TDS7404 Rebuild Calibration Content from CalCons files - Page 1
Forum section: electronics / testgear

author: charlyd
author_rank: Frequent Contributor
timestamp: April 01, 2023, 01:46:19 pm
content: Hi i have a TDS7404 where the eeprom content was lost a while ago.i heared from several people that it could be possible to rebuild the 2k bin file for my Eeprom X24165 from the calcons files made when the unit Passed SPC. i can image that those written files have the right content to get the unit in cal.i will add my whole CalCons dir ( i added extra number files 0-16 inside which were not open while running SPC so i guess not used )who can help me out rebuild my Field cal insode my eeprom.i am willing to pay $100 to the person who can get my Eeprom content back so my scope gets a SPC PASS state again.CalCons.zip(25.83 kB - downloaded 53 times.)- CalCons.zip -my Calcons filesfrom when my unit passed SPC- X24165_working unit.zip -a complete sample set from a working unit :Eeprom bin export+CalConsfrom the same unit.using this bin file in my scope generates on one channel a too big offset so spc won t pass.: if i remember well channel 2 has a big offset when running against the current not original eeprom content)if other files or info is needed, don t hesitate to contact me

author: charlyd
author_rank: Frequent Contributor
timestamp: April 19, 2023, 06:17:57 pm
content: yesterday i found an old "set" of vxboot folder.calcon files from when my unit passed SPC.i copied the structure in the orginal location booted the unit and waited for 20 minutes warm-up.then my unit displayed : "TEMP" which is ok. i saw it on the offset which was ok. but how do i get this content back into my eeprom ?anybody?

author: Benjamin74360
author_rank: Newbie
timestamp: December 27, 2024, 02:21:53 pm
content: Hi,I am new to this forum, and I also have a TDS7404 bought for parts.Thanks to the content available on this forum, I was able to replace the faulty NVRAM with a durable FRAM, install an SSD, improve the dissipation of the fragile trigger chips, and unlock all the options on this oscilloscope. Thanks, especially to Tin and Charlyd.However, I have one last problem, it is error 521, the factory cal data that is erased from the eeprom.The SPC tests are running correctly, the oscilloscope works well, but I would like to restore a correct content in the eeprom anyway.Have you found a solution since then?Thanks

author: charlyd
author_rank: Frequent Contributor
timestamp: December 28, 2024, 11:52:23 am
content: Hi if i rememeber well the 521 error is that the Misc 521. then it is a matter of. diag >> spc >> diag. and fixed.if it is factory cal. something you are in a need of the eeprom content. i can help you with that. before you do anything save your vxboot (complete) on a safe place.because the new eeprom content is of course not from your acq board which can end up with a wrong offset. the error should be gone. but the next step would be to figure out the relation between the eeprom content and the so called 9-15 files in your vxboot. they are generate by the use of the eeprom content while spc is ran.please explain how you got into it...and be sure to export your content before starting..the file is 2 posts up.by the way for those who want to export there eeprom to a safe place it works ok desoldering simply make quickly a big solder blop on each side of the eeeprom. ...onces done pic your tweezers fetch the chip while jumping from one side to the other with your Iron. that way you don t destroy your chip and content. i tried to export with a clip that didn t work for me.better leave it there if not neccessary and don t run calConStatus = cc_init(1) it will clear your eeprom.

author: charlyd
author_rank: Frequent Contributor
timestamp: December 28, 2024, 12:09:49 pm
content: [editted : Misc 521 was not correct that was Misc 451.so i didn t remember well

author: Benjamin74360
author_rank: Newbie
timestamp: December 28, 2024, 10:43:45 pm
content: Thanks for the clarification.My EEPROM is indeed erased, I had run the command calConStatus = cc_init(1) shortly after I bought the scope, while I was trying to troubleshoot another error.Unfortunately, if I had seen the eevblog threads before, I would never have done this, but too late, the damage was done...Now everything else is working fine and is saved correctly, so I will try to write the file you provided to the EEPROM.If my SPC fails afterwards, I will try to do some more research. I will update this thread then.

