Reverse engineer Dallas DS1742W? - Page 1
Forum section: electronics / repair

author: perdrix
author_rank: Frequent Contributor
timestamp: March 20, 2020, 09:19:18 pm
content: Did anyone ever strip one of these down completely to determine exactly what's inside them?Naturally there's a 2kx8 SRAM, a supervisory IC (what is it?) and a crystal ... The question is what else? Surely these can't be "rocket science" to reverse engineer with a replaceable battery?David

author: james_s
author_rank: Super Contributor
timestamp: March 21, 2020, 12:51:43 am
content: We know exactly what's inside these, the PowerCap version is not potted. There is an off the shelf SRAM, a battery, a 32kHz crystal, and a Dallas ASIC which is a RTC and battery backup controller. Due to the custom chip it doesn't really help you to know what's in there although you can cut the old battery out and solder in a new one.While the DS1742W is discontinued, the DS1744WP is in active production and I made an adapter using those to replace the DS1742W in Tek TDS3000 scopes. You can build one yourself if you like, aside from mechanical fitment constraints it will work in any application designed for the DS1742W, and the PowerCap package it uses has a replaceable battery.https://github.com/james10952001/DS1744WP-to-DS1742W-adapter

author: james_s
author_rank: Super Contributor
timestamp: March 21, 2020, 12:56:25 am
content: The DS1386 is the big brother to the DS1742 and is very similar inside. I do not currently have images of the DS1742W but I do have an intact dead one here kindly donated by another member so I will get that done eventually.

author: perdrix
author_rank: Frequent Contributor
timestamp: March 22, 2020, 01:28:18 am
content: Are you *sure* that it's a non-standard ASIC acting as the RTC and controller. I was hoping it might be a DS1315 Phantom Time Chip which is an off the shelf part (assuming they are still available) which is what was used in the DS1244. Are you sure it doesn't use one of those?Yes I was aware of the DS1744WP but by the time you've bought that and the PowerCap it's quite a bit of cash!Does anyone have a dead DS1742 I can rip apart?David

author: james_s
author_rank: Super Contributor
timestamp: March 22, 2020, 02:38:51 am
content: Yes I'm sure it's not a DS1315 or any other kind of phantom time chip, the RTC functions are not "phantom", they're fixed addresses overlapping the top handful of bytes of the RAM. You don't have to use any fancy tricks to access them like you do with the phantom RTCs, the enable to the RAM is passed through the RTC chip and when you access the RTC addresses it enables those and doesn't assert the chip enable to the SRAM. You don't need to rip one apart to see this, just look at one of the PowerCap versions as they're a bare PCB with the chips right out in the open, or compare the datasheets and it's obvious the RTC registers are different. Dallas makes or made a whole handful of RTC chips, some of the ones they offer integrated into potted modules are available separately, others are not.Yes the DS1744WP is not trivially cheap, however when it's the part needed to get a $500-$1500+ scope or other valuable instrument back up and running it seems pretty cheap to me. Also once you've installed that you can easily replace the battery the next time it goes dead without having to do any surgery. The low budget alternative is to cut out the old battery and solder in a new one, it's right under the top of the potted module, if you cut the plastic lid off one side you can often see the battery peeking through a thin layer of epoxy. It's a standard BR1632 lithium button cell.

author: David Hess
author_rank: Super Contributor
timestamp: March 22, 2020, 03:17:49 am
content: I do not know about the DS1742W specifically but the Dallas NVSRAMs I have checked used SRAM supervisors which were available as separate ICs, mostly or all from Maxim, so it was possible to design and build an exact duplicate.https://para.maximintegrated.com/en/search.mvp?fam=batteryback

author: james_s
author_rank: Super Contributor
timestamp: March 22, 2020, 05:53:07 am
content: The plain NVRAMs are easy, the RTC NVRAMs are not, not all of them anyway.

author: voltsandjolts
author_rank: Unknown
timestamp: March 22, 2020, 10:21:41 pm
content: Quote from: perdrix on March 22, 2020, 01:28:18 amYou have one already, its in your scope and its nearly dead anyway. No guts, no glory.

author: voltsandjolts
author_rank: Unknown
timestamp: April 01, 2020, 04:32:19 pm
content: https://www.eevblog.com/forum/testgear/reverse-engineering-tektronix-tds3gv-module-for-tds3000-series-oscilloscopes/msg2784562/#msg2784562

author: zebity
author_rank: Contributor
timestamp: October 23, 2020, 07:31:41 am
content: Hi Tektronics Scope Users,the Dallas DS1742W-120 is also a critical component is a number of SGI (Silicon Graphics Incorporated) Computers and there s a small group of us actively working on opening these up and coming up with a way of either cleanly attaching a replaceable battery on top or getting enough details on the internals to build an alternate replacement.The posting are in the IRIX Network on DS1742W-120 and related are in this thread:https://forums.irixnet.org/thread-2488.htmlSo far I have done destructive investigation on the DS1742W-120+ and am going to open up a DS1742W-120 next. The -120+ has an upside down layout with the battery on the bottom, which means it is not a good candidate for battery on top replacement.As I am a software person not a electronics person, any guidance from you electronics guys would be helpful.Let's keep these old Tektronics and SGI devices humming.Cheers from Oz,zebity/jwhat/John/

author: Stray Electron
author_rank: Super Contributor
timestamp: October 23, 2020, 11:07:38 pm
content: Zebity,Is that what is used in the SGI Indigo? I still have one and one of these days i intend to fire it up again (hoping that I can remember the PW!)

