Tektronix TDS 744A debug console questions. - Page 1
Forum section: electronics / repair

author: NPG
author_rank: Contributor
timestamp: January 25, 2025, 03:58:33 am
content: I just got a hold of the scope mentioned above.It has the following feature options. 13 1F 2F.I have looked around online for information on it and found a lot of interesting things.What I would like to do once I have the debug console up and running is to do the following.1. Query the scope for model information.2. Query the scope for installed hardware and features.3. If a feature comes back as disabled, query the scope about the ability to enable that feature.For instance if the hardware isn't installed, it doesn't make sense to enable some features like 05; or the 1-4 M features.4. Enable a feature if possible.5. Disable features.6. Maybe back up NVRAM or firmware.I would like to do as much of this as possible from the debug console port. What I have found online about it is for a different model of Tek TDS scope.Does anyone have information pertinent for this model of scope?Thanks :-)

author: TERRA Operative
author_rank: Super Contributor
timestamp: January 25, 2025, 12:51:24 pm
content: You can do all of this with the GPIB port. You can't query for disabled options etc, everything that is enabled is shown on the boot screen. But using the *IDN? command via GPIB will tell you the model, serial and firmware version.The debug port is used for lower level diagnostics when troubleshooting, and is not much use for normal operation.If option 05 isn't enabled already, you won't have the hardware installed, it is a PCB that sits above the acquisition board. You can see if it's installed by peeking in through the air vent holes on the right side of the instrument.Check this link on enabling and disabling options:https://www.eevblog.com/forum/testgear/enabling-options-in-tektronix-tds500-tds600-and-tds700-series-scopes/Youmiggghhhttbe able to enable option 2M, worth a try for sure. The scope simply won't report it on the boot screen if the RAM is not present inside.Turn off 1M, turn on 2M and reboot and see.Also, 2C can be enabled, but probably isn't useful unless you are doing communications signal triggering and mask testing.

author: NPG
author_rank: Contributor
timestamp: January 25, 2025, 04:01:36 pm
content: Thank you for all the information.Quote from: TERRA Operative on January 25, 2025, 12:51:24 pmAfter looking around online, I was under the impression that I needed a specific ISA GPIB card to do this.Am I mistaken?In my research, I came across these.https://tomverbeure.github.io/2020/07/02/Extracting-the-Tektronix-TDS420A-Firmware.htmlhttps://tomverbeure.github.io/2020/07/03/TDS420A-Serial-Debug-Console-Symbol-Table-Ghidra.htmlhttps://tomverbeure.github.io/2020/07/11/Option-Hacking-the-Tektronix-TDS-420A.htmlI figured that a $20.00 debug console adapter sold by a member of these forums on ebay might be more cost effective than building a PC with ISA bus, finding the magic GPIB card, getting a GPIB cable, installing software, etc.Quote from: TERRA Operative on January 25, 2025, 12:51:24 pmMost of what I want to do is lower level stuff, and seems to be possible if the articles that I linked above are legit.My only doubt is item 6 as moving a firmware image through 9600 baud serial connection sounds painful.I may try to see if I can turn the baud up to 115200 once I get access to the debug console, that might make FW transfer easier, but I have my doubts.Quote from: TERRA Operative on January 25, 2025, 12:51:24 pmExactly, I have no idea how that person enabled option 05 on their TDS 420 if the hardware wasn't there.They actually had to add RAM to their scope to get the 1M option going.Quote from: TERRA Operative on January 25, 2025, 12:51:24 pmThank you for that link, that is one of the pieces I was looking for.I didn't want to go poking around my scope's memory and brick it.It looks like the feature settings live in the same memory addresses on the TDS 400 series scopes too.Quote from: TERRA Operative on January 25, 2025, 12:51:24 pmThank you again for the help, I will definitely report back when I have more information. :-)

author: NPG
author_rank: Contributor
timestamp: January 25, 2025, 05:20:59 pm
content: Quote from: NPG on January 25, 2025, 04:01:36 pmI RTFM for the TDS 400 series.Feature 05 is "standard on the TDS 400A".:-)

author: TERRA Operative
author_rank: Super Contributor
timestamp: January 26, 2025, 02:11:02 am
content: You only need the specific National Instruments GPIB-PCII/IIA ISA-bus GPIB card for the adjustment procedure. All other GPIB functions can be done with any GPIB interface.You don't need the debug adapter for anything but diagnostics, all functions you mention you want to do can be done via standard GPIB, but if you want to take a look at the boot messages then go ahead and spend the $20.Adding options, backing up NVRAM or updating firmware is not low level.I have never tried to extract firmware via the serial port, I only use GPIB, so you are on your own there. AFAIK, you can't do that using the debug port.The TDS200, 300 and 400 series scopes are completely different in basically all respects and share no similarities with the TDS 500, 600 and 700 series scopes, which are closely related to each other.Don't take information for the TDS400 series and try to apply it to your scope.

author: NPG
author_rank: Contributor
timestamp: January 26, 2025, 03:01:13 pm
content: Quote from: TERRA Operative on January 26, 2025, 02:11:02 amOK, thank you, that's good to know.I am unfamiliar with GPIB, and had read that it was fairly interoperable.I found the same with a bit more research, it seems to be the Tektronix software that is locked to that specific card.Quote from: TERRA Operative on January 26, 2025, 02:11:02 amIf it's possible at a high level, it should be possible at low level.Is it a sane idea? Well... TBD. :-)Quote from: TERRA Operative on January 26, 2025, 02:11:02 amI found part of that out while researching feature 05.The TDS 4xxA series has the video hardware as standard. The TDS 7xxA series needs an add on card for that.It does however appear that feature code flags that are common to both product lines live in the same addresses on both.Feature code.Console enable command. TDS 4xxGPIB enable command. TDS 5xx-7xx05libManagerWordAtPut 0x50007, 1WORDCONSTANT:ATPUT 327687, 12FlibManagerWordAtPut 0x50009, 1WORDCONSTANT:ATPUT 327689, 11MlibManagerWordAtPut 0x50006, 1WORDCONSTANT:ATPUT 327686, 1The addresses are lining up between the product lines.I am fairly confident that a low level console command and a high level GPIB command will do the same thing.My current plan once I have the debug console up is as follows.1. Dump the symbol table.2. Find feature verification and other interesting routines.3. Run those to get results.4. Possible enable/disable some features.5. Verify results.6. Investigate dumping NVRAM and firmware.We will see. :-)

author: NPG
author_rank: Contributor
timestamp: January 26, 2025, 04:43:32 pm
content: Just found this thread.https://www.eevblog.com/forum/testgear/tds-744a-(-friends)-firmware-reverse-engineering/msg1167745/#msg1167745So it seems that what I want to do is possible.