Keyboard Shortcuts
ctrl + shift + ? :
Show all keyboard shortcuts
ctrl + g :
Navigate to a group
ctrl + shift + f :
Find
ctrl + / :
Quick actions
esc to dismiss
Likes
Search
Make a backup of your TDS5xx/6xx/7xx memories
|
Hello,
Here's how to do it: - Compile the code below (you know what to change in the code for various memories) - Get your NI GPIB adapter and attach it to the scope - Put NVRAM protection switch (S1002) to forward position - Turn the scope on - Run the PC program Hopefully the result of this is loads and loads of firmware and NVRAM backups uploaded somewhere safe like ko4bb-site. Have fun. ... #include <windows.h> #include <stdio.h> #include <stdlib.h> #include "ni488.h" void GpibError(const char * msg); /* Error function declaration */ int Device = 0; /* Device unit descriptor */ int BoardIndex = 0; /* Interface Index (GPIB0=0,GPIB1=1,etc.) */ int main(int argc, char *argv[]) { FILE *outfile; int f; unsigned long addr, straddr, endaddr, data; unsigned short lenght; unsigned char checksum; unsigned char str[0x100]; int PrimaryAddress = 29; /* Primary address of the device */ int SecondaryAddress = 0x7E; /* Secondary address of the device */ unsigned char Buffer1[0x500]; /* Read buffer */ Device = ibdev( /* Create a unit descriptor handle */ BoardIndex, /* Board Index (GPIB0 = 0, GPIB1 = 1, ...) */ PrimaryAddress, /* Device primary address */ SecondaryAddress, /* Device secondary address */ T3s, /* Timeout setting (T10s = 10 seconds) */ 1, /* Assert EOI line at end of write */ 0); /* EOS termination mode */ if (ibsta & ERR) { /* Check for GPIB Error */ GpibError("ibdev Error"); } ibclr(Device); /* Clear the device */ if (ibsta & ERR) { GpibError("ibclr Error"); } /* Attempt to read TDS544A flash ROM contents */ outfile = fopen("KRNLdump.bin","wb"); printf("\n"); // straddr = 0x01000000L; /* Start of flash ROM */ // endaddr = 0x01FFFFFFL; /* End of flash ROM */ // straddr = 0x04000000L; /* Start of TDS544A NVRAM */ // endaddr = 0x0407FFFFL; /* End of TDS544A NVRAM */ straddr = 0x00000000L; /* Start of Kernel ROM */ endaddr = 0x0003FFFFL; /* End of Kernel ROM */ addr = straddr; do { /* Read memory message */ str[0] = 'm'; /* m - read memory command */ str[1] = 0x00; /* checksum - fill later */ str[2] = 0x00; /* message lenght MSB */ str[3] = 0x08; /* message lenght LSB */ str[4] = (unsigned char)(addr >> 24 & 0xFF); str[5] = (unsigned char)(addr >> 16 & 0xFF); str[6] = (unsigned char)(addr >> 8 & 0xFF); str[7] = (unsigned char)(addr & 0xFF); str[8] = 0x00; /* data lenght - try 16 bytes first */ str[9] = 0x00; str[10] = 0x04; str[11] = 0x00; checksum = str[0] + str[2] + str[3]; for(f = 4; f < 12; f++) checksum += str[f]; str[1] = (unsigned char) checksum; //printf("\nSending:\n"); //for(f = 0; f < 12; f++) printf("%02X ", str[f]); ibwrt(Device, str, 12); /* Send */ if (ibsta & ERR) GpibError("ibwrt Error"); /* Read Acknowledge (plus-sign msg) */ ibrd(Device, Buffer1, 1); /* Read up to x bytes from the device */ if (ibsta & ERR) GpibError("ibrd Error"); //printf("\nAck reveiced:\n"); //for(f = 0; f < 1; f++) printf("%02X ", Buffer1[f]); /* Read reply message */ ibrd(Device, Buffer1, 0x404); /* Read up to x bytes from the device */ if (ibsta & ERR) GpibError("ibrd Error"); //printf("\nReceived:\n"); //for(f = 0; f < 0x404; f++) printf("%02X ", Buffer1[f]); /* Save buffer contents */ for(f = 4; f < 0x404; f++) { fputc(Buffer1[f], outfile); } /* Send Acknowledgement (plus-sign msg) */ str[0] = '+'; ibwrt(Device, str, 1); /* Send */ if (ibsta & ERR) GpibError("ibwrt Error"); addr += 0x400; } while(addr <= endaddr); fclose(outfile); ibonl(Device, 0); /* Take the device offline */ if (ibsta & ERR) GpibError("ibonl Error"); system("PAUSE"); } void