author: zebity
author_rank: Contributor
timestamp: October 24, 2020, 10:46:28 am
content: Hi Stray Electron,no Indigo uses DS1286 , see here for details on how to drill and replace battery:https://forums.irixnet.org/thread-1370-post-8924.htmlGlitchworks also have a very nicely build replacement:https://www.tindie.com/products/glitchwrks/gw-1286-1-dallas-ds1286-maintainable-repair-board/So you are well served for Indigo.The DS1742W is in the "big iron": Orign/Onyx 350, Tezro and Fuel.These machines actually have 2 RTC chips with the Dallas and Snaphat, both of which now have end of life batteries and so it is important that replacement / quality repair solution is found.Cheers from Oz,zebity/jwhat/John.

author: amyk
author_rank: Super Contributor
timestamp: October 25, 2020, 01:46:25 am
content: Various PC motherboards had the same problem, and the solution is the same: cut into the chip to disable the battery and connect a new external one.

author: james_s
author_rank: Super Contributor
timestamp: October 25, 2020, 06:03:12 am
content: I recently worked on an older dental xray digital sensor and a DS1742W was about the perfect size to use as a test subject. At some point I'd still like to shoot this on film which results in a much higher resolution shot but my friend's business is in the process of moving so I don't currently have access to that machine. Anyway this gives a reasonable idea of what's inside this part.

author: helius
author_rank: Super Contributor
timestamp: October 25, 2020, 07:37:52 am
content: It appears the DS1742W and other Timekeeper modules have been cloned already, for use in Tektronix DSOs.http://www.ebay.com/itm/293776182478

author: sicco
author_rank: Regular Contributor
timestamp: October 25, 2020, 11:58:52 am
content: For the tds3000 scopes, I have an alternative in the making, partly inspired on james_s DS1744 patch piggy back board. My board has same DS1744W but plugs into the scope rear expansion connector for RS232, VGA, GPIB, Ethernet. My board will get you not just the RTC, but also isolated RS232 DB9, isolated micro USB serial port, Ethernet RJ-45, and allows an ESP32 DevKit4 to be added for those that want the WiFi web server from Russia discussed in other thread on tds3k elsewhere on eevblog. No VGA or GPIB though.For this dead DS1742W workaround, the old DS1742W on the main board needs to be disabled - as in cut its pin 24 VDD or have its /CS input pin forced always high.I’ll make a few more quite likely.Expecting the JLCPCB delivered in a week or so - so fingers crossed.

author: james_s
author_rank: Super Contributor
timestamp: October 25, 2020, 06:05:53 pm
content: I wonder what IC that ebay replacement is using? My solution is cheaper if you build it yourself, but I'd have to charge at least as much if I were building them for other people for it to be worth it, the parts cost around $50 IIRC.

author: helius
author_rank: Super Contributor
timestamp: October 26, 2020, 01:18:40 am
content: If the equivalent battery-less Dallas clock-memory chips are not available, I think you would need to use something that can be programmed somehow (to match register functions and access time). Low-power CPLD or Silego glue, maybe even PSOC?

author: zebity
author_rank: Contributor
timestamp: October 27, 2020, 12:21:26 am
content: Hi EEVbloggers,I have pulled apart the DS1742W-120+, here is summary:Draft Pin Details:Pin 1 - Notched - Straight Through (A7)Pin 2 - Notched - Straight Through (A6)Pin 3 - Notched - Straight Through (A5)Pin 4 - Notched - Straight Through (A4)Pin 5 - Notched - Straight Through (A3)Pin 6 - Notched - Straight Through (A2)Pin 7 - Notched - Straight Through (A1)Pin 8 - Notched - Straight Through (A0)Pin 9 - Top Side R1, Under Side T1 (DQ)Pin 10 - Top Side R5, Under Side T2 (DQ)Pin 11 - Top Side R6, Under Side T3 (DQ)Pin 12 - Notched - Ground Layer (Battery -Neg)Pin 13 - Top Side R7, Under Side T6 (DQ)Pin 14 - Top Side R8, Under Side T5 (DQ)Pin 15 - Top Side R9, Under Side T5 (DQ)Pin 16 - Top Side R10, Under Side T9 (DQ)Pin 17 - Top Side R11, Under Side T8 (DQ)Pin 18 - Notched - Straight Through (^CE)Pin 19 - Notched - Straight Through (A10)Pin 20 - Notched - Straight Through (^OE)Pin 21 - Notched - Straight Through (^WE)Pin 22 - Notched - Straight Through (A9)Pin 23 - Notched - Straight Through (A8)Pin 24 - Top Side C2 (VCC), Under Side C3 (10A45)Draft ComponentsCapacitors x 3 (10A45)Resistor x 8 (102) - 1 per Data LineVoltage Regulator IC 6 PIN 10A45Oscillator Crystal (Pin 1/24 Notch)Battery Cell - 3V CR1225 (+Pos Pin 12/13 Notch, -Neg Pin 12)Here are pictures of PCB board that is encased in epoxy and sits underneath the main IC:And here is carefully cut chip with battery extracted:Full details of drilling/heating and cutting:https://tips.graphica.com.au/sgi-nvram.If someone else has nice pre-built replacement then I think I would just use that ... ;-)Cheers from Oz,zebity/jwhat/John

author: james_s
author_rank: Super Contributor
timestamp: October 27, 2020, 03:05:57 am
content: That's not a genuine DS1742W, at least it's not like any genuine DSxxxx part I've seen. Where did you get it from? It looks like one of the Chinese clones (that don't work properly) that are all over ebay. Look at my xray a few posts above, the genuine part has a completely different layout.

