Tektronix TDS3012B repair help needed

[cpuchip]

So, I have this old scope that I inherited from my dad, I know it's way out of support, but I don't want the thing to go to a land field. Please help!

The device was working last month, and then it locked up on me while measuring a 3 MHz signal and rebooted, now it's stuck on the "scope man" boot screen, when the scope works fine I hear relays that trigger on boot, and then click off?? But that no longer happens.
I have since taken the thing apart following the posted service manual to check if the Power Supply is bad, it’s not, it has the 15v supply across pins 1 and 6 to the battery board. I’ve also successfully powered the scope (to the frozen boot screen) using an external 12v supply to the battery terminals on the back. This is an old scope ( going on 20 years? ) I read several forms that the boot issue could be bad NVRam battery in the RTC that corrupts the ethernet settings enough to prevent the scope from booting. So I ordered a replacement remanufactured dallas ds1742w NVRam and swapped it in. I’ve tried holding down b-trig on boot to “clear” the NVRam, but it’s still stuck on the “scope man” boot screen.
I’ve gotten it to boot once, but then it locked up when the relays click again.
I have tested with another oscilloscope ( the venerable TBS1052B since that’s what a neighbor had that I could borrow) and have verified that the two crystals on top of the main board (48MHz and 75.757575Mhz both ring true to their markings ) I noticed on the forms that that is another failure point is the 75MHz crystal goes bad.
I’ve noticed several test points on the main board and was wondering if I could get documentation on what they are so that I can probe them, or if there is a diagnostic Serial port on the board I can tap into to see if there is an error message being outputted. I’ve noticed that on TP7 I get a 25.252525Mhz signal, TP8 give a bit stream of sorts for a few seconds on startup and then quiets down sometimes, or has a repeating pattern other times

TP2 and TP3 has a digital signal out for a blip on startup then remains static. TP4 has a voltage of 3.09v which I think corresponds to max708s power line watch dog chip.
I’m starting to think the flash chips U610/U620 may have been corrupted?
Thanks for any trouble shooting help so I can get this scope back up and running.
Useful info:
Main board schematic, Test point definitions, serial/debug/j-tag pin locations.

I've followed along these threads for trouble shooting help, but they didn't solve my issues
https://www.eevblog.com/forum/repair/tds3014-adventures-(seeking-75-75mhz-oscillator)/

Replaced Dallas 1742w with this ebay part: https://www.ebay.com/itm/Tektronix-TDS3000-TDS3000B-exact-functional-replacement-for-DS1742W/293776182478?hash=item44666cccce:g:U~gAAOSwjfBfgfa1

[james_s]

The TDS3000 series are fantastic instruments and still quite desirable and valuable, even a dead parts unit will usually fetch a few hundred bucks. Unfortunately the big problem with these is that documentation is virtually nonexistent. Tek never released any sort of schematics and the service manual is a joke. If there's a debug console somewhere like the older TDS scopes have I'd love to know, I have a parts unit that is stuck in a reboot loop, I bought it for the cosmetic parts since I had a working scope that had become so brittle that it was falling to pieces. I'd love to figure out what's wrong with it though since I've heard of others with the same problem. I was thinking about replacing the RAM and seeing if that resolved it. Bad flash is another possibility, these are right about at the age where flash is approaching the minimum spec'd data retention.

[Shiv]

May be a dumb answer, but did you tried to update it?

I don´t remember if updating it will boot from disk or loading other "things"...

[sicco]

I found something of a backdoor serial port to the TDS3000 main board. The 100 pin connector has pins 13 and 14, tied to the PowerPC CPU SMRXD1 and SMTXD1. See picture how I wired it up on a plug-in module to a FTDI FT232-TTL unit. Could have soldered on the mainboard just as well. These appear TTL level serial at 38400,n,8,1. When booting up, it spits out this without asking. Also when there is no DS1742W fitted (which also prevents a full normal boot up).

sysClkRateSet using 25 MHz
excInit called

And then nothing. After that it echoes every character that I typed in. In an intelligent way, like adding a ^ for control characters.
Except when bombarding it with  ESC, CR, or any other letter while it boots - then it no longer echoes at all. But the scope works.

