Reverse engineer Dallas DS1742W?

[MarkL]

Here's another post comparing a real DS1742W to a fake:

  https://www.eevblog.com/forum/repair/repair-of-tek-tds3014b-need-a-source-for-a-ds1742w-nvram/msg2644260/#msg2644260

And a couple of posts after that one, some photos after I cut into the fake.  The internals look the same as the one zebity posted.

[darkstar49]

Here's another post comparing a real DS1742W to a fake:

  https://www.eevblog.com/forum/repair/repair-of-tek-tds3014b-need-a-source-for-a-ds1742w-nvram/msg2644260/#msg2644260

And a couple of posts after that one, some photos after I cut into the fake.  The internals look the same as the one zebity posted.

Is there any technique to check whether a replica/fake DS1742W is functional or not ? What's the culprit with these chinese clones ?
I got one here that I suspect to be a clone, but my programmer is happy with it so far... (although I guess that's not the part that causes trouble...?)

 

[james_s]

Well, like I mentioned, mine all had different faults. The only definitive test is to try one in the actual application where it will be used, and even then you don't know how long it will last. My experience suggests that it's mostly a case of just poor build quality using low quality parts. The IC they use might be ok but a cheap battery or a source of electrical leakage (flux residue? leaky decoupling cap? diode leakage?) cause it to discharge.

[MarkL]

For clones that aren't downright dead, my pet theory is that the RTC part of the clone chip is drawing way too much current and drains the battery in a matter of maybe months to a year or two.

So it can be programmed normally and will retain the data, and it will keep time.  But only for a while.  Apparently long enough for people to be fooled and leave good feedback.

[zebity]

Hi James_s & others,

I agree 100% that people selling chips that don't work is essentially stealing people's money and more importantly wasting their time.

There is only one thing that is important to me and that is whether the chip works or not...

It is easy to verify if the chip works using the "XGecu TL866" programmer.

The programmer comes with a bunch of pre-existing profiles and the one to use for DS1742W is the DS1220 profile, which has the same NVRAM specs as the DS1742W but without the RTC chip.

As the purpose of this thread is about "reverse engineering", I am now going to open up a "genuine" DS1742W-120 and post the outcome of that investigation.

While x-rays are useful they do not provide level of info required to complete reverse engineering work.

I will likely not get this done until weekend but will re-post once completed.

Thanks for all the helpful feedback and information.

Cheers from Oz,

zebity/jwhat/John.

[james_s]

It's always interesting to open up a potted assembly to see inside. We already know exactly what's in there though, the PowerCap versions of the Dallas ICs are made with the same parts and are not potted. In the case of the DS1744 there's a SRAM, a Dallas RTC ASIC, a 32kHz crystal and a coin cell.  I don't have a PowerCap version of the DS1742 but the potted one looks like it has only one IC in it. I'll xray the one I have when I have a chance, using a small focal spot tube and mammography film produces images sharp enough to see the bonding wires in SC70 packages. Unfortunately the limiting factor is scanning the film into digital format.

[zebity]

Hi James_s & Co,

I have taken off the top layer of original DS1742W-120 from one of my SGI machines.

James is right the construction is substantially different, with harder further epoxy casing which is stamped with an Arrow and nomenclature (in reverse from casting) "M12C, 131, B".

It is going to take a bit more digging to see the internals of this one...

Here is picture of initial opening:



EDIT: And now with top epoxy mostly removed (showing oscillator and battery):



Cheers from Oz,

zebity/jwhat/John.

[james_s]

Try heating the epoxy if you haven't already. I de-potted a number of HeNe laser power bricks using a heat gun and various scraping implements. Do it outside though or with plenty of ventilation because it stinks. I found that many potting compounds that are rock hard at room temperature become quite pliable when hot.

[zebity]

Hi James_s & others,

yes thanks for tip on head gun, I used this for the second fake DS1742W-120+ de-pot and this one on DS1742W-120.

Here is insides view:



I cannot read the stamp on the contained IC as it is too faint.

It looks like 2 x 16 contact surface mount.

24 (exposed) + 2 (oscillator) + 2 (power) = 28 so 4 other contacts.

I am sure I read somewhere what the internal IC chip was and it was also no longer available from Maxim like the DS1742W.

I will so some further research on this.

Cheers from Oz,


zebity/jwhat/John.

[james_s]

Not surprisingly, it looks exactly like the xray I took of one.

In many cases the exact IC used in these was never sold separately, I did manage to get some for the larger part used in the TDS700 series scopes from a China seller but I have no idea where they got them.

To read the number, try wiping it with a damp cloth, sometimes that helps. Also try shining light from various angles, it looks almost readable in the photo.