author: zebity
author_rank: Contributor
timestamp: October 27, 2020, 04:04:12 am
content: Hi James_s,thanks for feedback.Yes I am aware that this might be a "fake" or the other alternative is that it is faulty.It was a DS1742W-120+ variation which appear to be the ones which are the potential "fakes".These have the battery and PCB on the bottom and not the top.Is your X-ray of DS1742W-120 or DS1742W-120+ and is there any known difference in these variations ?The spec sheet just indicate that the -120+ is lead free.I have known good DS1742W-120 variations which are from my SGI machines, but have deliberately held back from opening these up until I complete some further testing and validation with EEPROM programmer I have been using.I currently have two known good spares.In playing with the "fakes" I am now pretty comfortable that I will be able to open up "real" variation with confidence that I will not damage it.Cheers from Oz,zebity/jwhat/John.

author: Rasz
author_rank: Super Contributor
timestamp: October 27, 2020, 05:31:32 am
content: Quote from: zebity on October 27, 2020, 12:21:26 am>Mixed Content: The page at '<URL>' was loaded over HTTPS, but requested an insecure image '<URL>'. This request has been blocked; the content must be served over HTTPS.

author: james_s
author_rank: Super Contributor
timestamp: October 27, 2020, 06:38:05 am
content: Quote from: zebity on October 27, 2020, 04:04:12 amLooking again, your chip is 100% a fake. It has the same weird texture and faint blurry printing as the fakes I got a few years ago, and the internal layout is completely different. Mine is a DS1742W-150 out of a Tek TDS3000 scope but there is no visible difference inside parts of different speeds. I have xrayed 5 or 6 genuine DSxxxx parts and a handful of fakes and all of the genuine parts have a similar style. Fine traces, small vias, surface mount packages, very tidy assembly. The fakes are different, look at the PCB you extracted, big fat traces, huge vias, sloppy soldering, DIP package inside. Measure the external dimensions, the fakes are larger than the genuine parts.The DS1742 went out of production several years ago so if you buy one with a current date code it is fake. If you buy one from China it is either fake or an old used part. Ebay is full of fake Dallas chips, you can tell immediately by the prices. Don't be scammed, the fake parts don't work.

author: Rasz
author_rank: Super Contributor
timestamp: October 27, 2020, 08:36:05 am
content: Quote from: james_s on October 27, 2020, 06:38:05 amdont work in what specific way? they sure keep stuff in SRAM and return time

author: james_s
author_rank: Super Contributor
timestamp: October 27, 2020, 07:54:52 pm
content: Quote from: Rasz on October 27, 2020, 08:36:05 amI bought about 10 different ones before I knew better. Out of all those I had two that worked, both were genuine parts that had clearly been sanded, blacktopped and printed with new date codes, they even came pre-loaded with data.The others were all defective in various ways, most had different problems. Going from memory:- Chip was readable but writes had no effect, could not store data on it or set the time.- Completely dead, reads resulted in garbage.- Seemed to work ok on programmer but did not function properly in scope.- Read and write worked, but conents lost when power removed (defective battery)Seems like there was some other symptom but I don't recall what it was. Incidentally I cut open most of the defective ones some time later and all of the batteries were below 1V by then, none lasted more than a year or so.Then there is the fact that they are counterfeit parts created as a deliberate attempt to scam buyers. I would be willing to buy a Won Hung Lo branded "WHL1742" or whatever sold as a compatible replacement for a DS1742 provided that it works, there is clearly a market for these so it surprises me that no Chinese companies are doing it. But don't try to sell me a counterfeit Dallas branded part, that is cheating.

author: MarkL
author_rank: Unknown
timestamp: October 27, 2020, 09:00:29 pm
content: Here's another post comparing a real DS1742W to a fake:https://www.eevblog.com/forum/repair/repair-of-tek-tds3014b-need-a-source-for-a-ds1742w-nvram/msg2644260/#msg2644260And a couple of posts after that one, some photos after I cut into the fake. The internals look the same as the one zebity posted.

author: darkstar49
author_rank: Frequent Contributor
timestamp: October 27, 2020, 10:22:59 pm
content: Quote from: MarkL on October 27, 2020, 09:00:29 pmIs there any technique to check whether a replica/fake DS1742W is functional or not ? What's the culprit with these chinese clones ?I got one here that I suspect to be a clone, but my programmer is happy with it so far... (although I guess that's not the part that causes trouble...?)

author: james_s
author_rank: Super Contributor
timestamp: October 27, 2020, 10:32:50 pm
content: Well, like I mentioned, mine all had different faults. The only definitive test is to try one in the actual application where it will be used, and even then you don't know how long it will last. My experience suggests that it's mostly a case of just poor build quality using low quality parts. The IC they use might be ok but a cheap battery or a source of electrical leakage (flux residue? leaky decoupling cap? diode leakage?) cause it to discharge.

author: MarkL
author_rank: Unknown
timestamp: October 27, 2020, 11:51:30 pm
content: For clones that aren't downright dead, my pet theory is that the RTC part of the clone chip is drawing way too much current and drains the battery in a matter of maybe months to a year or two.So it can be programmed normally and will retain the data, and it will keep time. But only for a while. Apparently long enough for people to be fooled and leave good feedback.