One character does respond differently: CTRL-X. Then it says

Calling romInit

Which was scary as I feared it would now erase my ROMs - but it didn't. Well, not yet, I opted to power off immediately and then back on, and all was still alive. Maybe this was a Dallas serial rom init procudure - google hints.

So it is something VxWorks as google drives me to VxWorks when searching on what it says.

Must have something secret to make it work like a true VxWorks console - if anyone knows the magic keystrokes to get there then let me know please!

[cpuchip]

Wow Sicco! That's exactly what I wanted to know. I don't have a com board to put in so I'll have to tie off of the main connector directly on the main board. I'll try that later today when I have the scope up
pin 13 is PPC RX and pin 14 is PPC TX?

Shiv I did updated it last year to 3.41 because it was acting unstable then, crashing after triggering on a wave form, and that seemed to help but (crash less often after update), but it would still crash every now and again, but would recover each time, until last month. The crashing while triggering on a wave form before and less after is what is making me think it's a firmware corruption problem

James I've thought about parting it out after a few months if I can fix it. Since the rest of the scope is in fantastic shape. I didn't check before I lost the contents of the NVRam but I'm sure the thing has less then 1000 hours on it.

[james_s]

Be very careful, the expansion connector is wired directly to the CPU and is not buffered, it is not likely to be forgiving to wiring errors or ESD. It is deeply recessed into the back of the scope and not intended to be touched by anything other than approved expansion modules. Buy the correct connector, somebody identified it in one of the other threads.

I think I will try replacing the DRAM chips on my dead board, I can do that with minimal risk to anything else but of course they are obsolete so I'll have to find a source. I did find a cross reference somewhere and I saw some ebay sellers with SIMMs containing one of the supposedly compatible chips so that is an option. I have a nifty old DRAM tester so I could solder the original chips back on the SIMM board and test them even. If that doesn't work then the next thing to try is pull the flash chips and get a test adapter for my TL866. The issue though is getting a known good image of the contents to compare with, I don't know if anyone has figured out how to get that from the firmware disk images. I'm pretty good with a hot air station but given the value of these instruments I'm very hesitant to mess with the ROMs on a working one. Perhaps we could find someone who has one with a blown up front end that still boots and extract the ROM from that.

[YetAnotherTechie]

I have a dump of the 2 roms somewhere, but it contains the serial number...

[james_s]

I have a dump of the 2 roms somewhere, but it contains the serial number...

I don't see that as a big issue, it would still be sufficient for troubleshooting purposes and it's possible that the serial number could be altered fairly easily. These scopes are all discontinued, out of production and out of support, the serial number is all but irrelevant. Few are going to care if the serial number in ROM doesn't match what is on the back of the scope if their dead scope is revived.

[sicco]

YetAnotherTechie - would you also by any chance have a dump for the ROM inside a TDS3EM Ethernet module?

cpuchip - on what was TTL Tx and Rx, 13 or 14, i’d think the scope transmits on its pin 14, receives on its pin 13.
The way it was in the snapshot that i added, it worked. FTDI 6 pin header connector wire color coding at https://www.ftdichip.com/Support/Documents/DataSheets/Cables/DS_TTL-232R_CABLES.pdf page 11, 12.

Don’t forget a ground wire as well.

[mankan]

I used this connector https://www.digikey.com/en/products/detail/te-connectivity-amp-connectors/1-1734099-0/1121334 to for the expansion port.

[YetAnotherTechie]

YetAnotherTechie - would you also by any chance have a dump for the ROM inside a TDS3EM Ethernet module?

Sorry i don't have any modules, and it's B version, so ethernet is build in, i don't remember seeing a diferent flash chip for it...

[Shiv]

Wow Sicco! That's exactly what I wanted to know. I don't have a com board to put in so I'll have to tie off of the main connector directly on the main board. I'll try that later today when I have the scope up
pin 13 is PPC RX and pin 14 is PPC TX?

Shiv I did updated it last year to 3.41 because it was acting unstable then, crashing after triggering on a wave form, and that seemed to help but (crash less often after update), but it would still crash every now and again, but would recover each time, until last month. The crashing while triggering on a wave form before and less after is what is making me think it's a firmware corruption problem

James I've thought about parting it out after a few months if I can fix it. Since the rest of the scope is in fantastic shape. I didn't check before I lost the contents of the NVRam but I'm sure the thing has less then 1000 hours on it.