[zebity]

Hi James_s,

I found this Maxim Real-Time Clocks Selector Guide from June 2009 which still has the DS1742 as one of the "bytewide" available options (though is does indicate that PowerCap variation was made), but has no bare IC equivalent.

So as you say the IC was likely never sold seperately.

This leave option of:

1. Refurbish existing chip
2. Take out IC from existing chip and put on new board
3. Backward compatible replacement design / build
4. Build backward compatible replacement with larger NVRAM variation like DS1747 (as per your adaptor)

Option (3) It would be interesting project to do as learning exercise in Digital electronics, but (1) is the low hanging fruit for most people who can now see both the physical and x-ray view of chip and should be able to drill their existing chips to keep host machines running.

Cheers from Oz,

zebity/jwhat/John

[darkstar49]

Can only confirm that the 'james_s' solution works like a charm... indeed maybe not the cheapest option, but given the number of problems a failing RTC can give with the TDS3000(B), I don't really understand the fuss... 70-80$ shouldn't be the point !

https://www.eevblog.com/forum/repair/tds3014-adventures-(seeking-75-75mhz-oscillator)/msg2733286/#msg2733286

[Rasz]

RTC can give with the TDS3000(B), I don't really understand the fuss... 70-80$ shouldn't be the point !

Lets say you have a ~1970 car that sat in a barn for 30 years and carb is clogged. Do you buy a $80 rebuild carburetor, $15 carb kit or $10 gasket kit and just clean jets/float?
The way I see it you are throwing away perfectly good part because battery ran out.

[james_s]

Lets say you have a ~1970 car that sat in a barn for 30 years and carb is clogged. Do you buy a $80 rebuild carburetor, $15 carb kit or $10 gasket kit and just clean jets/float?
The way I see it you are throwing away perfectly good part because battery ran out.

If the carb is welded shut and I have to grind off the welds and mangle it to get it open and then goop it back together with JB Weld when I'm finished then I'd buy a new carb, one that is held together with screws that I can easily remove to service it the next time.

I only made the adapter after I had a part fail such that replacing the battery did not fix it. I've hacked new batteries into Dallas chips many times, but it's always a hack, and the PowerCap package is easily serviced later, a significant improvement in my mind for what I see as a trivial amount of money.

[Tantratron]

Lets say you have a ~1970 car that sat in a barn for 30 years and carb is clogged. Do you buy a $80 rebuild carburetor, $15 carb kit or $10 gasket kit and just clean jets/float?
The way I see it you are throwing away perfectly good part because battery ran out.

If the carb is welded shut and I have to grind off the welds and mangle it to get it open and then goop it back together with JB Weld when I'm finished then I'd buy a new carb, one that is held together with screws that I can easily remove to service it the next time.

I only made the adapter after I had a part fail such that replacing the battery did not fix it. I've hacked new batteries into Dallas chips many times, but it's always a hack, and the PowerCap package is easily serviced later, a significant improvement in my mind for what I see as a trivial amount of money.

I'm bit lost here due to my non-native english speaking or not grasping 2nd message.

What exactly do you recommend as a method solve the issue ?

By the way, the same issue occurs in older tektronix, see this synthesis https://www.eevblog.com/forum/repair/nvram-of-oscilloscope-tdsxxx-serie-c-and-d/ so could it a universal new design chip with firmware able to accommodate different brands of DS or Maxim ?

If we want to keep these legacy oscilloscope, the problem number one is these DALLAS nvrams potted battery so it would nice to have a plug&play board with ease to change battery and emulating the same RTC and memory function

[james_s]

I'm bit lost here due to my non-native english speaking or not grasping 2nd message.

What exactly do you recommend as a method solve the issue ?

By the way, the same issue occurs in older tektronix, see this synthesis https://www.eevblog.com/forum/repair/nvram-of-oscilloscope-tdsxxx-serie-c-and-d/ so could it a universal new design chip with firmware able to accommodate different brands of DS or Maxim ?

If we want to keep these legacy oscilloscope, the problem number one is these DALLAS nvrams potted battery so it would nice to have a plug&play board with ease to change battery and emulating the same RTC and memory function

New replacement using currently available parts, at least it works in TDS3000 scopes.
https://github.com/james10952001/DS1744WP-to-DS1742W-adapter

Or you can cut into the original Dallas brick and solder in a new battery, looks a bit messy but is not too hard to do and usually successful.

[sicco]

Happy to report that my plugin module for TDS3000 works OK now. This unit fits inside the Tektronix scope expansion connector (rear panel slot), and as a bonus you get the serial port with it as well. Micro USB and FTDI chip on board if you prefer that instead of legacy DB-9 serial ports. Or just TTL level serial for a FTDI-TTL 6 pin header adapter.

Maxim/Dallas DS1744W module on this plug-in takes over the role of the DS1742W on the main board.

