Automating Tektronix Field Adjustment Software for TDS oscilloscopes - Page 1
Forum section: electronics / testgear

author: dxl
author_rank: Regular Contributor
timestamp: December 21, 2014, 07:54:06 pm
content: Hi All,i've read several threads here about Tektronix scopes. I bought one a while ago (a TDS754D). That unit had a broken display (CRT was so weak, you couldn't read anything). I replaced that with a TFT LCD, so that problem is solved now. However, the processor board lost all of it's CAL constants, andthe Acquisition board had two failed Input Attenuator Hybrids. The latter one was easy to fix, i had another Acquistion board i could take them from.I'm still working on the re-calibration, and want to share some of the things i learned so far. Software used is the TDS700D field adjustment software.The software requires an old NI PCII/A GPIB ISA card. As i don't have such a card nor the old DOS PC required, i started to hack up DOSEMU to adda driver that simulates those card, so i could run everything on Linux with my more modern NI GPIB USB HS Adapter.The TDS Software actually expects two cards:a) one at 0x2e1 to connect to the DUT (the oscilloscope)b) one at 0xe2e1 to connect to all the required Measurement equipment when running in automated mode.in adj700d.bat, there's a TMODE variable define, which influences the calibration process:TMODE=M - default settingTMODE=MA - asks also for humidityTMODE=MB - exchange the meaning of both GPIB cardsTMODE=MD - prints diagnostic during calibration, i.e. why a calibration step failedthere are probably other settings, but i didn't test every possible combination.the G_CONFIG file defines the devices present on the GPIB bus - devices where 'INAME' starts with '*' are disabled, and the Software will ask the User to manually set the device to the required setting / read values manually. If you remove the asterisk, the Software will automatically programthe measurement device.the R_CONFIG file defines the connections between all those devices - you shouldn't change anything in the default R_CONFIG except if you want to have a full automatic calibration setup.I've spent most of the time figuring out how automatic switching works, so i don't have to switch cables all the time. Here's what i figured out:You have to add a 'Router' device to G_CONFIG, i added to the end:Code:CEDAT (ISYSTEMNO "1"INAME "Rt1"IDDRIVER "si5020"IMODELOPTION "Tektronix SI5020"IUNIT "1"IIDNO "n/a"ICALDATE "n/a"IDUEDATE "n/a"IADDRESS " 5")In R_CONFIG, there's a 'Section 3 - Path definitions'. In the manual configuration, every line has a unique number in the 'manual close' column.To automate a entry in that section, you have to move the unique number to the 'auto close' or 'auto open' section, depending on your switch setup.In 'Section 4: auto switching commands', you need to add one line for each of the automatic entries from section 3. Syntax is as follows:1 1:O1,3,4_1:C2,5,6,7,8The first column is the unique identifier from section 3. After that, the second column tells which GPIB unit should be used, and which relays should be closed and opened for that particular path. In my example above, Relays 1,3 and 4 will be closed, while 2,5,6,7 and 8 will be opened.I haven't defined that section so far, as i'm still waiting for the HP 75000 system i bought which should do all the switching.Hope this is helpful anyways.

author: sky2city
author_rank: Contributor
timestamp: May 16, 2016, 02:55:26 pm
content: Hi dxl,I am working on the Calibration for my TDS754D.Can you tell me the detial of how to hack up DOSEMU to add a driver that simulates those card.I don't have old PC anf NI PCII GPIB card ,but a modern NI GPIB USB HS Adapter only.thanks advance.Roger

author: dxl
author_rank: Regular Contributor
timestamp: May 17, 2016, 01:49:11 pm
content: I've uploaded the code i've written tohttps://github.com/sschnelle/qemu-gpib/commits/master. However, this only works for the Field Automation Software, other MSDOS software didn't work.