author: zebity
author_rank: Contributor
timestamp: October 27, 2020, 11:59:35 pm
content: Hi James_s & others,I agree 100% that people selling chips that don't work is essentially stealing people's money and more importantly wasting their time.There is only one thing that is important to me and that is whether the chip works or not...It is easy to verify if the chip works using the "XGecu TL866" programmer.The programmer comes with a bunch of pre-existing profiles and the one to use for DS1742W is the DS1220 profile, which has the same NVRAM specs as the DS1742W but without the RTC chip.As the purpose of this thread is about "reverse engineering", I am now going to open up a "genuine" DS1742W-120 and post the outcome of that investigation.While x-rays are useful they do not provide level of info required to complete reverse engineering work.I will likely not get this done until weekend but will re-post once completed.Thanks for all the helpful feedback and information.Cheers from Oz,zebity/jwhat/John.

author: james_s
author_rank: Super Contributor
timestamp: October 28, 2020, 06:29:26 am
content: It's always interesting to open up a potted assembly to see inside. We already know exactly what's in there though, the PowerCap versions of the Dallas ICs are made with the same parts and are not potted. In the case of the DS1744 there's a SRAM, a Dallas RTC ASIC, a 32kHz crystal and a coin cell. I don't have a PowerCap version of the DS1742 but the potted one looks like it has only one IC in it. I'll xray the one I have when I have a chance, using a small focal spot tube and mammography film produces images sharp enough to see the bonding wires in SC70 packages. Unfortunately the limiting factor is scanning the film into digital format.

author: zebity
author_rank: Contributor
timestamp: November 03, 2020, 04:39:45 am
content: Hi James_s & Co,I have taken off the top layer of original DS1742W-120 from one of my SGI machines.James is right the construction is substantially different, with harder further epoxy casing which is stamped with an Arrow and nomenclature (in reverse from casting) "M12C, 131, B".It is going to take a bit more digging to see the internals of this one...Here is picture of initial opening:EDIT: And now with top epoxy mostly removed (showing oscillator and battery):Cheers from Oz,zebity/jwhat/John.

author: james_s
author_rank: Super Contributor
timestamp: November 03, 2020, 06:15:36 am
content: Try heating the epoxy if you haven't already. I de-potted a number of HeNe laser power bricks using a heat gun and various scraping implements. Do it outside though or with plenty of ventilation because it stinks. I found that many potting compounds that are rock hard at room temperature become quite pliable when hot.

author: zebity
author_rank: Contributor
timestamp: November 06, 2020, 08:40:54 am
content: Hi James_s & others,yes thanks for tip on head gun, I used this for the second fake DS1742W-120+ de-pot and this one on DS1742W-120.Here is insides view:I cannot read the stamp on the contained IC as it is too faint.It looks like 2 x 16 contact surface mount.24 (exposed) + 2 (oscillator) + 2 (power) = 28 so 4 other contacts.I am sure I read somewhere what the internal IC chip was and it was also no longer available from Maxim like the DS1742W.I will so some further research on this.Cheers from Oz,zebity/jwhat/John.

author: james_s
author_rank: Super Contributor
timestamp: November 06, 2020, 06:48:21 pm
content: Not surprisingly, it looks exactly like the xray I took of one.In many cases the exact IC used in these was never sold separately, I did manage to get some for the larger part used in the TDS700 series scopes from a China seller but I have no idea where they got them.To read the number, try wiping it with a damp cloth, sometimes that helps. Also try shining light from various angles, it looks almost readable in the photo.

author: zebity
author_rank: Contributor
timestamp: November 07, 2020, 01:13:33 am
content: Hi James_s,I found this Maxim Real-Time Clocks SelectorGuidefrom June 2009 which still has the DS1742 as one of the "bytewide" available options (though is does indicate that PowerCap variation was made), but has no bare IC equivalent.So as you say the IC was likely never sold seperately.This leave option of:1. Refurbish existing chip2. Take out IC from existing chip and put on new board3. Backward compatible replacement design / build4. Build backward compatible replacement with larger NVRAM variation like DS1747 (as per youradaptor)Option (3) It would be interesting project to do as learning exercise in Digital electronics, but (1) is the low hanging fruit for most people who can now see both the physical and x-ray view of chip and should be able to drill their existing chips to keep host machines running.Cheers from Oz,zebity/jwhat/John

author: darkstar49
author_rank: Frequent Contributor
timestamp: November 12, 2020, 10:48:11 am
content: Can only confirm that the 'james_s' solution works like a charm... indeed maybe not the cheapest option, but given the number of problems a failing RTC can give with the TDS3000(B), I don't really understand the fuss... 70-80$ shouldn't be the point !https://www.eevblog.com/forum/repair/tds3014-adventures-(seeking-75-75mhz-oscillator)/msg2733286/#msg2733286

author: Rasz
author_rank: Super Contributor
timestamp: November 12, 2020, 04:48:34 pm
content: Quote from: darkstar49 on November 12, 2020, 10:48:11 amLets say you have a ~1970 car that sat in a barn for 30 years and carb is clogged. Do you buy a $80 rebuild carburetor, $15 carb kit or $10 gasket kit and just clean jets/float?The way I see it you are throwing away perfectly good part because battery ran out.