Still needs a bit of patch wire soldering on the main board unfortunately: the DS1742W /CS pin, or D4 from the PowerPC XPC860DCZP, that I routed to pin 11 of the 100 pin expansion port connector. That is/was EXTCLK_in from the PowerPC CPU, but I stole it, and now use it as a spring board. That pin 11 used to go via a 100 ohms SMD to the PowerPC CPU, I unsoldered that resistor to free up this connector pin. Next, if you'd leave the old DS1742W on the main board, it needs to be silenced. Did that by pulling its /OE to its VCC, and cutting the PCB track that used to go to that /OE.

It also can accommodate an ESP32 DevKit, and the WiFi web server as disclosed in https://www.eevblog.com/forum/testgear/reverse-engineering-tektronix-tds3gv-module-for-tds3000-series-oscilloscopes/msg3014688/#msg3014688 works great, thank you stas_last!

It also helped me upgrade my TDS3034 into a TDS3054, as per https://www.eevblog.com/forum/testgear/reverse-engineering-tektronix-tds3gv-module-for-tds3000-series-oscilloscopes/msg2748914/#msg2748914 - thank you for that james_s - and thank you for the hint on DS1744W in the first place.

This board could only be realised with the great guidence from pmercier c.s. as per https://hackaday.com/2020/07/18/reverse-engineering-teaches-an-old-scope-new-tricks/

Only bit I could not get to work (yet) is the 10BaseT Ethernet port. I assumed in full ignorance that all that was needed was a PHY chip like the legacy MC68160 but looks like more is needed on the board - likely a ROM and possibly something for the MAC address maybe. Not too big a problem, as Ethernet on the TDS3000-b and beyond comes from the mainboard now, and -b will reject a plugin board that says it's TDS3EV. So let's not do that.

Yes, this solution to the TDS3K RTC empty battery design flaw is obviously more expansive as the james_s patch board, but on the plus side this is much easier to retrofit I think - unless you're really good at desoldering 24 pin DIP modules from delicate multilayer boards. And you get the serial port. WiFi web server. USB serial. Unlock the 500 MHz bandwidth for free... Unless you had a serial module already of course.

So no more end of life after 20 years for TDS3000. Another 100 years to go - well - for as long as you can get DS1744 clip-on batteries (which btw have easily accessible solderalbe battery tabs).

Should I start a business selling these boards now? 

[james_s]

I have an original Tek ethernet module, I can open it up later and see what it has inside.

[sicco]

Wow. Yes please!

[james_s]

This is the board in a TDS-3EM module. As hypothesized there is a ROM in there. I don't really want to try desoldering it and I don't think I have an adapter to read that package with anyway. It may be possible to dump the contents onto a floppy or via GPIB.

[sicco]

Thank you james_s.
Studied the hi-res pictures, almost done reverse engineering the tracks on both sides. A0 from mainboard skipped, A1-A19 on Tek mainboard to A0-A18 of the 16 databits bits wide 29AM008 flash ROM. Still in doubt a little bit on the /CS, /WE, /OE, BYTE/WORD lines for the 29AM008. Would you mind helping me confirm a few tracks where I’m not 100% sure yet? As in beep through from 100 pin connector to the 74LC245 and the 74LC08 chips? Like is it using CE1 or CE2, WE1 or WE2? HRST? And what code goes into the 74LC245 for board ID?

No idea yet how to get the hex code. Assuming it is read only in normal use. Speculating the hex file can be read out via the 100 pin connector, and written back via the same route. But i doubt the Tek firmware will do any of that for us. So another project on the horizon, Flash rom copy tool...

Will need reflashing anyway as only 20 years data retention is promised by the AMD datasheet   

[james_s]

Yeah I can take it apart again and check a few things when I have a chance.

I'm hoping that it lasts longer than 20 years in the real world, usually this stuff does. Actually this ethernet interface doesn't seem all that useful, I have a GPIB module I usually use instead and if I want to get screenshots off the scope I use the floppy drive.

[sicco]

James_s, see pictures attached on where I'm not 100% sure yet. I intend to leave out the 74LC245 bufferes and the 74LC08.

Can you beep through and check these assumptions:

U170 pin 47 goes to VCC or GND or is it left floating?
R100 left side goes to U170 pin 11? Or 12? Or elsewhere?
U180 pin 15 goes to U150 pin 15 goes to U140 pin 5?
U160 is just pass through buffer with pins 11, 12, 13 not used and 10, 5 and 1 to VCC (=14)? Pins 1 and 2 puzzle me here.
U110 pin 1 goes to U170 pin 28? And to U140 pin 8?   Or is it U170 pin 4 to to U160 pin 3?
U140 pin 7 to U160 pin 2?
U140 pin 11 to 100pins connector pin 66?
U140 pin 12 to 100pins connector pin 81?
U140 pin 13 to 100pins connector pin 79?
U140 pin 14 to 100pins connector pin 78?
U140 pin 15 to 100pins connector pin 76?
U140 pin 16 to 100pins connector pin 74?