author: sky2city
author_rank: Contributor
timestamp: May 17, 2016, 05:07:45 pm
content: dxl,Thanks for your reply.I assumpt your are running the DOS on QEMU.So what I need to do list:A. Install a linux system on my PC, some OS like Ubuntu, and then install the linux driver for NI GPIB HS Card.B. Download the QEMU and make it run on linux.C. Clone qemu-gpib master brunch to local QEMU.D. Start a DOS emulator on QEMU, like FreeDOS, athttps://en.wikibooks.org/wiki/QEMU/FreeDOS.E. Last step, run the Automating Tektronix Field Adjustment, do everything must to be done......Correct me if I am wrong.Roger.

author: andy2000
author_rank: Frequent Contributor
timestamp: May 17, 2016, 07:03:15 pm
content: Quote from: dxl on December 21, 2014, 07:54:06 pmThe cal constants are stored on the acquisition board in a pair of EEPROMs. It's odd that you could lose them since they are hardware write protected by the protection switch on the processor board.

author: dxl
author_rank: Regular Contributor
timestamp: May 17, 2016, 08:58:00 pm
content: Quote from: sky2city on May 17, 2016, 05:07:45 pmYes, those steps are right. I digged and found the MSDOS image i used for calibrating my TDS754D. I've uploaded them tohttp://stackframe.org/qemu-gpib/.Just download and gzip -d the msdos_gpib file. The msdos_gpib.sh contains the commandline required to start qemu with gpib support. And yes, the first version was running on dosemu, but qemu/kvm is much faster when it comes to process all the FFT stuff that's done inside of the Field Adjustment software. So i switched to QEMU.

author: sky2city
author_rank: Contributor
timestamp: May 18, 2016, 03:25:29 am
content: I had downlaod it.I have everything need for the Cal. of my TDS754D........Thanks so much.

author: dxl
author_rank: Regular Contributor
timestamp: May 18, 2016, 08:47:08 am
content: One thing i forgot to mention - in the QEMU GPIB code, there's a function gpib_map_commands(), which does some translation of the GPIB commands for my Test equipment. If you have all the equipment Tek wants, you can remove that function.The current function translates the commands so that the FAS can work with my equipment, which is:- a Fluke 3330 calibrator with own GPIB interface- a Rohde & Schwarz SMIQ03 RF generator- a PREMA 6.5 digit DMM- an HP75000 based switching system to run the full test suite automated.

author: sky2city
author_rank: Contributor
timestamp: May 19, 2016, 12:14:18 pm
content: Got it.

author: sky2city
author_rank: Contributor
timestamp: May 19, 2016, 12:42:48 pm
content: BTW,Actually, I don't have the equipment tek recommented.I am going to calibrate it manually.refer to the service manual of TDS700D, there are 3 cal. test:1) Voltage Reference2)Frequency Response3)Pulse TriggerI have two 6.5 digit DMM,HP3456 and HP3457A, and RF singal generator of MT8801C.there will be no problem with Voltage Reference / Frequency Response cal.for Pulse Trigger, I plan to buy a "Pulser, Tunnel Diode",Tektronix part number067-0681-01.thanks.

author: charlyd
author_rank: Frequent Contributor
timestamp: September 28, 2017, 09:01:49 am
content: hello i am also busy try to cal. my TDS754D but get erros while doing voltage calibration.anyone ever had that ? (i have my Processor board fail still ( i keep that in mind)could there be a link?