GpibError(const char *msg) { printf("%s\n", msg); printf("ibsta = 0x%x <", ibsta); if (ibsta & ERR ) printf(" ERR"); if (ibsta & TIMO) printf(" TIMO"); if (ibsta & END ) printf(" END"); if (ibsta & SRQI) printf(" SRQI"); if (ibsta & RQS ) printf(" RQS"); if (ibsta & CMPL) printf(" CMPL"); if (ibsta & LOK ) printf(" LOK"); if (ibsta & REM ) printf(" REM"); if (ibsta & CIC ) printf(" CIC"); if (ibsta & ATN ) printf(" ATN"); if (ibsta & TACS) printf(" TACS"); if (ibsta & LACS) printf(" LACS"); if (ibsta & DTAS) printf(" DTAS"); if (ibsta & DCAS) printf(" DCAS"); printf (" >\n"); printf ("Iberr() = %d", iberr); if (iberr == EDVR) printf(" EDVR <Driver error>\n"); if (iberr == ECIC) printf(" ECIC <Not Controller-In-Charge>\n"); if (iberr == ENOL) printf(" ENOL <No Listener>\n"); if (iberr == EADR) printf(" EADR <Address error>\n"); if (iberr == EARG) printf(" EARG <Invalid argument>\n"); if (iberr == ESAC) printf(" ESAC <Not System Controller>\n"); if (iberr == EABO) printf(" EABO <Operation aborted>\n"); if (iberr == ENEB) printf(" ENEB <No GPIB board>\n"); if (iberr == EOIP) printf(" EOIP <Async I/O in progress>\n"); if (iberr == ECAP) printf(" ECAP <No capability>\n"); if (iberr == EFSO) printf(" EFSO <File system error>\n"); if (iberr == EBUS) printf(" EBUS <Command error>\n"); if (iberr == ESTB) printf(" ESTB <Status byte lost>\n"); if (iberr == ESRQ) printf(" ESRQ <SRQ stuck on>\n"); if (iberr == ETAB) printf(" ETAB <Table Overflow>\n"); if (iberr == ELCK) printf(" ELCK <Lock error>\n"); if (iberr == EARM) printf(" EARM <Ibnotify rearm error>\n"); if (iberr == EHDL) printf(" EHDL <Invalid Handle>\n"); if (iberr == EWIP) printf(" EWIP <Wait already in progress>\n"); if (iberr == ERST) printf(" ERST <Notification cancelled due to reset>\n"); if (iberr == EPWR) printf(" EPWR <Power error>\n"); printf("Ibcnt() = %u\n", ibcnt); printf("\n"); /* Call ibonl to take the device and interface offline */ //ibonl(Device, 0); //system("PAUSE"); //exit(1); } |
|
Hello,
toggle quoted message
Show quoted text
Only now I saw your code! I would have spared desoldering and resoldering 12 eeprom! However, with my eprom programmer, as well as read all the eeprom, I also refreshed rewriting them. Although the firmware of my TDS524A is not much recently I put it on KO4BB's site. Now I have 2 TDS544A in repair and I will use your code to backup the firmware. You also know how to do the firmware restore? Regards --- In TekScopes@..., "nukescope" <vtp@...> wrote:
|
|
--- In TekScopes@..., "nukescope" <vtp@...> wrote:
btw, where you found the "m" command ? |
|
--- In TekScopes@..., "nukescope" <vtp@...> wrote:
hmm, my first reply was not posted properly, so let's try again. I've tested your code on TDS754A (fw 4.1e), unfortunately it didn't worked for me. First of all, when the S1002 is in unprotected position TDS7xx is no booting, this seems to be the typical case. While with "protected" position the "m" command you using is not getting any proper data from TDS. To double check the results/error, i've edited the code to check the IDN, which was working, so there is no issue with my setup. On TDS7xx seems to be a hidden unlock, so i've changed your code to send PASSWORD PITBULL, but still the "m" command buffer contains bad data instead of ROM/NVRAM content. |
|
jlachmann2001
Hi,
toggle quoted message
Show quoted text
I had exactly the same experience with my TDS684a, however, I finally understood what happened and succeeded to backup my RAM & ROM: In the unprotected mode, my scope doesn't boot either, however, it enters some kind of monitor mode where it responds to a fixed GPIB address (as used in the original code) and correctly replies to the "m" command. Regards, ´³¨¹°ù²µ±ð²Ô --- In TekScopes@..., "suzuatama" <suzuatama@...> wrote:
|
|
Hi ´³¨¹°ù²µ±ð²Ô,
toggle quoted message
Show quoted text
indeed, with unchanged code it seems to work, for me at least partialy. The address increments properly but the data seems to stay unchanged, after each every 0x400 again the same buffer. I've made backup before with EPROM burner, so can compare results. regards T. --- In TekScopes@..., "jlachmann2001" <j.lachmann@...> wrote:
|
|
Hello,
- Get your NI GPIB adapter and attach it to the scopeOh FFS, what is so difficult about following these instructions? I have got all kind of correspondence where people have tried to "fix" the code provided by letting their scopes boot up fully, or altering the GPIB address or whatever. The code works by communicating with the kernel ROM and with the KERNEL ROM ONLY as made sure by the S1002 instruction above! And that is where the 'm' command resides along with others that let upload and execute code to the kernel RAM (obviously for use with secondary bootloader in order to rewrite flash contents) or simply write to memory if needed (useful for rewriting the NVRAM contents) and so on. |
|
got it, it seems to be Agilent 488 mode issue.
toggle quoted message
Show quoted text
Not sure if it's only issue on my computer, with my adapter, with my drivers or a general issue. However, i've compiled for MSDOS and PCII/A adapter and it worked. --- In TekScopes@..., "suzuatama" <suzuatama@...> wrote:
|
|
a single line of text like
toggle quoted message
Show quoted text
/* don't change the next 2 lines, 29,0x7E is special hard-wired debug address */ would make the difference and save your time, anyway. Regards the "NVRAM" backup, in the TDS700A Field Adjustment Software the address of NVRAM is 67108880, which is 0x04000010L. However, this didn't made sense for me so i've tried the TDS544A address space (0x04000000L to 0x0407FFFFL). I've compared the resulting NVRAM dump with the one i made before with EPROM burner, but they are completly different. In the "TDS 520B Mod CM Component Service Manual" the NVRAM address space is however defined as 0x04000000L to 0x040FFFFFL, so i thought "why not try the second part from 0x0407FFFFL to 0x040FFFFFL". This time the resulting dump is matching the one i've made before with EPROM burner (and as this dump was already restored to replacement NVRAM, and the TDS works, i assume that it was ok). I would say, at least for TDS754A fw 4.1e, it make sense to backup both NVRAM spaces. --- In TekScopes@..., "nukescope" <vtp@...> wrote:
|
|
oh well ... it's all on the schematic.
toggle quoted message
Show quoted text
On TDS754A the address space 0x04000000L to 0x040FFFFFL is DS1486 and 0x0407FFFFL to 0x040FFFFFL is NVRAM DS1650/DS1250. --- In TekScopes@..., "suzuatama" <suzuatama@...> wrote:
|
|
Hello,
--- In TekScopes@..., "suzuatama" <suzuatama@...> wrote: got it, it seems to be Agilent 488 mode issue. I used devcpp to compile the code, it's good for small things like this and very easy to set up. NI library "gpib-32.obj" needs to be linked with the compiled code. The adapter I used is NI GPIB-USB-HS, OS is winXP. I guess it can be ported to other adapters as long as the GPIB settings (addresses, EOI and EOS) stay. Glad you got it working though. |
|
You all may be interested to know that an Ebay seller of "Tektronix battery modules" has a list of models which (according to Tek, he says) do not store cal constants in either the NVRAM or the RTC/NVRAM, hence no danger of losing cal with chip replacements. Interesting stuff I have not had time to verify.
toggle quoted message
Show quoted text
Den --- In TekScopes@..., "nukescope" <vtp@...> wrote:
|
|
I saw the auction but his statements are contradictory.
