Tektronix TLA715 Logic Analyzer - Bricked

[smgvbest]

In trying to work out the BIOS flash utility I ended up bricking my TLA715.

At this point I get a Beep, Pause, beep, beep and no screen no nothing.   I checked the primary/secondary display out and also blank.

So looks like my BIOS got bricked.    The Version of my BIOS was 1.00.02 and the version flashed was the same from a original Tek Floppy. (still sealed in the envelope)
I used the the PHLASH.EXE after getting it bootable.

so when you run PHLASH.EXE it reads the BIOS.ROM file then the PLATFORM.BIN file from the floppy then immediately starts to write the BIOS out.
everything looked good,  no failures or anything

but after rebooting,  nothing.

I do have a second TLA715 with a V1.00.00 BIOS.   Its got a bad battery socket.   someone replacing the battery ripped the battery connector right off the board.   I've temp fixed it but need to lay down new pads and join to the vias near-by then epoxy the battery socket down.

What I'm going to do it de-solder the FLASH from the bricked unit first and read it out.  if all goes good there I'll remove the other and read it out and reprogram the first one.

Once I get the board out I'll get some good pics of the 715 control board and post and also post the raw dump of the flash

I did more reading on flashing the BIOS.   it looks like the service manual says to go into the BIOS and do the BIOS UPDATE in there with the DISC inserted into the floppy drive.

Thats all for now

[smgvbest]

I did get the control board pulled,   Hint you do not need to remove the front bezel to get it out.   just remove all the screws as instructed and you can pull the side panel out and then remove the board

The flash has been removed and read out on the T56. 


the PHLASH.EXE program on the BIOS Floppy has these options for reference

Code: [Select]

USAGE:  PHLASH [options] [@rspfile] [romfile]
     romfile    Override the default BIOS ROM image name BIOS.ROM with "file".
     @rspfile   Response file containing more options
     /A         No auto-sensing, use PLATFORM.BIN parameters only.
     /B=name    Override the default filename PLATFORM.BIN with "name".
     /BU[=name] Backup flash memory into BIOS.BAK before programming.
                If "name" specified, override the default filename BIOS.BAK.
     /C         Clear CMOS checksum after programming.
     /CS        Verify BIOS ROM image checksum.
     /DEV       List flash devices currently supported by PHLASH.
     /H or /?   Help screen.
     /I         Verify image size matches flash part size.
     /MFG       Manufacturing mode - Automatically reboot without keypress.
     /N         Program only if BIOS.ROM is different than system BIOS.
     /NOBIOSINFO  Do not display bios date and part number while flashing.
     /O         Override (disable) all options from PLATFORM.BIN.
     /P         Production mode (minimize messages and delays).
     /PF="opts" Platform specific string "opts" passed to platform.
     /PN        Program only if same BIOS part number.
     /RO[=name] Read contents of flash part and save to a file.
     /Rn        Retry flashing a block n times if flash fails.
     /S         Silent operation (turn off speaker).
     /SE        Do a sector erase for the Atmel 49F002 flash part.
     /SO=[NORMAL|COMPAT]  Select Operation of multiple part support.
     /SWAP=NO   Disable Axx swapping.
     /V         Verify each block after programming it.
     /Z         Zero before erasing a block.
     
To FLASH a part you also need the following files:
     1) PLATFORM.BIN (manufacturer specific initialization file)
     2) BIOS.ROM (BIOS ROM image file)

I'm attaching a zip file of the BIOS Floppy for reference.   
*** Use at your RISK. ***

[picburner]

Some time ago, as a precaution, I dumped the flash of my working TLA715 with v. 1.00.02 also.
I made a comparison of the two dumps (mine and yours) and found some differences.
I attaching my dump.

[rl78family]

Hello, can anyone send a BIOS version other than 1.00.02 to rl78family@gmail.com?
I want to compare with 1.00.02 in order to find the checksum.

[tv84]

I want to compare with 1.00.02 in order to find the checksum.

Why don't you debug the PHLASH.EXE app since it includes the feature?

Code: [Select]

     /CS        Verify BIOS ROM image checksum.

[rl78family]

Why don't you debug the PHLASH.EXE app since it includes the feature?

Code: [Select]

     /CS        Verify BIOS ROM image checksum.

Good tip, thanks, I hadn't thought of that. The truth is that I have doubts, because:
1) PHLASH.EXE cursed at my BIOS when trying to check the checksum (need to check it again)
2) PHLASH.EXE is from Phoenix, and our loader is from Radisys, and it seems to me that it has its own separate CRC.

By the way, I learned how to make a bootable floppy disk that can revive the system if the BIOS is damaged, but the live bootblock remains.
When will be the time - I'll post it here.

[rfdes]

The checksum used in these ROM images are nothing more than a simple 8bit binary sum of all bytes in the file.  They should equate to 0.
Use a hex editor such as HxD (free).  Open the file and find the calculate checksum feature. The checksum byte sits at the very last byte position of the binary image.

I know this because I spent some time reverse engineering the bios for the TLA704 analyzer.  The 704 also used a Phoenix bios and PHLASH utility.
The checksum that I am referring to only supports the integrity of the ROM binary image.  Once the Bios has been flashed and the system boots there is another checksum that is run.  There are areas of the ROM binary image that are compressed and finding this checksum has been an aggravation for me.

I am curious if you are attempting to reverse engineer your Bios.

[rl78family]

The checksum used in these ROM images are nothing more than a simple 8bit binary sum of all bytes in the file.  They should equate to 0.
Use a hex editor such as HxD (free).  Open the file and find the calculate checksum feature. The checksum byte sits at the very last byte position of the binary image.

Thank you, I will try this soon.

I know this because I spent some time reverse engineering the bios for the TLA704 analyzer.  The 704 also used a Phoenix bios and PHLASH utility.
The checksum that I am referring to only supports the integrity of the ROM binary image.  Once the Bios has been flashed and the system boots there is another checksum that is run.  There are areas of the ROM binary image that are compressed and finding this checksum has been an aggravation for me.

"Proenix BIOS editor" is able to unpack BIOS (and modify modules), but cant assemble it back. It seems phoenixtool is able to put separate modules back into BIOS.ROM.

I am curious if you are attempting to reverse engineer your Bios.

I am attempting to add the Tualatin CPU microcode and maybe change the CL3 to CL2 for the RAM. The second task is unknown to me, but I will search for it. But first I have to learn how to fix CRC.

[rl78family]

Hi, here is Crisis Disk build tool to restore bricked TLA715.
It's based on this tool https://web.archive.org/web/20021115014239/http://www.radisys.com:80/files/support_downloads/SF81010002.ZIP, and files from "TLA715-BIOS-102.zip".
Tested under WinXP SP3 and my TLA715. Also there is *.bat file, so should work under DOS.
Please don't modify any files on floppy. Disk boot record on floppy can't search files, it's able only load first record (MINIDOS.SYS) and pass control to it.