Possible ticking time bomb in Tek DPO3000 and MSO3000 series of scopes DPO4000 ? - Page 1
Forum section: electronics / testgear

author: Jwalling
author_rank: Unknown
timestamp: December 23, 2020, 05:19:46 pm
content: This may be a ticking time bomb in Tek DPO3000 and MSO3000 series of scopes. It also may affect the DPO4000 and MSO4000 scopes as, IIRC, they use a similar NVRAM scheme. It's not a Dallas chip you can remove, read-out, and program a fresh one, but a soldered in battery on the acquisition board. This scope came to me on a repair job with a battery that was very dead. This is the first time I've seen a dead battery on one of these, so I can't be sure of this fault.I opened a ticket with Tek:QuoteResponse:QuoteI DON'T think this ahardwarefailure, if the battery is at fault.

author: Jwalling
author_rank: Unknown
timestamp: December 23, 2020, 05:28:59 pm
content: Just emailed Casey this:Quote

author: CJay
author_rank: Super Contributor
timestamp: December 23, 2020, 05:30:31 pm
content: Looks like there may be a MAC related command in the TV84 post with attached txt filehttps://www.eevblog.com/forum/testgear/dpo3000-hacks/25/You probably need to find the serial debug port on the 'scope

author: Jwalling
author_rank: Unknown
timestamp: December 23, 2020, 05:35:31 pm
content: Quote from: CJay on December 23, 2020, 05:30:31 pmWhich I've heard talked about, but have yet to see anyone post about where it is located or pinout.Thanks.

author: Jwalling
author_rank: Unknown
timestamp: December 23, 2020, 06:23:15 pm
content: Or maybe USB port...

author: Jwalling
author_rank: Unknown
timestamp: January 07, 2021, 03:13:14 pm
content: Quote from: Jwalling on December 23, 2020, 05:28:59 pmNot much of an update, but what the hell...Response from 1-4-2020Quote"definitely possible" WTF does that mean?So my next email:QuoteSo far Using it's USB connection, I tried to brute force the MAC address using the first three octets that are assigned to Tektronix. I don't know whether it expects spaces, colons, or nothing, so I tried all three.Code::MFG:MAC 08 00 11 79 22 91:MFG:MAC 08:00:11:79:22:91:MFG:MAC 080011792291:PASSWord INTEKRITY (only):MFG:MAC 08 00 11 79 22 91:MFG:MAC 080011792291:MFG:MAC 08:00:11:79:22:91:MFG:MODe (and using :PASSWord INTEKRITY):MFG:MAC 08:00:11:79:22:91:MFG:MAC 08 00 11 79 22 91:MFG:MAC 080011792291:MFG:MODe (NOT using :PASSWord INTEKRITY):MFG:MAC 08:00:11:79:22:91:MFG:MAC 08 00 11 79 22 91:MFG:MAC 080011792291None of those worked.I also looked at some other scopes on my Asus router to see what other first three octets they use:TDS3034B B041068 CODEX CORP 08:00:3E:01:02:03That's odd - Codex.TDS3014C C014072 TEKTRONIX INC 08:00:11:1E:C1:DDWhat is strange (though not related to this thread) a TDS3054B with serial prefix B014XXX did not show up on my Asus router, but was working fine on Ethernet in any case. I tried a TDS3012B with serial prefix B027XXX and it behaved the same way.Anyway, a few pics using a USB connection. The first, an MSO4K that's working correctly.

author: Jwalling
author_rank: Unknown
timestamp: January 21, 2021, 02:51:54 pm
content: On 1/14/2020 I got this reply:QuoteSo it's gone fromQuoteTo that.*sigh*

author: KE5FX
author_rank: Super Contributor
timestamp: January 23, 2021, 08:34:08 am
content: What's the actual Ethernet hardware implementation? Maybe there's a power or communication issue that keeps the Ethernet MAC hardware from talking to the CPU. They may have just bought an Ethernet-to-SPI or whatever bridge from the "Codex Corp." OEM. If that's where the MAC address is stored, you might just need to troubleshoot that area of the hardware.The battery business may be a red herring, in other words.

author: JohnPi
author_rank: Regular Contributor
timestamp: January 24, 2021, 08:44:17 pm
content: I (and others) have asked before on this forum where the serial debug port is on these 'scopes. Does anyone have any information please ?

author: Jwalling
author_rank: Unknown
timestamp: January 25, 2021, 09:30:54 am
content: Quote from: KE5FX on January 23, 2021, 08:34:08 amScope is gone, as the customer didn't care about the problem. So I guess I'll wait and see if this problem pops up again with someone else when their battery dies...The TDS3000 B and C scopes store the MAC address in the Dallas chip, so there would be precedent for this.