author: fenugrec
author_rank: Frequent Contributor
timestamp: January 01, 2018, 05:54:36 am
content: Quote from: dxl on December 21, 2014, 07:54:06 pmAwesome work on qemu ! I had started to do the exact same thing a few months back : for some reason I never found this thread until very, very recently. I also spent much time analyzing the TDS700.exe binary, and went down a slightly different path.As you stated, the field adjustment software needs either an ISA, NI GPIB-PCII or PCIIA card, which are getting hard to come by. These cards are based on a NEC7210-compatible IC which implements a set of 8 registers. One difference between PCII and PCIIA cards is the mapping of these registers in the x86 IO address space. Otherwise they behave pretty much the same, as far as the field adjustment software (can I call it just FAS ?) is concerned.Now, as it turns out, many ICs have implented a 7210-compatible interface or just cloned it altogether. Anything NAT4882-based necessarily has a 7210 mode, and this means many many ISA cards could *potentially* be used with the FAS. The caveat of course being that the FAS needs to be modified to use the proper IO address mapping.Here's a table that hopefully explains better than me.Code:index : 7210 register #name : 7210 register name*_mapping : IO port used to access the register on a certain card type (AT is GPIB-AT, not sure about GPIB-AT/TNT)indexnamePC2_mappingPC2A_mappingAT_mapping0CDOR02B802E102C01IMR102B906E102C22IMR202BA0AE102C43SPMR02BB0EE102C64ADMR...5AUXMR...6ADR...7EOSR...Here's the relevant section of code in the FAS that generates the IO port mappings:Code:;Dissassembly from TDS700.exe near file offset 0x346CD;;This code path parses the "GPIBn=PC2A   " environment variable;(set in ADJ700.bat);;gpib_cardID is "n" in "set GPIBn=...", so 0 or 1.;Notice this pattern:;leaax, [di+2E1h];which does "ax = di + 0x2E1", where di is generated based on the DIP switch setting.;We recognize 2E1 as the base address for register CDOR on the PCIIA cards !3B14:017Fmovsi, [bp+gpib_cardID]3B14:0182shlsi, 13B14:0184moves, seg_775463B14:0188movdi, es:[si+big.GPIB_DIPswitch]3B14:018Dmovcl, 0Dh; shift DIPswitch setting to set address bits A14..A133B14:018Fshldi, cl3B14:0191leaax, [di+2E1h]3B14:0195moves, seg_775483B14:0199moves:[si+big.DIR_CDOR], ax3B14:019Eleaax, [di+6E1h]3B14:01A2moves, seg_7754A3B14:01A6moves:[si+big.ISMR1], ax3B14:01ABleaax, [di+0AE1h]3B14:01AFmoves, seg_7754C3B14:01B3moves:[si+big.ISMR2], ax; ... and so on.I had difficulty finding an inexpensive GPIB-PCII board, so after realizing this I bought a GPIB-AT . Then I have patched the FAS to use the correct addresses (as well as the shift constant to use the "DIPswitch" value correctly) . So far it seems to be working - I've been able to connect to the DUT (my TDS744A) ! Note, for lack of cal equipment, I haven't actually tried any of the steps yet but I see this as a very good sign.TLDR : here's a summary of the possible methods to run the field adjustment software for these TDS scopes:basic setup : native DOS machine with an ISA card either GPIB-PCII or GPIB-PCIIA; this means nothing more recent than roughly Pentium III for the last ISA motherboards.dxl's neat qemu layer : DOS running in qemu, modern host computer with a modern USB-GPIB devicenative DOS machine + an ISA-GPIB card that claims to be PC2-compatible : looking at the list of supported devices in linux-gpib shows some names that also pop up on ebay, like "CEC PC 488", "cb7210", and some others. It's likely some of these will indeed be perfectly PC2 / PC2A compatible and not require patching the FAS.native DOS machine + an ISA-GPIB that is *not* PC2 compatible, but based on a controller IC such as NAT4882 which implements 7210 registers. The GPIB-AT is one of these. This requires patching the FAS which is fairly straightforward.I've been running my tests on freeDOS running on an old dual-P3 server motherboard; I don't think it's necessary to suffer needlessly and run plain MS-DOS. But, as I mentioned I haven't tried the cal process, only the initial connection.For those also wanting to do a native DOS + ISA card setup, I did some research to catalog NI ASSY # for these products. NI has many different hardware revisions for each product name, so it can be hard to identify the product based just on PCB photos.Code:ASSY : printed on component side of PCB. Back side often / always has a different number.Some of these don't make sense to me, but I'm fairly confident anything with a 7210 or NAT4882 can be made to work with the FAS.ASSYModelControllerNotes180100-02HGPIB-PCD7210C#180102-02 backface; "GPIB-PCII" printed near conn ??(datecode 0989)180100-02HGPIB-PCD7210C#180102-02 backface; (datecode 0587)180210-01GPIB-PC2A?D7210C#180212-01Abackface (dc 1485). no RTC180210-02GPIB-PC2A?D7210C#180212-01Abackface (dc 1485). RTC181060-01CAT-GPIBNAT4882+TURBO4882 PLCC sticker "AT-GPIB" near conn ??181060-01EAT-GPIBNAT4882+TURBO4882181065J-01GPIB-PCII/IIANAT4882

