xyzI've added a few pins on the TE connector and some info on the read me. Not really much, but I plan to add a home brew expansion board with KiCad at some point, unless someone wants to beat me to it.Let me know if any of you want direct access to that repo for commits. I'll spend the next couple of days flushing out the TE connector pin out from other places on this form, and added what I know about the NVRam. Then I'll probably start in on some KiCad project, but I don't even know what dimensions to make the PCB, what did you use sicco on your home made expansion board?

author: m k
author_rank: Super Contributor
timestamp: November 28, 2020, 12:38:37 pm
content: Quote from: sicco on November 19, 2020, 10:45:06 pmIn case there's a password somewhere I spotted XYZ something around IP iddresses.

author: cpuchip
author_rank: Contributor
timestamp: December 02, 2020, 01:38:48 am
content: I'm looking at the BDM doc I found for the MPC8xxx processorsSicco do you know where the:SRESET (Pin 65)HRESET (Pin 66)DSDI (Pin 63)DSDO (Pin 62)FRZ/VFLS0 (Pin 61 as FRZ) (looking at Datasheet H2) is this on TE 100?FRZ/VFLS1 (Pin 61 as FRZ) (looking at Datasheet J3) is this on TE 100?pins are? You mentioned that they were on the TE connectorI've not yet tried JTAG missing the TMS pin yet on this board. I finally have a TJAG probe, though I think I'm going to get the FT232H breakout board from adafruit, that seems more straight forward to use.

author: cpuchip
author_rank: Contributor
timestamp: December 02, 2020, 04:56:04 am
content: I've updated my TE connector pinout page here:https://github.com/cpuchip/TekTDS30xyz/blob/main/TE%20100%20pinout.mdYou'll have to read over it to let me know if I've missed anything or made any mistakes.Pin 11 is the only one not marked with something. also pmercier was unsure of these pins:11 ?? No information that I can find22 (was mixed up with SNI_RCLK & /INT )25 as possibly *WAIT26 either *REG or *ALE27 maybe is A2074 possibly *OE (note is that Output enable in regards to whatever the TE 100 pin expansion cards wants to put on the Data bus?)77 *TAI used this page:https://hackaday.io/project/172242-extension-card-for-tds3000-scopes/log/179520-the-actual-informationsand this thread to help fill in the holes:https://www.eevblog.com/forum/testgear/reverse-engineering-tektronix-tds3gv-module-for-tds3000-series-oscilloscopes/75/

author: sicco
author_rank: Regular Contributor
timestamp: December 02, 2020, 07:15:52 am
content: The connector pinout: see the pdf for the schematics that I shared in post just a few days ago in this same topic thread. I made a KiCAD symbol for it.Yesterday I managed to get an old Abatron BDI2000 BDM/Jtag unit hooked up to in the TDS3034, and with that I could read out the flash ROM on the main board. BDM is not Jtag, but using the same pins mostly, except for TMS that BDM does not use at all. BDM definition of a 10 pin header is also different from what Jtag has defined. But the TDS3000 has neither. It might be that the -b and or -c versions do have the 10 pin debug/program headers, it looked like that on some of the pictures or youtubes that I came across.

author: sicco
author_rank: Regular Contributor
timestamp: December 02, 2020, 07:23:43 am
content: This item if you scrol back up:Re: Tektronix TDS3012B repair help needed« Reply #40 on: November 23, 2020, 01:17:06 pm »I noticed that from an iPad clicking on the pdf attachment link does not work, so use a PC to open the schematics.

author: cpuchip
author_rank: Contributor
timestamp: December 02, 2020, 05:30:29 pm
content: Quote from: sicco on December 02, 2020, 07:15:52 amWait what! You got BDM working?! that's great news! I definitely don't have an BDI2000... Did you use BDM? and what program did you use to talk to the MPC860?