author: m k
author_rank: Super Contributor
timestamp: January 25, 2021, 07:25:59 pm
content: It seems that that Tek tech didn't tell you all.Maybe that is the situation where the device must call home using alternative channel.Is it probable that there are a special console port?Perhaps commands are rerouted like you wondered.HTML something was a fashion one day.Quote from: JohnPi on January 24, 2021, 08:44:17 pmWhere are all pcb pictures?

author: tixdave
author_rank: Newbie
timestamp: March 30, 2021, 07:06:55 pm
content: Quote from: JohnPi on January 24, 2021, 08:44:17 pmI have been trying to find the serial debug port on a DPO4034B and I have at last found it!!!On the back I/O module there is a RS-232 IC chip (U801, ICL3221) right next to the VGA port.I have pinned it out and it looks like Rx is pin 11 and Tx is pin 4 on the 15 pin VGA connector (unused VGA pins).Connected it up to putty and had to change the baud from 9600 to 115200 and what do you know, words start showing up in the terminal!!Hope this helps!

author: Jwalling
author_rank: Unknown
timestamp: March 31, 2021, 11:59:32 am
content: Quote from: tixdave on March 30, 2021, 07:06:55 pmThanks for that.This also appears to be the case with the non-suffix MSO/DPO 4000 scopes. However, I get nothing but garbage. I tried baud rates from 9600 up to 230K.

author: Jwalling
author_rank: Unknown
timestamp: April 01, 2021, 12:33:46 pm
content: Quote from: Jwalling on March 31, 2021, 11:59:32 amOperator error. I was using the wrong type of serial converter at the PC end.Here's the output of a working MSO4104. Invoking the full tests from the utility menu produces no output, but SPC does. Serial port was set to 9600,n,8,1Code:U-Boot 1.1.4 (Jan 8 2007 - 11:12:14) Tektronix, Inc. V1.06CPU: AMCC PowerPC 440EP Rev. C at 333.333 MHz (PLB=133, OPB=66, EBC=66 MHz)I2C boot EEPROM enabledInternal PCI arbiter enabled, PCI async ext clock used32 kB I-Cache 32 kB D-CacheBoard: Tektronix Route66 IBM 440EP Main BoardVCO: 666 MHzCPU: 333 MHzPLB: 133 MHzOPB: 66 MHzEPB: 66 MHzI2C: readyDRAM: 128 MBFLASH: 64.5 MBPCI: Bus Dev VenId DevId Class Int00 13 10b5 9056 0680 1800 15 1002 4c59 0300 17DISP: Type 1In: serialOut: serialErr: serialEnter password - autobooting in 3 seconds## Booting image at f0000000 ...Image Name: Linux-2.4.20_mvl31-440ep_evalImage Type: PowerPC Linux Multi-File Image (gzip compressed)Data Size: 1441010 Bytes = 1.4 MBLoad Address: 00000000Entry Point: 00000000Contents:Image 0: 1033953 Bytes = 1009.7 kBImage 1: 407042 Bytes = 397.5 kBVerifying Checksum ... OKUncompressing Multi-File Image ... OKcmdline is console=ttyS0,9600 quiet bigphysarea=519 panic=2 root=/dev/mtdblock7rw mem=131072kLoading Ramdisk to 07f2b000, end 07f8e602 ... OKChecking for firmware update...No USB mass storage devices found to update from.Linux 2.4.20_mvl31-440ep_eval V 1.15 Tektronix Route66 Tue Jun 22 15:19:50 PDT 2010stat of /var/log/dmesg failed: No such file or directoryWarning: loading NiDKEng-1.6 will taint the kernel: non-GPL license - ProprietarySee http://www.tux.org/lkml/#export-tainted for information about tainted modulesWarning: loading NiDUsb-1.6 will taint the kernel: non-GPL license - ProprietarySee http://www.tux.org/lkml/#export-tainted for information about tainted modulesWarning: loading tek will taint the kernel: non-GPL license - ProprietarySee http://www.tux.org/lkml/#export-tainted for information about tainted moScope application starting (normal mode)---------------------- startScopeApp() running Init code ----------------------versionBuildFWVersionString(): TimestampString: 25-Apr-12 11:13VersionFIRMWAREVERSIONversion: v2.68Major ver num: 2 Minor ver num: 68Initializing MiaInitializing Tek0005Initializing Ibm440Initializing HFD204ADCInitializing HFD204ADCModel id: 0x03Initializing Ltc1658DacBoard id: 0x01Initializing M859Initializing M859Initializing M859Initializing M859Initializing Ltc1660DacInitializing Ltc1660DacHFD144 ID_REG = 0x00001440HFD144 ID_REG = 0x00001440HFD144 ID_REG = 0x00001440HFD144 ID_REG = 0x00001440Initializing Hfd144Initializing Hfd144Initializing Hfd144Initializing Hfd144Open Max5362 successful.Initializing Max5362Initializing Ltc1661DacInitializing Ltc1661DacInit ADT7468 and locking.Factory Checksum: Stored: 7072, Calculated: 7072 - OKSpc CheckSum: stored: 49755 calculated: 49755 - OKDemux initializationDram calibrationDram calibration completeDram Calibration results:-------------------------DramCal has PASSED on all DemuxsDemux initialization completeStarting POST diagsFinished POST diags---------------------- startScopeApp() running Start code ------------------------------------------- startScopeApp() running Run code -----------------------SIOCSIFFLAGS: Link has been severedOK to connect by: telnet MSO4104-04TRCT 1072SocketServerService: Socket server daemon started on port 4000.Protocol: Raw-----------------------------------------------------------------startScopeApp() complete; duration = 34.739902 seconds=================================================================PID to Task info written to /tmp/threads.txtPower Up Completed at 05:11:11Enter 'ctrl-\' to quit scopeAppBEGIN SPC, PASSING:05:24:17 SPC: starting 5:24:1705:24:17 Signal test05:24:18 - PASSED05:24:18 Signal test 0:0:105:24:18 Time Interpolator Cal05:24:24 - PASSED05:24:24 Time Interpolator Cal 0:0:605:24:24 ADC Linearity05:25:35 - PASSED05:25:35 ADC Linearity 0:1:1105:25:35 ADC Offset and Gain05:25:56 - PASSED05:25:56 ADC Offset and Gain 0:0:2105:25:56 ADC Interleave05:26:21 - PASSED05:26:21 ADC Interleave 0:0:2505:26:21 Offset05:27:20 - PASSED05:27:20 Offset 0:0:5905:27:20 BW Offset05:27:22 - PASSED05:27:22 BW Offset 0:0:205:27:22 DC Balance05:29:09 - PASSED05:29:09 DC Balance 0:1:4705:29:09 Attenuation05:30:10 - PASSED05:30:10 Attenuation 0:1:105:30:10 VariGain/GainStepsCal05:33:26 - PASSED05:33:26 VariGain/GainStepsCal 0:3:1605:33:26 Trigger Level Gain and Hysteresis 1Meg05:33:38 - PASSED05:33:38 Trigger Level Gain and Hysteresis 1Meg 0:0:1205:33:38 Trigger Level Gain and Hysteresis 50 Ohm05:33:50 - PASSED05:33:50 Trigger Level Gain and Hysteresis 50 Ohm 0:0:1205:33:50 Trigger Level Offset 1Meg05:33:59 - PASSED05:33:59 Trigger Level Offset 1Meg 0:0:905:33:59 Trigger Level Offset 50 Ohm05:34:07 - PASSED05:34:07 Trigger Level Offset 50 Ohm 0:0:805:34:07 Digital Trigger Level05:34:14 - PASSED05:34:14 Digital Trigger Level 0:0:705:34:14 Adg523 Word Recognizer Delay05:36:26 - PASSED05:36:26 Adg523 Word Recognizer Delay 0:2:1205:36:26 Adg523 Analog Delay05:39:23 - PASSED05:39:23 Adg523 Analog Delay 0:2:5705:39:23 Adg523 Extra Delay Paths05:39:23 - PASSED05:39:23 Adg523 Extra Delay Paths 0:0:005:39:23 Digital Hsr Deskew05:40:41 - PASSED05:40:41 Digital Hsr Deskew 0:1:1805:40:41 SPC Total Time: 0:16:2405:40:41 Writing SPC Consts:SPC Version: 11Date (mon:day:year): 4:1:2021Time (hr:min:sec): 5:40:4105:40:41 FactoryDate: (mon:day:year) 7:19:2008Factory Time: (hr:min:sec) 22:25:7