I´m saying you maybe could do it again.

If you are lucky, the first boot section is ok and it could be upgraded to write on a new firmware and rip the corruption.

It´s just a try

[sicco]

YetAnotherTechie: If the ROM hex image is for TDS3012b then I’d suspect it contains the code that the TDS3012 not-b would otherwise get from the ROM on the Ethernet module TDS3EM. So I’d like to check that out.

Other experts: would a firmware upgrade/downgrade with the 5 floppy disks also reflash the Ethernet code on the TDS3012b, and therefore also on the TDS3012 TDS3EM if that was the hardware in place inside a TDS3012?

I’m speculating here that the newer TDS3012b went to double size flash ROM chips, and therefore could embed the TDS3EM ethernet code on their mainboard by just adding PHY chip. And that in the TDS3012, the code space above its flash ROMs was mapped to /CE1 or /CE2 in the memory map, so that it could physically reside on a plugin module. Maybe?

[cpuchip]

I used this connector https://www.digikey.com/en/products/detail/te-connectivity-amp-connectors/1-1734099-0/1121334 to for the expansion port.

Thanks Mankan I'll get one on order, one day I might even design a board if I ever get this scope up and running.

cpuchip - on what was TTL Tx and Rx, 13 or 14, i’d think the scope transmits on its pin 14, receives on its pin 13.
The way it was in the snapshot that i added, it worked. FTDI 6 pin header connector wire color coding at https://www.ftdichip.com/Support/Documents/DataSheets/Cables/DS_TTL-232R_CABLES.pdf page 11, 12.

Thanks I'll try this when my port header comes in!

If you are lucky, the first boot section is ok and it could be upgraded to write on a new firmware and rip the corruption.

It´s just a try

I'll try that next, but last I remember when I had the floppy drive installed it was not showing any signs of life, like seeking or such. I've pulled down somewhere else on this form the 3.39 firmware version that I can put to some floppies, I was fortunate enough to get a stash from all of my neighbors last time I upgraded the firmware on this scope.

[YetAnotherTechie]

Hope it helps

[james_s]

The dead one I have shows the splash screen for several seconds, then it flashes briefly and continues to do this. I believe what is happening is the boot process is starting then something fails and it reboots and just keeps doing this over and over. Since I don't have a console showing the boot process I have no idea what is actually happening, it never tries reading the floppy or shows any error messages. In searching for information all I've found is a few other people with the same problem and no solution. I think if we can narrow this down it's likely to be the same problem happening in many of these.

[cpuchip]

Hope it helps

Hey! how did you get this dump? I have a TL866II+ but the AM29LV160DB-90EC (16 Megabit ( 2 M X 8-bit/1 M X 16-bit ) CMOS 3.0 Volt-only Boot Sector Flash Memory) aren't on the list. And thank you!!! It'll be fun just parsing through the hex! So thank you very much.

The dead one I have shows the splash screen for several seconds, then it flashes briefly and continues to do this. I believe what is happening is the boot process is starting then something fails and it reboots and just keeps doing this over and over. Since I don't have a console showing the boot process I have no idea what is actually happening, it never tries reading the floppy or shows any error messages. In searching for information all I've found is a few other people with the same problem and no solution. I think if we can narrow this down it's likely to be the same problem happening in many of these.

I think so too. I've reached out to TEKtronics and haven't gotten anything back from them. They did a few nice things when they retired this scope, but honestly I feel like companies should practically open source their old defunct products so as to reduce e-waste. It's a shame that we cannot easily fix these scopes!

[YetAnotherTechie]

Hey! how did you get this dump? I have a TL866II+ but the AM29LV160DB-90EC (16 Megabit ( 2 M X 8-bit/1 M X 16-bit ) CMOS 3.0 Volt-only Boot Sector Flash Memory) aren't on the list. And thank you!!! It'll be fun just parsing through the hex! So thank you very much.

same programmer, i used AM29LV160BB to read 
Maybe you could  try to modify the dump program that's around here for the tds3xx series  so it works with 3000, removing the chips to find differences is not very safe or productive, because the scope writes a log of the scpi commands and errors, so a lot of the dump changes.