author: ingowien
author_rank: Regular Contributor
timestamp: March 06, 2019, 09:40:11 pm
content: The github link does not work anymore, is there a chance I could get that content for some tests with my 754D?

author: alocam
author_rank: Regular Contributor
timestamp: April 11, 2019, 08:08:57 pm
content: Hello, I was reading your post after searching for GPIB PCIIA ISA card, and I wonder whether you finally had a chance to grab one of these. I need to calibrate a Keithley unit, and software requires such card. I got one on ebay, but it did not come with the DOS diskette to install it. Do you know any source to download the PCII/PCIIA software?Thank you!

author: HardyG
author_rank: Newbie
timestamp: May 22, 2019, 07:33:15 pm
content: http://www.ni.com/product-documentation/54558/en/?OpenDocument

author: fisafisa
author_rank: Regular Contributor
timestamp: May 23, 2019, 06:28:22 pm
content: HiI would be interested too in the qemu-gpib.Anybody?

author: youxiaojie
author_rank: Newbie
timestamp: September 28, 2019, 01:56:17 pm
content: dear friend, who has the calibration software? could you give me a copy? and firmware updater disk?thanks.

author: charlyd
author_rank: Frequent Contributor
timestamp: October 24, 2019, 05:10:03 pm
content: i can help you out.. please pm me

author: gdwiggins
author_rank: Newbie
timestamp: December 31, 2020, 07:18:00 pm
content: Looking for the contents ofhttps://github.com/sschnelle/qemu-gpib/commits/masteras it is no longer a valid link--hopefully someone has it?

author: fenugrec
author_rank: Frequent Contributor
timestamp: November 06, 2021, 04:12:54 pm
content: Unfortunately I can't find my fork of qemu-gpib, but I was able to rescue the essential files.I have created a branch with those files, but it will NOT compile, and will NOT work without some work :1- original code was ported on a qemu tree from around 2012 that I can't find in current master repo2- qemu codebase has changed a lot since 2012If anyone's interested in working on this, I made a quick commit with just the files here:https://gitlab.com/fenugrec/qemu/-/tree/gpib_pciia

author: dxl
author_rank: Regular Contributor
timestamp: November 06, 2021, 09:07:39 pm
content: I updated the patch in the beginning of the year, and iirc it worked:https://github.com/svenschnelle/qemu/tree/pciia

author: fenugrec
author_rank: Frequent Contributor
timestamp: November 06, 2021, 09:48:38 pm
content: Quote from: dxl on November 06, 2021, 09:07:39 pmHi,that's awesome !! I didn't know you were still following this thread. Thanks again for sharing this.

author: dxl
author_rank: Regular Contributor
timestamp: November 07, 2021, 07:40:28 pm
content: Not really following, but once a year or so i stop by ;-)

author: fenugrec
author_rank: Frequent Contributor
timestamp: December 23, 2021, 05:41:16 pm
content: I finally calibrated my 744A last week, and discovered a few things while doing so , and decided to share a few tips in a videohttps://youtu.be/wSqTj4gGCJUHere are the main points :- Supported ISA GPIB cards :https://www.eevblog.com/forum/testgear/automating-tektronix-field-adjustment-software-for-tds-oscilloscopes/msg1388658/#msg1388658- CVR calibration does NOT absolutely require a metrology-grade DC calibrator like the DP8200, EDC 501 etc. But does need something better than just a lab PSU- CVR calibration needs +- 9.5V at the highest setting (not 104V as the service manual indicates) ; look at your "CVRCAL.500" file to confirm- HF cal needs 505MHz for a 500MHz scope, at +16 to +17 dBm. Many signal generators cannot do this, but a simple RF amplifier will do the trick.- HF cal : watch out for lossy coax cable (e.g. RG58 ) ! Even 0.6dB of loss caused problems. Manually compensating that loss worked OK.