[Finderbinder]

Just did RTC battery mod/replacement on my TDS3012B without board removing:

[sicco]

Nice job Finderinder!

I took my plugin board with the DS1744W RTC alternative another step further. Now have the Ethernet (for not -b and not -c models) TDS3EM emulation part working also. The flash eprom on a TDS3EM only has the MAC address in it as ASCII string. So no code for network stacks in there. Just 18 bytes for 00:01:02:03:04:05<null> if the MAC address is 00 01 02 03 04 05... What a waste of flash rom megabytes...

Also found out the hard way that the NVRAM (so the DS1742W originally) does hold some Ethernet networking relevant parameters. And those do not get reset-to-good values with holding TRIG-B button at reboot time. Something related to network name and network type. Only loading the NVRAM with the 2kbyte data image as found elsewhere on this forum makes the TDS3EM (/equivalent) network work as advertised. A NVRAM with all zeros or all 0xff bytes does not work properly when ethernetworking! Like DHCP does not work if enabled - the scope goes into cyclic reboots.

NB be aware that the scope as web page (e*Scope) only works on the -b and -c models. I used a NI how-to-ethernet-TDS3000 web page that Google hinted at - but that doesn't say it will not work for not -b not -c models... 

Enabling mechanism for the extensive self-test diagnostics second serial port output is clearer to me also now: the TENA line (pin 17 on 100 pins expansion port) needs a 4k7 pull down to GND. Looks like at boot-up, it's configured as input with weak pull-up, then sensed, and thereafter it becomes a network controller output instead of general purpose i/o pin. Also I noticed that on the original TDS3EM on TX (pin 15) there's a 47k pullup to +5V.
 
Here's what it says on the diagnostics output (TTL serial, 38400,n,8,1, pin 13) when all works finally after reloading the RTC NVRAM with file (bin.bin is the RTC 2k binary data) attached:

▒▒▒UUUUUUUUUUUUUUUUUUUU
Loading Image
Boot flash checksum OK
Code flash checksum OK
0x00800000 bytes of RAM found
DRAM address line check OK
DRAM data line check OK
NVRAM address line check OK
NVRAM data line check OK
TBC ACQ SRAM address line check OK
TBC ACQ SRAM data line check OK
TBC Display SRAM address line check OK
TBC Display SRAM data line check OK
SuperI/O ID 0x000000b2
Uncompressing code from 0xffc40010 size 0x001e0927
Enabling cache
Entering usrRoot
Enabling the MMU
sysClkRateSet using 25 MHz
Enabling I/O system
excInit called
Class 17 Level 3  hwResetTBC(): Installing Machine Check Exception handler. 15:17:52 12/29/2020 (thread: StartUp)
Class 7 Level 3  hwI2CAppKeySearch: new device I2C/APPKEY1 slot 1 addr 0xa0
 15:17:52 12/29/2020 (thread: StartUp)
Class 7 Level 3  hwI2CAppKeySearch: new device I2C/APPKEY2 slot 2 addr 0xa2
 15:17:52 12/29/2020 (thread: StartUp)
TBC reset count = 2
Class 2 Level 3  acqWaitForAcqDone: timed out, sysjmp = 0x5
 15:17:54 12/29/2020 (thread: StartUp)
Attaching network interface qu0... done.
Attaching network interface lo0... done.
NFS client support not included.
Starting VXI-11 service...Core channel...Abort channel...ready.


Other achievement: can now do a 'no soldering - no main board patch wires' RTC expansion port plug-in module. For that I edited the boot rom code so that CS2 for the NVRAM-RTC at 0x02800000 becomes CS5, and CS5 at 0x05000000 becomes CS2. The nice thing was that the boot rom checksum remains the same despite the edits.
The plugin module RTC DS1744 then uses CE1, pin 78. But then we cannot have the TDS3EM Ethernet module emulation because that needs CE1 for its flash rom... Also it appears that once plugin modules are detected at boot-up time, some application code rewrites the PowerPC MMU glue-less registers again, so redefines CS2 and CS5 and then we're lost again. But still, it is possible to do a no-soldering expansion port DS1742W-dead battery to DS1744W-another-10-years, without even opening up the TDS3000 scope! However, on the downside, you do need a BDM interface like the Abatron BDI2000 that I used here.

Plus: I have started to offer these "DS1744W-another-10-years" plugin boards on eBay now. So serial, isolated, USB, ESP32-WiFi, ESP32-Bluetooth, RS232, Ethernet - and a 10 pins BDM header (in he next revision).