author: james_s
author_rank: Super Contributor
timestamp: November 12, 2020, 05:05:23 pm
content: Quote from: Rasz on November 12, 2020, 04:48:34 pmIf the carb is welded shut and I have to grind off the welds and mangle it to get it open and then goop it back together with JB Weld when I'm finished then I'd buy a new carb, one that is held together with screws that I can easily remove to service it the next time.I only made the adapter after I had a part fail such that replacing the battery did not fix it. I've hacked new batteries into Dallas chips many times, but it's always a hack, and the PowerCap package is easily serviced later, a significant improvement in my mind for what I see as a trivial amount of money.

author: Tantratron
author_rank: Frequent Contributor
timestamp: November 12, 2020, 05:32:04 pm
content: Quote from: james_s on November 12, 2020, 05:05:23 pmI'm bit lost here due to my non-native english speaking or not grasping 2nd message.What exactly do you recommend as a method solve the issue ?By the way, the same issue occurs in older tektronix, see this synthesishttps://www.eevblog.com/forum/repair/nvram-of-oscilloscope-tdsxxx-serie-c-and-d/so could it a universal new design chip with firmware able to accommodate different brands of DS or Maxim ?If we want to keep these legacy oscilloscope, the problem number one is these DALLAS nvrams potted battery so it would nice to have a plug&play board with ease to change battery and emulating the same RTC and memory function

author: james_s
author_rank: Super Contributor
timestamp: November 12, 2020, 06:19:03 pm
content: Quote from: Tantratron on November 12, 2020, 05:32:04 pmNew replacement using currently available parts, at least it works in TDS3000 scopes.https://github.com/james10952001/DS1744WP-to-DS1742W-adapterOr you can cut into the original Dallas brick and solder in a new battery, looks a bit messy but is not too hard to do and usually successful.

author: sicco
author_rank: Regular Contributor
timestamp: November 13, 2020, 11:08:26 pm
content: Happy to report that my plugin module for TDS3000 works OK now. This unit fits inside the Tektronix scope expansion connector (rear panel slot), and as a bonus you get the serial port with it as well. Micro USB and FTDI chip on board if you prefer that instead of legacy DB-9 serial ports. Or just TTL level serial for a FTDI-TTL 6 pin header adapter.Maxim/Dallas DS1744W module on this plug-in takes over the role of the DS1742W on the main board.Still needs a bit of patch wire soldering on the main board unfortunately: the DS1742W /CS pin, or D4 from the PowerPC XPC860DCZP, that I routed to pin 11 of the 100 pin expansion port connector. That is/was EXTCLK_in from the PowerPC CPU, but I stole it, and now use it as a spring board. That pin 11 used to go via a 100 ohms SMD to the PowerPC CPU, I unsoldered that resistor to free up this connector pin. Next, if you'd leave the old DS1742W on the main board, it needs to be silenced. Did that by pulling its /OE to its VCC, and cutting the PCB track that used to go to that /OE.It also can accommodate an ESP32 DevKit, and the WiFi web server as disclosed inhttps://www.eevblog.com/forum/testgear/reverse-engineering-tektronix-tds3gv-module-for-tds3000-series-oscilloscopes/msg3014688/#msg3014688works great, thank you stas_last!It also helped me upgrade my TDS3034 into a TDS3054, as perhttps://www.eevblog.com/forum/testgear/reverse-engineering-tektronix-tds3gv-module-for-tds3000-series-oscilloscopes/msg2748914/#msg2748914- thank you for that james_s - and thank you for the hint on DS1744W in the first place.This board could only be realised with the great guidence from pmercier c.s. as perhttps://hackaday.com/2020/07/18/reverse-engineering-teaches-an-old-scope-new-tricks/Only bit I could not get to work (yet) is the 10BaseT Ethernet port. I assumed in full ignorance that all that was needed was a PHY chip like the legacy MC68160 but looks like more is needed on the board - likely a ROM and possibly something for the MAC address maybe. Not too big a problem, as Ethernet on the TDS3000-b and beyond comes from the mainboard now, and -b will reject a plugin board that says it's TDS3EV. So let's not do that.Yes, this solution to the TDS3K RTC empty battery design flaw is obviously more expansive as the james_s patch board, but on the plus side this is much easier to retrofit I think - unless you're really good at desoldering 24 pin DIP modules from delicate multilayer boards. And you get the serial port. WiFi web server. USB serial. Unlock the 500 MHz bandwidth for free... Unless you had a serial module already of course.So no more end of life after 20 years for TDS3000. Another 100 years to go - well - for as long as you can get DS1744 clip-on batteries (which btw have easily accessible solderalbe battery tabs).Should I start a business selling these boards now?

author: james_s
author_rank: Super Contributor
timestamp: November 13, 2020, 11:29:10 pm
content: I have an original Tek ethernet module, I can open it up later and see what it has inside.

author: sicco
author_rank: Regular Contributor
timestamp: November 13, 2020, 11:35:24 pm
content: Wow. Yes please!

author: james_s
author_rank: Super Contributor
timestamp: November 16, 2020, 02:57:56 am
content: This is the board in a TDS-3EM module. As hypothesized there is a ROM in there. I don't really want to try desoldering it and I don't think I have an adapter to read that package with anyway. It may be possible to dump the contents onto a floppy or via GPIB.