[cpuchip]

Do you think this would be an okay substitute?

https://www.digikey.com/en/products/detail/macronix/MX29LV160DBTI-70G/2744817

What adapter did you use? because that's a 48 pin part, and the TL866II+ is a 40 pin dip.
Never mind, i see I need the tsop48 sn001 adapter board.

[shakalnokturn]

If this is of any help... Sending "i" (LF/CR) to VxWorks over the serial debug port should prompt it to return the active processes.

Attached  a list of the VxWorks symbols for a TDS 420, I expect a fair deal should be common.

I also seem to remember reading somewhere on here that some TDS scopes (TDS 210/220) would output early boot diagnostic information in form of different frequencies on the probe compensation no idea if that applies to the TDS 3012.

[sicco]

Sending "i" did nothing on my TDS3054.

All I'm getting after a reboot is still just this on that first TXD1, RXD1 TTL pins 13,14 serial engineering/debug(?) port at 38400,n,8,1. This is from when booting up 4 times in a row:

osysClkRateSet using 25 MHz
excInit called
sysClkRateSet using 25 MHz
excInit called
sysClkRateSet using 25 MHz
excInit called
sysClkRateSet using 25 MHz
excInit called


CTRL-X is the only 'command' that makes it do something else then just echoing what I type in. It has Xon/Xoff protocol rules active it seems.

CTRL-X gives this. And leads to just a reboot.

cacheDisable (0);
Calling romInit

Had that in v3.39, and it's the same in firmware version 3.41.
So no real progress today yet I'm afraid.

Well, did get an order in with JLCPCB for another 10 of the DS1744W rear expansion port adapter boards, now with flash ROM for Ethernet, for which I don't have HEX code yet. But I'm betting that the firmware floppies have it. My hope stems from the fact that when upgrading, it sort of skips the bulk of the first two floppies in my TDS3054 that has no Ethernet and no TDS3EM. So maybe those first two disk have the Ethernet ROM image. Maybe...

But if anyone has the ROM hex image for the TDS3012-b, any TDS30xx-b, or -c, or for the TDS3EM module, then please can I you share?

From the firmware floppies, .DAT file sizes [KB] are:
   
                 3.39      3.41
      
Disk1   513   513
Disk2   145   145
Disk2a   234   234
Disk3   1421   1421
Disk4   785   789
      
Total          3098   3102

But that might be compressed - so not sure really what this means and how much is boot ROM that never gets updated - maybe...

[shakalnokturn]

It would be good to have the boot log from a working scope to compare.

It looks like either corrupt firmware, or basic hardware fault.

Extract from the VxWorks BSP developer's guide:

2.2.4 Detailed Boot Sequence
The following is a step-by-step description of a generic boot sequence.
Step 1: Execute romInit( )
At power-up (cold start), the processor begins execution at the romInit( ) entry
point, located in romInit.s. For resets (warm starts), the processor begins execution
at romInit( ) plus a small offset (see sysToMonitor( ) in target/config/sysLib.c).
The romInit( ) routine must be written in assembly language.
The purpose of this routine is to initialize the CPU and some portion of memory. It
does the absolute minimum amount of initialization—that is, the initialization of
essential hardware only—before jumping to romStart( ). If romInit( ) is working
correctly, the memory from LOCAL_MEM_LOCAL_ADRS through
(LOCAL_MEM_LOCAL_ADRS + LOCAL_MEM_SIZE) should be readable and
writable. If this is not the case, romInit( ) is not working properly.
In addition to initializing memory as described above, the romInit( ) routine must
also disable interrupts and clear caches. romInit( ) then configures the boot type
(cold or warm) to be a subroutine argument and branches to romStart( ) in
bootInit.c. For more information on configuring the boot type, see 2.3.7 Hardware
Considerations, p.42.
romInit( ) must do only as much device setup as is required to start executing C
code. Hardware initialization is the responsibility of the sysHwInit( ) routine in
target/config/sysLib.c, which is called later during the boot sequence.
________
Extract from VxWorks architecture supplement (WRT PPC/MPC processors):

In a standard VxWorks image, excVecInit( ) and excInit( ) install the default
exception and interrupt handlers, along with the stub for the entry and exit code,
by calling the connect routines described previously.
_________

An interesting detail from:
https://www.ee.ryerson.ca/~courses/ee8205/Data-Sheets/Tornado-VxWorks/vxworks/ref/excLib.html

"Exceptions or uninitialized interrupts that occur after the vectors have been initialized by excVecInit( ), but before excInit( ) is called, cause a trap to the ROM monitor."