author: EE-digger
author_rank: Frequent Contributor
timestamp: April 01, 2021, 02:30:00 pm
content: Some Tek scopes (TDS7xx comes to mind) only stored user settings in their Dallas chip. As Jay mentioned, others stored more than that.One place I worked in the past used Dallas chips in their very expensive high speed BER/transmission test equipment. Critical calibration constants for line conditioning and timings were stored in those chips. Dumb design which renders those units to a high position in the recycling pile.

author: analogRF
author_rank: Super Contributor
timestamp: May 23, 2022, 04:04:01 pm
content: Quote from: Jwalling on April 01, 2021, 12:33:46 pmBut can you stop the boot?I am having trouble stopping the UBoot...needs a password!!

author: analogRF
author_rank: Super Contributor
timestamp: May 23, 2022, 04:06:17 pm
content: Quote from: tixdave on March 30, 2021, 07:06:55 pmhave you been able to stop the UBoot?what is the password it needs for stopping?

author: Jwalling
author_rank: Unknown
timestamp: May 23, 2022, 06:59:39 pm
content: Quote from: analogRF on May 23, 2022, 04:04:01 pmNever tried, and I no longer have it.

author: tixdave
author_rank: Newbie
timestamp: May 24, 2022, 01:43:02 pm
content: Quote from: analogRF on May 23, 2022, 04:06:17 pmI have not been able to, I do not know the password.Why do you want to stop the UBoot?