author: sicco
author_rank: Regular Contributor
timestamp: December 02, 2020, 06:48:36 pm
content: The program for BDI2000, i got nothing initially after scoring my unit on eBay for 50 Euros. Then searched and searched and searched until i found something in China. Posted that elsewhere in forum for BDI2000 on EEVBlog.It’s not straightforward, you need both Ethernet and RS232 to initialise the module. The PC from which you run the tool needs to run a FTP server, and a Telnet session, but it is possible. There’s a special config file that sets the MPC860 config registers. Lots of config registers to set... These say for example what address range is used for which of 8 or so /CS pins. Plus how to set /CS, for how long, and so on. I used brute force with the config file from China, which I knew was not for a TDS3000 main board, but something else MPC860 PowerPC running also something VxWorks. Close enough, fingers crossed. It did allow me to work back where the boot roms were mapped, and from there I could read code that strongly resembled the rom code for v3.39 shared earlier in this forum thread. So could not yet run scope code in debug mode, i.e. not able yet to single step or set breakpoints. Not sure I want that either. Without the Tektronix C source code that would be pretty tough anyway.But maybe the original Tektronix engineers from 20 years back now read these posts, and maybe also they and their employer agree that by now it is time to donate that source code to science. To us. So publish it quietly in a github corner or so. As a tribute to their Brand image, reputation. One can always ask...On why I go into this deep dive: ongoing mission is to make a super plugin that fixes the TDS3K empty battery DS1744 design flaw, that also offers isolated serial, USB, WiFi, Bluetooth and Ethernet. And now also BDM connector plus that other diagnostics second serial port. For Ethernet I still need an image of the TDS3EM rom code, plus a programmer for the AMD29EV800 rom chip on it. My hope is that someone out here can get me that code, or if not, that i can find this code in the image for the TDS3000-b motherboards that we have already.

author: cpuchip
author_rank: Contributor
timestamp: December 03, 2020, 03:25:40 am
content: Okay, I've looked at getting a BDI2000, but there's just non available in my price range (they're over 300$+ here in the states, and there's only like 2 of them available), I did find that OCDemon usbWiggler Macraigor can program the MPC860 processor (I think) and I found some of those on ebay.com for 20$ so I've ordered one.

author: cpuchip
author_rank: Contributor
timestamp: December 03, 2020, 04:41:14 pm
content: Quote from: cpuchip on December 02, 2020, 01:38:48 amAre those the pins you used for the BDM interface?I found this as the pin config of the Wiggler to use:QuoteCan you confirm that you used pin 61 IRQ6 or FRZ as your debug indicator on the BDM adapter?

author: sicco
author_rank: Regular Contributor
timestamp: December 03, 2020, 05:04:01 pm
content: Yes, those were the pins i used. IRQ6 for FRZ, only one of the two.Plus DSCK, DSDI, DSDO, SRESET, HRESET, GND (2x) and target VDD.