author: sicco
author_rank: Regular Contributor
timestamp: November 16, 2020, 11:27:06 pm
content: Thank you james_s.Studied the hi-res pictures, almost done reverse engineering the tracks on both sides. A0 from mainboard skipped, A1-A19 on Tek mainboard to A0-A18 of the 16 databits bits wide 29AM008 flash ROM. Still in doubt a little bit on the /CS, /WE, /OE, BYTE/WORD lines for the 29AM008. Would you mind helping me confirm a few tracks where I’m not 100% sure yet? As in beep through from 100 pin connector to the 74LC245 and the 74LC08 chips? Like is it using CE1 or CE2, WE1 or WE2? HRST? And what code goes into the 74LC245 for board ID?No idea yet how to get the hex code. Assuming it is read only in normal use. Speculating the hex file can be read out via the 100 pin connector, and written back via the same route. But i doubt the Tek firmware will do any of that for us. So another project on the horizon, Flash rom copy tool...Will need reflashing anyway as only 20 years data retention is promised by the AMD datasheet

author: james_s
author_rank: Super Contributor
timestamp: November 17, 2020, 02:53:24 am
content: Yeah I can take it apart again and check a few things when I have a chance.I'm hoping that it lasts longer than 20 years in the real world, usually this stuff does. Actually this ethernet interface doesn't seem all that useful, I have a GPIB module I usually use instead and if I want to get screenshots off the scope I use the floppy drive.

author: sicco
author_rank: Regular Contributor
timestamp: November 17, 2020, 10:00:27 am
content: James_s, see pictures attached on where I'm not 100% sure yet. I intend to leave out the 74LC245 bufferes and the 74LC08.Can you beep through and check these assumptions:U170 pin 47 goes to VCC or GND or is it left floating?R100 left side goes to U170 pin 11? Or 12? Or elsewhere?U180 pin 15 goes to U150 pin 15 goes to U140 pin 5?U160 is just pass through buffer with pins 11, 12, 13 not used and 10, 5 and 1 to VCC (=14)? Pins 1 and 2 puzzle me here.U110 pin 1 goes to U170 pin 28? And to U140 pin 8? Or is it U170 pin 4 to to U160 pin 3?U140 pin 7 to U160 pin 2?U140 pin 11 to 100pins connector pin 66?U140 pin 12 to 100pins connector pin 81?U140 pin 13 to 100pins connector pin 79?U140 pin 14 to 100pins connector pin 78?U140 pin 15 to 100pins connector pin 76?U140 pin 16 to 100pins connector pin 74?

author: Finderbinder
author_rank: Regular Contributor
timestamp: December 25, 2020, 05:07:56 pm
content: Just did RTC battery mod/replacement on my TDS3012B without board removing:

author: sicco
author_rank: Regular Contributor
timestamp: December 29, 2020, 07:17:23 pm
content: Nice job Finderinder!I took my plugin board with the DS1744W RTC alternative another step further. Now have the Ethernet (for not -b and not -c models) TDS3EM emulation part working also. The flash eprom on a TDS3EM only has the MAC address in it as ASCII string. So no code for network stacks in there. Just 18 bytes for 00:01:02:03:04:05<null> if the MAC address is 00 01 02 03 04 05... What a waste of flash rom megabytes...Also found out the hard way that the NVRAM (so the DS1742W originally) does hold some Ethernet networking relevant parameters. And those do not get reset-to-good values with holding TRIG-B button at reboot time. Something related to network name and network type. Only loading the NVRAM with the 2kbyte data image as found elsewhere on this forum makes the TDS3EM (/equivalent) network work as advertised. A NVRAM with all zeros or all 0xff bytes does not work properly when ethernetworking! Like DHCP does not work if enabled - the scope goes into cyclic reboots.NB be aware that the scope as web page (e*Scope) only works on the -b and -c models. I used a NI how-to-ethernet-TDS3000 web page that Google hinted at - but that doesn't say it will not work for not -b not -c models...Enabling mechanism for the extensive self-test diagnostics second serial port output is clearer to me also now: the TENA line (pin 17 on 100 pins expansion port) needs a 4k7 pull down to GND. Looks like at boot-up, it's configured as input with weak pull-up, then sensed, and thereafter it becomes a network controller output instead of general purpose i/o pin. Also I noticed that on the original TDS3EM on TX (pin 15) there's a 47k pullup to +5V.Here's what it says on the diagnostics output (TTL serial, 38400,n,8,1, pin 13) when all works finally after reloading the RTC NVRAM with file (bin.bin is the RTC 2k binary data) attached:▒▒▒UUUUUUUUUUUUUUUUUUUULoading ImageBoot flash checksum OKCode flash checksum OK0x00800000 bytes of RAM foundDRAM address line check OKDRAM data line check OKNVRAM address line check OKNVRAM data line check OKTBC ACQ SRAM address line check OKTBC ACQ SRAM data line check OKTBC Display SRAM address line check OKTBC Display SRAM data line check OKSuperI/O ID 0x000000b2Uncompressing code from 0xffc40010 size 0x001e0927Enabling cacheEntering usrRootEnabling the MMUsysClkRateSet using 25 MHzEnabling I/O systemexcInit calledClass 17 Level 3 hwResetTBC(): Installing Machine Check Exception handler. 15:17:52 12/29/2020 (thread: StartUp)Class 7 Level 3 hwI2CAppKeySearch: new device I2C/APPKEY1 slot 1 addr 0xa015:17:52 12/29/2020 (thread: StartUp)Class 7 Level 3 hwI2CAppKeySearch: new device I2C/APPKEY2 slot 2 addr 0xa215:17:52 12/29/2020 (thread: StartUp)TBC reset count = 2Class 2 Level 3 acqWaitForAcqDone: timed out, sysjmp = 0x515:17:54 12/29/2020 (thread: StartUp)Attaching network interface qu0... done.Attaching network interface lo0... done.NFS client support not included.Starting VXI-11 service...Core channel...Abort channel...ready.Other achievement: can now do a 'no soldering - no main board patch wires' RTC expansion port plug-in module. For that I edited the boot rom code so that CS2 for the NVRAM-RTC at 0x02800000 becomes CS5, and CS5 at 0x05000000 becomes CS2. The nice thing was that the boot rom checksum remains the same despite the edits.The plugin module RTC DS1744 then uses CE1, pin 78. But then we cannot have the TDS3EM Ethernet module emulation because that needs CE1 for its flash rom... Also it appears that once plugin modules are detected at boot-up time, some application code rewrites the PowerPC MMU glue-less registers again, so redefines CS2 and CS5 and then we're lost again. But still, it is possible to do a no-soldering expansion port DS1742W-dead battery to DS1744W-another-10-years, without even opening up the TDS3000 scope! However, on the downside, you do need a BDM interface like the Abatron BDI2000 that I used here.Plus: I have started to offer these "DS1744W-another-10-years" plugin boards on eBay now. So serial, isolated, USB, ESP32-WiFi, ESP32-Bluetooth, RS232, Ethernet - and a 10 pins BDM header (in he next revision).