author: micaticu
author_rank: Contributor
timestamp: May 03, 2022, 09:58:53 pm
content: Hello dxl,How is you project for automating the FAS 'Router' advancing?Do you have any news, more details?

author: jozefch
author_rank: Newbie
timestamp: December 29, 2022, 01:54:56 pm
content: Hello,As i need to calibrate my newly acquired TDS744 after input relays replacement, I was hoping to get FAS working.I was trying to get qemu gpib layer compiled and working, so far without any success.Older (2021) branch will not compile anymore, trying to apply changes to the new qemu branch will fail to compile. Patching it requires more knowledge than i have.Anyone have up to date qemu with gpib patch or at least working branch?I have also built an PII computer with ISA hoping it will run with CEC PC-488 8bit ISA card. This card have different IO port mapping, which i realized shortly after reading available documentation and ofc., ebay parcel arrivalfenugreccould you please share your patched TDS700 executable for GPIB-AT (i'll buy this card if it will work, PCII/PCIIA are just too expensive) or even better, if possible publish the patching procedure so i can try to patch executable for CEC PC-488 card?Thanks!

author: fenugrec
author_rank: Frequent Contributor
timestamp: December 29, 2022, 07:17:29 pm
content: Quote from: jozefch on December 29, 2022, 01:54:56 pmYou have seen this post ? :https://www.eevblog.com/forum/testgear/automating-tektronix-field-adjustment-software-for-tds-oscilloscopes/msg1388658/#msg1388658Granted the details are bit vague if you're not used to reversing software. You need to- find the docs for your ISA card and find the addresses of the control registers. See the table in the post I linked above- is your address map more similar to a PC2 or PC2A ? i.e. a xxx8, xxx9, xxxA sequence vs 02xx,04xx,06xx ? pick one. I used PC2A; PC2 will require slightly different modifications- Optional, if yours is going to be based on the PC2A : near file offset 0x6dcd1, modify two occurences of "PC2A" to an arbitrary string that you will use in the config file. I used just "AT".Remember, you can't change the length of the .exe file, and string needs to be 0-terminated.- tweak the code near file offset 0x346D1 . Any hex editor will do but it helps to look at disassembly to validate. See screenshot below; patched version is on the right.Maybe this decompiled code will help understand what happens there :Code:iVar6 = strcmp_0d84(..., "PC2A");if (iVar6 == 0) {/* PC2A addresses */p_bigstruct = (big_struct *)(iVar3 * 2);iVar6 = p_bigstruct->GPIB_DIPswitch << 0x0d;p_bigstruct->gpib_CDOR = iVar6 + 0x2e1;p_bigstruct->gpib_IMR1 = iVar6 + 0x6e1;p_bigstruct->gpib_IMR2 = iVar6 + 0xae1;p_bigstruct->gpib_SPMR = iVar6 + 0xee1;p_bigstruct->gpib_ADMR = iVar6 + 0x12e1;p_bigstruct->gpib_AUXMR = iVar6 + 0x16e1;p_bigstruct->gpib_ADR = iVar6 + 0x1ae1;iVar6 = iVar6 + 0x1ee1;}else {/* PC2 addresses */tmp2 = (big_struct *)(iVar3 * 2);uVar5 = *(undefined2 *)0x2e78;tmp2->gpib_CDOR = tmp2->GPIB_DIPswitch << 3;tmp2->gpib_IMR1 = *(int *)(iVar3 * 2 + 0x4a) + 1;tmp2->gpib_IMR2 = *(int *)(iVar3 * 2 + 0x4a) + 2;tmp2->gpib_SPMR = *(int *)(iVar3 * 2 + 0x4a) + 3;tmp2->gpib_ADMR = *(int *)(iVar3 * 2 + 0x4a) + 4;tmp2->gpib_AUXMR = *(int *)(iVar3 * 2 + 0x4a) + 5;tmp2->gpib_ADR = *(int *)(iVar3 * 2 + 0x4a) + 6;iVar6 = *(int *)(iVar3 * 2 + 0x4a) + 7;}}[EDIT - typo in addresses]