toggle quoted message
Show quoted text
He does have a list of scopes that he claims do not keep calibration information in the NVRAMs and he says there is no need to save the contents when swapping the new NVRAMs in. Then why this statement? "THE BATTERIES WEAR OUT and cause your oscilloscope not to function properly" If there is no need to save the contents of the NVRAMs when swapping why even bother swapping them, and why would the scope not function properly when the batteries are dead? --Victor --- In TekScopes@..., "denyhstk" <denyhstk@...> wrote:
|
|
Some oscilloscopes like the 2232 and I would guess the 2224 and 2221A
do not store any calibration information in their NVRAM but do store the oscilloscope's configuration there. If the backup battery dies, then the oscilloscope will loose its configuration settings and report a CMOS error on startup. That can be mildly annoying but in all other respects the oscilloscope will work fine. On Wed, 10 Oct 2012 04:03:59 -0000, "victor_j_silva" <daejon1@...> wrote: I saw the auction but his statements are contradictory. |
|
In the auction the seller does his job trying to sell his merchandise.
toggle quoted message
Show quoted text
If the data in NVRAM are lost you can always resort to a friend with the proper tools for the calibration of the instrument (the options need some more tricks). The real problem is the firmware on the 12 EEPROM. They now have 19 years old and the producers guarantee retention of the data 10 years or more but are only statistical data. If we do not refresh the firmware, probably in a short time these scopes will not longer make the boot. Therefore I share the idea of Nukescope to make a backup and a database of the firmware. --- In TekScopes@..., "denyhstk" <denyhstk@...> wrote:
|
|
Interesting, it certainly is possible if the newer scopes have a sectored 5V flash. These scopes are old enough not to have a read-while-write type of flash so there is either another flash for the cal data or during calibration the code runs on SRAM. My old TDS544A definitely had a 12V erase/pgm bulk block flashes and stores calibration information in NVRAM. IIRC, the NVRAM was DS1650 for which TI BQ4015 should work also but be a lot cheaper than the Dallas part.
toggle quoted message
Show quoted text
Regarding the NVRAM, I had trouble reading it in a programmer so that was my primary reason for digging up the GPIB memory read commands and protocol. Make good use of the code, I spent a lot of time decompiling the kernel ROM in order to find out everything necessary. The flashes in my TDS544A were AM28F010 which tend to keep their contents very well, actually so well that they are difficult to erase after 20 years of use (in another application). But still, backing all the stuff up would be good. Maybe sometime someone (or me) even writes a secondary bootloader so we can rewrite the flashes. -NS PS. I like the sellers associated risk list, particularly item #3. --- In TekScopes@..., "denyhstk" <denyhstk@...> wrote:
You all may be interested to know that an Ebay seller of "Tektronix battery modules" has a list of models which (according to Tek, he says) do not store cal constants in either the NVRAM or the RTC/NVRAM, hence no danger of losing cal with chip replacements. Interesting stuff I have not had time to verify. |
|
I'm amazed at the life of these Dallas parts (16 years or more?). I designed in a number of Dallas parts in the 1990 timeframe. They started to lose data retention about 7 to 8 years later.
toggle quoted message
Show quoted text
The difference has to be in the environment. We were building telecom test equipment, used indoors and out, and frequently left to die for long periods of time. The Tek scopes on the other hand, may have frequently been left on in an indoor environment. I'm convinced that internal leakage in the switch / logic probably keeps the batteries "topped off" (I know, they are lithium). Others have voiced this theory in the past. So, if you want good batteries, buy a scope with a dim CRT ;) Den --- In TekScopes@..., "nukescope" <vtp@...> wrote:
|
|
I'm new to these scopes, but have lots of programming/debugging experience.
toggle quoted message
Show quoted text
This program works fine with my TDS784C. I just got kernel file created. Scope has to be off when protection switch is moved to the front. Turning scope on puts in on GPIB:29 in that special mode where "m" command works. After that it's straight forward. How do I put file on ko4bb site? My scope is fine, but stuck in running Vref calibration. I wonder if I can cancel that calibration without actually redoing it (Looks like it is major pain). Nukescope, you did look at disassembled code. Any ideas on how to clear Vref running state? Thanks! --- In TekScopes@..., "suzuatama" <suzuatama@...> wrote:
|
David Hess
to navigate to use esc to dismiss