author: friendtogeoff
author_rank: Newbie
timestamp: February 02, 2021, 12:37:27 pm
content: Wow, really nice piece of work @sicco.I'm interested in getting one of these to put into a TDS3054 (not B or C) as an alternative to buying a TDS3EM from the sharks. Any hints on where to find the eBay offer?

author: sicco
author_rank: Regular Contributor
timestamp: February 02, 2021, 12:52:04 pm
content: I have two that are fully populated and tested, as per picture.Looks like my eBay ad for them from ~November has disappeared, but happy to sell and ship directly to you.150 EUR for one, plus 20 EUR shipping to a UK address. Not sure what customs duty get added for you post Brexit, but obviously that for you to settle.Paypal should work, IBAN maybe even better.Share your shipping address etc via direct message please (instead of full forum post).Warm regards, Sicco.

author: sicco
author_rank: Regular Contributor
timestamp: February 02, 2021, 01:03:28 pm
content: PS just noticed that on the picture I just made, there was a board plugged in that does not have Ethernet (TDS3EM emulation), but the two units in front of the scope will give you Ethernet as in:

author: cuebus
author_rank: Unknown
timestamp: April 18, 2021, 12:47:39 am
content: Hi all,I decided to definitively figure out how these DS1742Ws are constructed so I softened the epoxy on the one I desoldered from my scope and got to work.Turns out, unlike the DS1486 that I reverse engineered last year, this one uses a single chip solution. Both the RTC and RAM are on the same die. This part is a TSOP-1 32 pin part marked Dallas DS1743E-3 (the 3 is the voltage designator, there is also a DS1743E-5 for 5V chips). As you can expect it's the same part used in the DS1743W, which is 8 x 8k, just 2 address pins are unused, similar to james_s' adapter board solution.Battery used is smaller- just a BR1225 coming in at 48mAh. One may think this is an issue but I measured the current draw in data retention mode to be only 300nA, giving it a lifetime of 18 years unpowered.My scope is from 2000 and has 50,000 hours on it, so not counting self discharge, my original chip would have had a life of about 4 years left still unpowered.Pinout of the TSOP is close but not the same as JEDEC standard since naturally there need to be some pins there for the RTC xtal and battery inputs.If you can acquire a DS1743WP PowerCap (some available on eBay), you can do what I did and remove that chip (it's the same one) and solder it onto a PCB made to copy the DS1743W layout. I attached the gerbers of the layout I made.The chip on the powercap is tacked with adhesive on 4 edges, but they are right on the edge of the chip so can be relatively easily cut away with a knife. As long as you get most of it off you'll have no issue removing the chip.You only need 2 other parts, a crystal, and a battery.I used the same crystal as for my DS1486 project, CMR200T32768DZBTI don't know the load capacitance required by this one but I've had it running several days in my scope now and it's still exactly on spec with another clock.Battery for my board is BR-1225/H1AN. As stated, you'll get 18 years minimum use with this.Altogether it makes for a nice compact replica, and fits like a glove.Cheers,Robin

author: james_s
author_rank: Super Contributor
timestamp: April 18, 2021, 02:55:24 am
content: Well that fits what I could see in the xray picture of mine. Interesting that the IC is a DS1743.

author: zebity
author_rank: Contributor
timestamp: March 09, 2022, 10:30:26 pm
content: Hi James_s and others,happy to report that this nut has been cracked, not once but twice, by SGI community.see this post on IRIX Network for drop in replacement by cz7asm with working clock and nvram:https://forums.irixnet.org/thread-3360.htmlAnd these post on SGI User Group:By cz7asm:https://forums.sgi.sh/index.php?threads/ds1742-nvram-chip-replacement.702/And Glitchworks prototype:https://forums.sgi.sh/index.php?threads/dallas-ds1742w-replacement.707/I read the cuebus post, but it is not clear to me if this provides both RTC and NVRAM solution. If so then that gives three replacement options…I have personally tested the cz7asm version, in SGI O350 (I am jwhat on IRIX Network) and confirmed it works like a charm. It has also been verified in SGI Fuel.I have no affiliation with either cz7asm or Glitchworks, I am just another person who was doing drilling and investigation to see if a replacement solution could be found.It would be good to know if the replacement options also worked in other equipment.Cheers from Oz,zebity (jwhat/John)

author: cz7asm
author_rank: Newbie
timestamp: March 10, 2022, 10:21:26 am
content: Hi, if anyone is interested I have the DS1742W replacement available on ebay -https://www.ebay.com/itm/284766293220Thank you zebity/John for spreading the word.