author: jozefch
author_rank: Newbie
timestamp: December 31, 2022, 12:11:04 pm
content: I have seen that post, however never worked with disassembler in any way, nor patched an DOS MZ executable. Your reply was more clear now, thanks for explanation.What can go possibly wrong to at least try, right?CEC PC-488have factory default starting address0x2B8, used range is2B8-2BFaccording to manual.After watching some tutorials, managed to patch exe in RAW mode using ghidra. Executable must be opened in RAW mode so it can be exported back to DOS MZ executable correctly.After a few HW configuration trials, some patches/exports, finally managed to get instrument detectedBtw, couln't find PC2A refference around offset 0x346b2, is the offset correct??Few notes:PC2A card is selected in startup batchCEC PC-488*MUST*have IRQ enabled in my case (IRQ7)I'm getting "Spurious SQR error" which so far have no impact to functionalityI'm not sure if it's allowed to attach TEK FAS executables, so I'll share it upon request

author: fenugrec
author_rank: Frequent Contributor
timestamp: December 31, 2022, 04:40:42 pm
content: Quote from: jozefch on December 31, 2022, 12:11:04 pmExcellent work !QuoteOops, copypaste error; 2 occurences are at 6dcd1 and 6dce1. But it's purely cosmetic.SRQ error : that's weird. I don't remember it being a problem, but the error message looks vaguely familiar. Also I don't remember if I had to do anything for IRQ settings; I'd have to reconnect + boot the temporary DOS machine I built just for this.Re sharing patches : I want to tryhttps://github.com/pR0Ps/pycrkto generate / apply human-readable binary patch files. Not a fan of python venv stuff which is why I haven't tried yet, but I'm not aware of many tools for this kind of thing.

author: fenugrec
author_rank: Frequent Contributor
timestamp: January 08, 2023, 12:04:24 am
content: Quote from: jozefch on December 31, 2022, 12:11:04 pmI uploaded my patch for GPIB-AT and instructions for creating / applying similar patches here :https://github.com/fenugrec/tdsutils/tree/master/tds700adj_patchesIf you want, grab xdelta3 (a brilliant tool) to produce a delta-diff - smaller and not problematic to share , and I could also add it to my repo.

author: jozefch
author_rank: Newbie
timestamp: January 08, 2023, 08:35:34 am
content: Nice!Patch for CEC PC-488 attached, uses "PC2A" for card type configuration in batch.

author: jozefch
author_rank: Newbie
timestamp: January 08, 2023, 09:07:51 am
content: 7z file was missing for some reason...

author: fenugrec
author_rank: Frequent Contributor
timestamp: January 08, 2023, 02:07:08 pm
content: Cool, will add to my repo.Looks like your card uses the same addresses as PC2, did it not work as-is with the unpatched exe ? Oh I see you also tweaked the GPIB_DIPswitch << X line too..

author: jozefch
author_rank: Newbie
timestamp: January 08, 2023, 07:13:43 pm
content: I tried to use PC2 settings for PC488 but without any success, afterwards i decided to patch exe.It seems there is something different for PC2, maybe different DIP mask value would work

author: DC1MC
author_rank: Super Contributor
timestamp: February 19, 2023, 03:58:01 pm
content: Dear participants of this thread, a group of incurable optimists has started the effort of fully reversing the Tek FAS and redo it for a more modern and affordable infrastructure in this thread:https://www.eevblog.com/forum/testgear/tektronix-tds-scope-field-adjustment-software-reverse-engineering/If your available time and interests allows, kindly please have a look and contribute, your expertise is invaluable in putting the project on the road.Also, is this FAS sw (DOS version) available somewhere and did anybody confirm if the FAS software uses the CEC library ?Thanks and cheers,DC1MC