[sicco]

The scope that I was playing with is a working one - it's cpuchip who started this thread who has a failed one.

It's just that I don't know yet how to exploit its backdoor - how the get anything more than just CTRL-X being romInit()...

It feels like we're getting close to really opening up the debug/monitoring port. But there is a hurdle still to take.

Just found the TDS3012b ROM images shared by YetAnotherTechie, pasted the two 16 bits wide files into one 32 bit file, and then see interesting text in the lower part of the code. Clearly looks like messages for detailed self tests, with pass/fail strings that would end up somewhere. But where is that somewhere, how to read / log / print that??

000000: 00000006 fffebbdc fffeea4c fffea074 fffe0040 ffff4420 ffff92e4 dcc50a57 ...........L...t...@..D .......W
000020: ffc00100 00002114 9da76212 00000000 ffc40000 001dbdbd 64a3bb00 00000001 ......!...b.............d.......
000040: ffc3ec58 00001004 9366a332 00000000 ffc04000 0003ac54 674b8add 00000001 ...X.....f.2......@....TgK......
000060: ffe1bdd0 00047724 00000000 00000000 ffffffff ffffffff ffffffff ffffffff ......w$........................
000080: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ................................
0000a0: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ................................
0000c0: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ................................
0000e0: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ................................
000100: 3cc0ffc0 38c60128 3ce0ffc0 38e70100 3d00ffc0 39080100 7cc73050 7cc64214 <...8..(<...8...=...9...|.0P|.B.
000120: 7cc803a6 4e800020 48000055 48000059 436f7079 72696768 74203139 39372054 |...N.. H..UH..YCopyright 1997 T
000140: 656b7472 6f6e6978 2c20496e 632e436f 70797269 67687420 31393834 2d313939 ektronix, Inc.Copyright 1984-199
000160: 35205769 6e642052 69766572 20537973 74656d73 2c20496e 632e0000 38a00002 5 Wind River Systems, Inc...8...
000180: 48000009 7c651b78 4800000d 480008d0 48000000 3c600000 60631002 7c600124 H...|e.xH...H...H...<`..`c..|`.$
0001a0: 7c7b03a6 38000000 7c788aa6 60680000 3c600400 7c788ba6 3c80ff00 60840000 |{..8...|x..`h..<`..|x..<...`...
0001c0: 7c9e9ba6 3c60ffff 6063ff88 90640004 3c600000 60630000 3ca00001 60a50000 |...<`..`c...d..<`..`c..<...`...
0001e0: 90a40ab8 90640abc b0640964 b0640960 b0640962 b0640970 90640ac4 3c600000 .....d...d.d.d.`.d.b.d.p.d..<`..
...
001f20: afdd0c3a 5f3aafbd 7fbdb082 5f8247f8 3e303430 34343737 abf7bf9b 994b4fbd ...:_:....._.G.>0404477.....KO.
001f40: bd599493 349fff37 fb9b177d d9936956 bbfdd697 bdd2fd11 31db9bb3 63139637 .Y..4..7...}..iV........1...c..7
001f60: 93733693 193137f7 331737af 7bb9b999 bb197957 7fdfd3d5 73b773f7 37933b99 .s6..17.3.7.{.....yW...s.s.7.;.
001f80: 1d115316 99315315 31694bf4 fbdbd359 31497353 76956d69 7b9d9693 13131979 ..S..1S.1iK....Y1IsSv.mi{......y
001fa0: 79376935 426f6f74 20666c61 73682063 6865636b 73756d20 4f4b0a0d 002a2a2a y7i5Boot flash checksum OK...***
001fc0: 426f6f74 20666c61 73682063 6865636b 73756d20 4641494c 45442a2a 2a0a0d00 Boot flash checksum FAILED***...
001fe0: 436f6465 20666c61 73682063 6865636b 73756d20 4f4b0a0d 002a2a2a 436f6465 Code flash checksum OK...***Code
002000: 20666c61 73682063 6865636b 73756d20 4641494c 45442a2a 2a0a0d00 20627974  flash checksum FAILED***... byt
002020: 6573206f 66205241 4d20666f 756e640a 0d003078 00202a2a 2a200020 2a2a2a20 es of RAM found...0x. *** . ***
002040: 4d616368 696e6520 43686563 6b206475 72696e67 206c696e 65206368 65636b20 Machine Check during line check
002060: 61742000 202a2a2a 20416464 72657373 2f446174 61206c69 6e652046 41494c45 at . *** Address/Data line FAILE
002080: 44206174 20004452 414d2061 64647265 7373206c 696e6520 63686563 6b204f4b D at .DRAM address line check OK
0020a0: 0a0d0044 52414d20 64617461 206c696e 65206368 65636b20 4f4b0a0d 004e5652 ...DRAM data line check OK...NVR
0020c0: 414d2061 64647265 7373206c 696e6520 63686563 6b204f4b 0a0d004e 5652414d AM address line check OK...NVRAM
0020e0: 20646174 61206c69 6e652063 6865636b 204f4b0a 0d005442 43204143 51205352  data line check OK...TBC ACQ SR
002100: 414d2061 64647265 7373206c 696e6520 63686563 6b204f4b 0a0d0054 42432041 AM address line check OK...TBC A
002120: 43512053 52414d20 64617461 206c696e 65206368 65636b20 4f4b0a0d 00544243 CQ SRAM data line check OK...TBC
002140: 20446973 706c6179 20535241 4d206164 64726573 73206c69 6e652063 6865636b  Display SRAM address line check
002160: 204f4b0a 0d005442 43204469 73706c61 79205352 414d2064 61746120 6c696e65  OK...TBC Display SRAM data line
002180: 20636865 636b204f 4b0a0d00 53757065 72492f4f 20494420 00200a0d 004c6f61  check OK...SuperI/O ID . ...Loa
0021a0: 64696e67 20496d61 67650a0d 00556e63 6f6d7072 65737369 6e672063 6f646520 ding Image...Uncompressing code
0021c0: 66726f6d 20002073 697a6520 00206578 70656374 65642000 20616374 75616c20 from . size . expected . actual
0021e0: 00206174 74656d70 74696e67 20636f64 65207265 636f7665 72790a0d 00537461 . attempting code recovery...Sta
002200: 7274696e 6720426f 6f742043 6f646520 61742000 ffffffff ffffffff ffffffff rting Boot Code at .............
002220: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ................................
....

