Tektronix TDS784D hangs when write protection switch is disabled

[dj831]

Hello everyone, I've got a question to people experienced on TDS784D A11 CPU boards. Here's the story ...

I found on FleaBay a 784D having latest 7.4 firmware revision, with issue on last two channels - they worked fine though when scope was delivered and item passed SPC . I then wanted to console oscilloscope to dump that infamous DS1486. I then built a console adapter to connect to the scope, it worked flawlessly, I was able to dump DS1486. As expected, beginning of each dump is different (RTC). I was able to clear log (after saving it) - it contained not much faults apart probes used by former users.

When I turned off memory protection switch, and powered device, here's what I have on console:

RUNNING FROM DRAM.
DRAM test passed.

   Bootrom Header Checksum passed.
   Bootrom Total Checksum passed.
   BootRom Check Sum passed.
   Bus Error Timeout test passed.

Kernel Diagnostics Complete.
Calling SDM (monitor) Routine.

   Enabling Bus Control register. Value = 0x67
   IMR 1 Register test passed.
   Misc. Register test passed.
   Timer Interrupt test (Auto-Vector) passed.
   NVRam DSACK test passed.

+12V applied to Flashroms, NVRam NOT WRITE Protected

Flashrom Programming Voltage is ON.
Cannot transfer control to Flashrom.
Transferring control to the SDM (monitor).

...

And scope hangs, displaying '8' on LED display. No matter if switches are set to '00110000' (console monitoring) or '00000000' (normal mode), if transfer mode on Putty is set to 'None' or 'CTS/DTR'. Funny thing is that item works fine, no 'FAIL' message on boot when Cal switch is not enabled.

Four things though:

1. When I enable 'Expand error log and increase diag messages', I've got:

CPU: 68EC040.  Processor #0.
Memory Size: 0x1000000.  BSP version 1.0.
Executing Diagnostics

-> ERRORID: 163 diagnostic test failure Start Power-On Sequence

Start Power-On Diag Sequence

...

But nothing with a 'Fail' message on what is tested right after.

2. Toggling that switch when device has booted does absolutely nothing. I guess it must be read at power on.

3. Setting switches either to '00000000' or '00110000' change absolutely nothing

4. When dumping DS1486, few bytes change from time to time. Often 5 bytes, but had once 29 bytes - but it's RAM after all. Of course, I exclude these first bytes related to RTC.

Since I suspected my console port, I built a simpler one (the one that uses RS232 board connected to console port) - exact same issue  For thoses interested in, please have a look at the picture below, serial port uses Cisco console cable, because I've got plenty of these 

If someone has an idea, it is very welcome!

[Jwalling]

[...]

When I turned off memory protection switch, and powered device, here's what I have on console:

[...]

+12V applied to Flashroms, NVRam NOT WRITE Protected

Flashrom Programming Voltage is ON.
Cannot transfer control to Flashrom.
Transferring control to the SDM (monitor).

Are you sure that the WP rocker switch is set to off (toggled towards the rear of the unit)?
Because that's not what the self test is saying...

[dj831]

Hi Jwalling, first, thanks for your input. Apologies, bad copy paste ...

I don't remember exact position of S1002 since I'm not in front of oscilloscope, but from what I recall, TDS freezes when I've got a warning about UNprotected flash.

To confirm, IIRC, pin #56 (/Write Protect) of both 28F160J5 flash memories goes high when in programming mode (and scope freezes). WP pin is connected straight to S002 switch, and info is reported to OS from switch via two series resistors (49.9R + 0R), then a 541, then a F245 (or F240, I don't remember). I haven't sensed anything on NVRAM' pins, since I've just soldered sockets last night

I've dumped DS1250Y yesterday night (B&K Precision 844USB programmer), and I need to do the same for the DS1486 - I've got to set up first a laptop having a parallel port, install XP and connect my old HiLo ALL-07 that is supposed to support DS1486.

Any thoughts are very welcome! 

[Jwalling]

Hi Jwalling, first, thanks for your input. Apologies, bad copy paste ...

I don't remember exact position of S1002 since I'm not in front of oscilloscope, but from what I recall, TDS freezes when I've got a warning about UNprotected flash.

The scope will do that when S1002 is toggled to unprotected. When the rocker switch is toggled towards the front of the scope, it's unprotected.

[chronos42]

This behaviour is absolute normal.

There are two states for this switch:

1: Scope is running and then the switch is set to unprotect. Scope is still running and now prepared for calibrating.

2: The scope makes a coldstart while the switch is set to  unprotect. The scope operation system is not starting, only the bootloader. The loader waits for commands over the GPIB port. This is for firmware and option updates.

[dj831]

Hi, thanks all for your answers! You are absolutely right: normal behaviour.

I did not answer since I was busy on repair of that scope: BOTH NVRAMs failed  Meanwhile, I've ordered three DS1486 on eBay china (c.a. $15 for all three, delivered), hoping that one would be good on all three. I was lucky, first one was good!  They are obviously fakes, but working fakes (for how long, that's a good question).

The TDS I own was purchased on eBay on october, in very good condition having channels 3 & 4 defective, but that worked fine when delivered. The only issue was a defective rubber ON/OFF key (I was lucky to found a brand new keypad, still on eBay).

Knowing that DS1486 was critical on TDS series, I dumped DS1486 through console port - and it proved useful  I just had to reprogram my DS1486, and modify time registers to get a wotking device (I use a B&K 844USB).

But ...

When I desoldered NVRAMs, DS1250 did not appreciate desoldering. Battery bulged and device lost memory few days after - I had time to dump memory and save dump. I then removed epoxy resin, clened both ICs, changed battery and now have a running DS1250 for years.

If some people are interested in DS1250 teardown, just let me know, in order I start a new topic about it - it may be helpful for dying TDS series. I will try to do the same for DS1486, but will be more complicated, since It surely uses an SSOP32 RAM instead of SOIC IC used on DS1250.

[nctnico]

If you replace the NVRAM then use sockets. Still I don't get how you managed to damage an NVRAM by soldering. Did you use a Butane torch? 

[dj831]

Hi, yes, of course! Why? I shouldn't have?

Well, to be (a bit) serious, I took great care when I desoldered both NVRAMs - needless say  I used soldering station (JBC AD2200) set @ c.a. 350°C, used solder braid, and solder flux (both on braid and on PCB - that way since I have an issue with my RP5100). Have a look at solders after replacement:



BTW, I was even more cautious when I desoldered DS1486. Believe it or not, some tracks broke inside the PCB This is the 1st time that happens to me, after 30+ years of successful repairs/desoldering. Hopefully, both NVRAMs are wired together (apart some CS pins, of course). So, an easy fix:



Nedless say, I soldered quality sockets - I don't even't think someone would solder new NVRAMs without sockets, especially with DS1486 from eBay. BTW, here are pictures of bulged DS1250Y:





and renewed DS1250Y (Both ICs were desoldered, board cleaned, ICs resoldered, and new battery added):



Yes, I know this is a very bad idea to solder a battery: heating can be dangerous and leads to loss of battery life expectancy. Reason why I'm very cautious to avoid both issues, by scratching surface before soldering, adding flud, and by being very quick when soldering.