author: sicco
author_rank: Regular Contributor
timestamp: December 04, 2020, 10:32:55 pm
content: More progress to report with the BDM using the Abatron BDI2000. See also attached .txt files, one for what I got via the BDI2000 Telnet port, one for the config file that ftp's into the BDI2000 when it boots up, and one from the TDS3000 diagnostics port on pins 13 and 14, a FTDI-TTL cable, Putty at 38400,n,8,1.The config file is basically totally empty now. Because my TDS3000 has working flash roms, and from there it boots up and gets its proper configuration for the memory map and what is CS0 ... CS7 etc.All I need to type into the BDI2000 Telnet console is 'reset run', then within a few seconds I must type 'halt' and then 'go'. Without the halt and go, it does not decently boot up, but with these two extra commands it does a full boot and allows me to halt, single step trace, inspect ram, registers, upload code, edit code, download code the whole lot. And I assume that includes erase and reflash as well, but I'm cautious for now.So that map is:CS0: boot ron = flash on mainboard. At 0xffc00000..0xffffffff.CS1: DRAM - but that gets mapped differently. I think it sits at 0x00000000..0x0x007fffff.CS2: the DS1742W RTC/NVRAM, mapped at 0x02800000..0x028007ff. You can see the seconds ticking, and the time/date in BCD at the top at 0x028007f0..0x028007ffCS3 - don't know yet - likely i/o to the scope ADCsCS4 - don't know yet - likely i/o to the scope ADCsCS5 - don't know yet - likely i/o to the scope ADCsCS6 - the CE1 signal on the expansion port, pin 78.CS7 - the CE2 signal on the expansion port, pin 79. That's the one byte module identifier. The high 4 bits indicate what module is plugged in. 0x0*=TDS3VM, serial RS232+VGA, 0x1*=TDS3GM, serial+GPIB, 0x2*=TDS3EM, Ethernet+serial, 0x3*=G01 DIGITAL VIDEO, 0x4*= TDS3GV, higher numbers gets me 'incompatible firmware' - so future expansion i guess.Now, I remade a TDS3EM on my super plugin with DS1744 RTC, and that now gets recognized as a TDS3EM, and the scope even sees that my flash rom on the module is still blank. So looks like the final step is to get that flash code as a binary or hex file, and then my BDI2000 will be able to flash it! But who is willing to share me taht code? Or lend my an original TDS3EM so that I can read it out. Maybe it's just the MAC address, maybe it's the full Ethernet stack. Any help appreciated.Just reflashing TDS3000 firmware with the 4 floppy disks (i went back from 3.41 to 3.39) did not do the trick of also flashing the TDS3EM plugin module flash chip.Bedtime now in Holland.

author: sicco
author_rank: Regular Contributor
timestamp: December 12, 2020, 12:06:32 pm
content: A bit of a side topic, but might be worth sharing: on the mechanism behind PASSWORD PITBULL and MCONFIG TDS3054: what that does is append a string in the TDS3000 main board rom image. The exact address position seems to depend on FW version, and model like -b or -nothing, but it looks like the mechanism is there also for firmware 3.41. So I guess it is the same approach for the -c versions. The 3.41 firmware and the -c models don't do the PITBULL MCONFIG anymore, so for now we were stuck with the older models. But this here may be a clue on how to crack that puzzle for -c etc.If you make a dump of the binary files (like those two for u610_339 and U620_339 shared before by others in this forum), and then search for ascii string "TDS 30" (no quotes, but with the space), then you find two relevant parts. The first one I think is the original firmware when a unit left the Tektronix factory. But then higher up in the rom code, there's a section where additional strings can get appended. The MCONFIG TDS30nn secret command simply appends the null terminated string TDS 30nn to that list - provided it is a known model number, fits the number of channels etc. The list grows and grows every time you do a MCONFIG, overwriting already erased (0xff) data. So no need to erase rom flash sectors upfront. Looks like you can do it 100+ times should you wish so.At the next reboot, it reads that list of strings, picks the last one from that list, and that will be how it will configure itself. That configuration act involves a lot of internal data partition reshuffling in the roms it seems, but that's ok.Here's a snippet for what the version upgrade attempts status is in the image for u610_339 and U620_339 that was shared earlier:2c07a0: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ................................2c07c0: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ................................2c07e0: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ................................2c0800: ffffffff 54445320 33303334 42000000 00780000 00f40000 01ea0000 03c40000 ....TDS 3034B....x..............2c0820: 07890000 00780000 00f30000 01e90000 03c20000 07840000 00770000 00f10000 .....x...................w......2c0840: 01e60000 03bb0000 07780000 00790000 00f50000 01ed0000 03c90000 07940000 .........x...y..................2c0860: 00760000 00f00000 01e40000 03b60000 076e0000 00790000 00f50000 01ed0000 .v...............n...y..........and then much further down:2d8200: 00000000 00000000 0000bee6 3333be64 00004074 70b83ef6 57000000 0000bf00 ............33.d..@tp.>.W.......2d8220: 1b33bf00 1b33bf00 1b33be60 b1f83e3a 13333e3a 13333e3a 13333f00 0000bf19 .3...3...3.`..>:.3>:.3>:.3?.....2d8240: 34cdbf19 34cdbf19 34cdbf00 00003e7b 53babeea 3fa33f23 e6683e9a 00000000 4...4...4.....>{S...?.?#.h>.....2d8260: 00000000 00000000 01000000 03800005 00000000 00000536 111e0a00 07d20000 .......................6........2d8280: ff005444 53203330 35344200 54445320 33303634 4200ffff ffffffff ffffffff ..TDS 3054B.TDS 3064B...........2d82a0: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ................................2d82c0: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ................................2d82e0: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ................................2d8300: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ................................2d8320: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ................................2d8340: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ................................2d8360: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ................................2d8380: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ................................Which makes me conclude that the owner here originally had a TDS3034B, which he managed to upgrade to a TDS3054B, and then, after that, he upgraded to TDS3064B.My gut feeling now is that in a TDS3000-c unit, the act of appending "TDS 3064C" to the bottom of the list of null-terminated ansi-C ascii strings would result in the same bandwidth upgrade for, say, a TDS3012C.Some more evidence supporting that below - in picture attached. That's from my TDS3034-nothing, where I went back and forth multiple times.Also attached my updated Abatron BDI2000 BDM config file for the TDS3000 PowerPC XPC860.Disclaimer: I have not yet written anything into my rom's, only observed what happens (what the delta is inside the flash roms) when doing the BW hack in FW 3.39 in my old TDS3034. But it looks promising for -c models I think.