So close...

[cpuchip]

I've just tried downgrading my firmware from 3.41 to 3.39 and I got no life out of the floppy disk drive. Still trying other things! I want to check the console output next.

Thanks for all of your Reponses guys! I starting to feel like I'm understanding this scope a bit. I wish the TEKtronics over lord would bless us with a schematic or repo to play in. but that's wishful thinking.

[cpuchip]

OKAY I was adventurous..... I figured I had a dead scope anyway and desided to solder right to the mainboard pins 13 (scope TX) / 14(scope RX) and 1 (gnd) for a serial consol this is my output

UUUUUUUUUUUUUUUUUUUU
Boot flash checksum OK
Code flash checksum OK
0x00800000 bytes of RAM found
DRAM address line check OK
DRAM data line check OK
NVRAM address line check OK
NVRAM data line check OK
TBC ACQ SRAM address line check OK
TBC ACQ SRAM data line check OK
TBC Display SRAM address line check OK
TBC Display SRAM data line check OK
SuperI/O ID 0x000000b2
Loading Image
Uncompressing code from 0xffc40010 size 0x001e0927
Enabling cache
Entering usrRoot
Enabling the MMU
sysClkRateSet using 50 MHz
Enabling I/O system
excInit called

So.. heh. CTRL-X didn't seem to do anything and mine wasn't echoing but I'm still playing with it. maybe I don't have a good connection on rx