author: Benjamin74360
author_rank: Newbie
timestamp: March 24, 2025, 11:19:03 pm
content: Hi,I'm back to share my experience with the EEPROM of my TDS7404, if it can help anyone. Sorry for the long post, but if anyone picks up reverse engineering, they'll at least have a starting pointI tested the good file provided by charlyd (thanks!).Like him,I no longer get error 521 when flashing the file to the EEPROM, but the calibration is no longer successful(voltage overflow errors on all 4 channels, calibration is interrupted).The provided file either contains data too far from what my device needs, or is for a slightly different version of oscilloscope.So I spent several dozen hours investigating and attempting to reverse-engineer the EEPROM.I'm attaching all the elements used in my reverse engineering to this link (file too large for this message) :https://drive.google.com/file/d/1FTFo0BdDCD7tWuoDGnJIqSJifKhPpEMg/view?usp=sharingI mainly compared the file on my EEPROM with the 521 error and the one provided by charlyd. I also analyzed the communication between the device and the memory with a logic analyzer (at power-up and then during the MISC test).Here are my thoughts:I deduced that most of the data included in the memory are calibrationconstants encoded in IEE754. For example, there are a lot of 3f800000 (or similar values) in my file, which corresponds to 1.0000000.It's also worth noting that the file seems to be divided into two or three parts.We can see that the oscilloscope, during the MISC test, first reads the data from address 0x00 to address 0x12B, then the data from address 0x12C to 0x17D. This results in two distinct parts. Changing a value in the first part will generally result in a 521 error, and in the second, a 541 error.A third part is certainly present from 0x00 to 0x59, since the data doesn't appear to correspond to calibration data, and changing this part results in 521AND541 errors (in my tests at least). Perhaps CRCs in this part ?I've tested many combinations of slightly modified data to try to remove the errors, but I've never succeeded. Even the slightest change to the calibration data results in an error. It therefore appears that CRCs are being calculated by the oscilloscope to verify the memory data. I've tested dozens of combinations on the memory to modify the CRC, but I haven't found anything that doesn't produce errors...The system seems well designed by Tektronix so that it's impossible to modify the device calibration without an internal document explaining the logic of the calibration datasI also have another reverse engineering possibility, but it seems less likely and is outside my current area of ​​expertise anyway.Note that if we disassemble EEPROM code (x86 dissasembly), we find a set of instructions ending with a "ret". However, the instructions are quite different between the two files included in the two EEPROMs, so maybe it's just a coincidence? Maybe a mix of IEE754 and assembler data, I don't know?If anyone is comfortable with complex assembler instructions, perhaps they'll understand something about these disassemblies.After several dozen tests,I'm giving up on this search, so as not to waste any more time and risk damaging the oscilloscope. In any case, the calibration passes despite the error, so the device seems to be accurate. To obtain a no-error calibration, it would have to be sent to Tek for recalibration (I received a quote for over 1500€ several years ago, so I'll refrain).PS :For owners of aBatronixuniversal programmer, it doesn't normally support X24165 memories, but I was able to work with it.To use it, you need to use an Arduino board with the program I'm attaching to the link. You need to power the EEPROM with the Arduino's 0-5V and connect its pins 1, 2, 3, 4, and 7 to ground, and the SDA and SCL to the Arduino's SDA and SCL. The program can be uploaded to the Arduino, and the chip is write-enabled (a write is made to the Write Protect register, and is confirmed by the Arduino on the serial monitor).Next, you need to launch the Batronix software and install the X24165 update that I also provided in this post. You need to connect a ground wire, the SDA, and the SCL to the Batronix,WITHOUTremoving power from the EEPROM (otherwise the Write Protect register will be reset).Once this is done, you can use the programmer with this EEPROM.The Arduino allows you to unlock the memory; otherwise, this programmer cannot work due to its architecture.