author: james_s
author_rank: Super Contributor
timestamp: March 16, 2022, 07:37:34 pm
content: Looks good. I'm curious, what IC did you base it on? Did you have to find a source of Dallas custom ICs or did you come up with a modern solution using current production parts?

author: zebity
author_rank: Contributor
timestamp: May 03, 2022, 05:48:26 am
content: Hi James_s,looking at it, it looks like it is DS1558D based,So I presume to get this to behave the same as DS1742 you just have to hold the lower of the additional address lines (A0-A8 ?) high to make sure the RTC Clock addressing is mapped correctly.As DS1742 has A0 - A10 and DS1558D has A0-A18 (so additional 8 address lines).So not serial to parallel conversion.Cheers from Oz,zebity

author: Dave Wise
author_rank: Regular Contributor
timestamp: May 03, 2022, 04:07:11 pm
content: Marked "DS1558D" is DS1558W which is 3.3V. Its additional address lines are A11-A18. It has eight extra registers you want to avoid, at 7FFF0-7FFF7. Hold A11-A18 high except tie at least one to A3 so xx8-xxF hit the top bank while xx0-xx7 go elsewhere. BF (Battery Flag) is not defined, but I don't think Tek cares. Everything else is compatible AFAICT.I will certainly want one sometime for my TDS3054B which retains data but the clock stops.

author: Dave Wise
author_rank: Regular Contributor
timestamp: May 10, 2022, 11:48:52 pm
content: And... GlitchWorks has developed the GW-1742W-1. He's selling it athttps://www.tindie.com/products/glitchwrks/glitch-works-gw-1742w-1-dallas-ds1742w-replacement/. He's willing to program parts but he doesn't know the TDS3000 format, we'll have to send a dump.I have a Needhams EMP-300 programmer. I suspect I can read a DS1742W by calling it a 2716 eprom.

author: Dave Wise
author_rank: Regular Contributor
timestamp: July 22, 2022, 03:09:36 pm
content: GlitchWorks GW-1742W-1 was out of stock, now available again on Tindie. I'll reserve one but I'm not ready, I'm using the scope and don't want to take it down.GW warned me off treating as 2716 EPROM:QuoteSince my EMP-300 supports DS1220, that's what I'll set it for when I read my DS1742W.

author: james_s
author_rank: Super Contributor
timestamp: July 23, 2022, 12:15:32 am
content: You can read them easily enough but writing them is where problems tend to crop up. I forget exactly what I ran into but I ended up wiring up some switches and LEDs (actually I used a FPGA dev board but only because I happened to have one) and manually programmed the needed bytes and configuration bits by hand.

author: bschwand
author_rank: Contributor
timestamp: November 17, 2022, 11:08:45 am
content: Quote from: james_s on March 21, 2020, 12:51:43 amIs it possible to directly use that module in a Tek3034B or does it have to be programmed first ?

author: YetAnotherTechie
author_rank: Regular Contributor
timestamp: November 17, 2022, 01:59:06 pm
content: On "B" models you will need to write the MAC address back on the ram, or the network will not work.

author: bschwand
author_rank: Contributor
timestamp: November 17, 2022, 02:11:15 pm
content: ok, is there an nvram dump for the 3034B available somewhere, I am searching the forums and have not found anything so far, just that the MAC is somewhere in the beginning of the nvram.

author: button.ch
author_rank: Contributor
timestamp: August 28, 2024, 10:45:26 am
content: Hi~ sicoo ！I only have one TDS3032 and I am interested in your second life plug-in rev 2. Can you share its PCB diagram data? Looking forward to seeing replies on the forum frequently! Wishing you all the best!

author: sicco
author_rank: Regular Contributor
timestamp: August 28, 2024, 01:17:24 pm
content: Seehttps://www.eevblog.com/forum/testgear/tds-1000-2000-3000-bw-hack/msg5436188/#msg5436188for schematics and PCB (in KiCAD zip archive).And onhttps://www.eevblog.com/forum/repair/tds3014-adventures-(seeking-75-75mhz-oscillator)/msg5508388/#msg5508388there's the most recent PC software version.

author: daisizhou
author_rank: Super Contributor
timestamp: August 28, 2024, 10:13:11 pm
content: Hi~ sicoo ！Did you know that there is a corresponding PCB or open source PCB file for DS1644-120?

author: button.ch
author_rank: Contributor
timestamp: August 29, 2024, 01:14:54 am
content: Hello sicoo, I found that there is no PCB file for plug-in rev 2 in the tds3000-xpc. zip compressed file. I just want a simpler version, not one that integrates the CPU, as described in your "TDS3K Second Life plug-in rev 4. pdf". thank you!

author: sicco
author_rank: Regular Contributor
timestamp: August 29, 2024, 08:35:58 am
content: If you leave out on this "rev. 4" board the XPC860 BGA IC 4, IC 5, X1, U3, the flash roms IC7, 8, the RAM IC 9, so populate as in the picture in the "Reply #164 on: April 07, 2024, 02:15:09 pm post", then you have just what you ask for.