author: james_s
author_rank: Super Contributor
timestamp: December 12, 2020, 07:35:23 pm
content: This makes me wonder if a corrupted string being written to that location could cause the boot failures like we've seen. I wonder what happens if you do manage to fill the space? Maybe it's smart enough to stop writing at some point, or start over at the beginning? The bandwidth upgrade remains after doing a firmware update so maybe it masks off that space and doesn't mess with it.

author: sicco
author_rank: Regular Contributor
timestamp: December 12, 2020, 10:17:45 pm
content: Today I had the courage to finally do the erase command, followed by a prog command. If that would not work flawlessly, then I would have lost my TDS3034. So I was a bit worried. But I was lucky, so it survived after reflashing with the Abatron BDI2000 BDM tool. First upload the rom image, then do a verify command, and only if that works, only then I knwe that the settings for chip type, size, file format, offsets etc was probably good enough to dive into the deep.Tried a couple of different firmware's with several manual edits. It worked as expected more or less. With FW 3.41, I can change from TDS30x4 with x at 1, 2, 3 or 5. But that only works if I edit the first entry where there was a list of entries before. Padding the list of strings as seemed to happen with MCONFIG in FW 3.39 did not do the trick in FW 3.41. Only overwriting the first list entry works. If it doesn't work, then typically the scope defaults to the lowest setting, so to TDS3014 in my case. It also does that if I try to run with a TDS3012B image.Surprised to see that there is no ROM checksum check over this part of the main board flash roms. the VxWorks bootrom reports two checksums, one for Boot flash, another for Code Flash, and both always passed, irrespective of the small edits I made in the full rom images.Updated Abatron BDI2000 config file attached, plus a telnet session log from the BDI2000.

author: cpuchip
author_rank: Contributor
timestamp: December 14, 2020, 05:44:58 am
content: Quote from: sicco on December 12, 2020, 10:17:45 pmYou Sicco are a brave soul! and congrats on not messing up your scope.I just received my BDM probe, I hope it has enough features to get me along in this debug process. I hope to have a connector wired up with it, and the two serial ports this week, but we'll see, I'm also searching for a job now so my time in the evenings are limited.