Tektronix TDS500/600/700 NVRAM floppy backup and restore tool

[flyte]

Hi all,

As many of these great Tektronix TDS scopes are ageing, they will have their NVRAMs sooner or later wiped due to battery failure and because AFAIK the only way to safely dump the NVRAMs contents is via a GPIB interface, which not every scope owner has, I've decided to write a small script which simply dumps the NVRAM contents to a floppy disk. As most TDS scopes, and certainly the higher spec'd ones, have a floppy disk option, taking a backup this way would be a quick win for anyone looking to do so or worrying about imminent battery doom.

The script is based on the JRE installer script and reads 0xA0000 bytes from the base address 0x4000000 (contiguous 128K DS1486 and 512K DS1250Y), so it should work with the TDS700C/D and TDS600C series. It has been tested on TDS754D, TDS784D and TDS694C. Adapting it to TDS series with different NVRAM addresses should be easy.

Simply put the attachment's contents into an (old) FAT formatted floppy and start up the scope with the disk mounted. About 10s after boot, it will dump the NVRAMs to dump.bin on the floppy. Use an error-free floppy and preferably first format it on the scope itself using the normal file utilities for best compatibility.

Make sure you rename the dump.bin right away to include the scope model and serial number, as there is no way to derive that from the binary dump afterwards.

Have fun saving your equipment!   

flyte

-- EDIT/UPDATE:

If we can read this way, we can also write!   

So I've made a second script which will load an NVRAM dump back into the scope via floppy. Works the same way as the dumper, but expects a file writedmp.bin on the disk. Tested on a TDS754D scope, works perfectly. Note that loading a dump from a different scope will mess up all calibration values, so please be honest when offering scopes "repaired" this way and mention it to your buyer.

BTW, if you are looking for a factory new genuine Dallas DS1486, I have some left from known distributor origins. It's likely to be one of the very last batches, as the production stopped years ago and worldwide stocks are now depleted, and what now remains are Ebay floods of Asian counterfeits with all sorts of issues.

-- EDIT/UPDATE 2:

Made a new set of scripts v3, the previous download's nvram restore/write script did not write correctly in some cases which lead to a corrupt nvram, even if the file was fine, as it appeared. Also, the backup/dump script seemed to hang on A-series scopes, a TDS524A in the case tested. Please delete your old downloads, replace them with the new scripts and check info.txt in the archive.

-- EDIT/UPDATE 3:

Added a checksum verification tool so everyone can verify the dump taken has valid checksums on critical calibration data. Even though it contains checksum locations for a range of firmware versions and models, you may encounter an unrecognized NVRAM firmware prototype. Also, there may be locations in the NVRAM with other checksums than what is supported by the tool, but those verified by it are the critical ones regarding calibration and proper startup. It's written in Java, you need to install a Java JRE on your computer in order to use it. Run command example:

Code: [Select]

java -cp TDSNvrCV_1_0.zip TDSNvramChecksumVerifier DUMP.BIN
-- EDIT/UPDATE 4:

Added scripts to backup the factory calibration constants in the EEPROMs on acquisition boards of -B, -C and -D series scopes, starting with firmware v4.x. Check info.txt inside the archive. The checksum verifier has been updated to allow verification of the acquisition EEPROM dumps, and the tool will attempt to detect based on file size whether the dump is an NVRAM or acquisition EEPROM.

Code: [Select]

java -cp TDSNvrCV_2_0.zip TDSNvramChecksumVerifier DUMP.BIN
-- EDIT/UPDATE 5:

New version of the scripts which allow you to also write the EEPROMs on acquisition boards of -B, -C and -D series scopes, starting with firmware v4.x. Be very careful when using this function, you may permanently destroy your scope. Check info.txt inside the archive. The checksum verifier is now part of the archive.

[flyte]

Please leave your comment including scope model number and firmware revision for other users to know whether it worked ok.

[flyte]

To those following this thread: old release had several bugs and problems please update your download with the new and better release v3 available in first post 

[Treehouseman]

Would it be possible to make this dump the contents of the firmware off the flash, and would this be possibly be able to restore a bricked scope? I know that the flash is already too big to be dumped all at once, when I finally did get some output over gpib it was 3MB of data, so it would have to be done over multiple reads.

[tinhead]

thanks for the update @flyte

[flyte]

In theory, yes. Pratically speaking no.

Grabbing a dump in multiple files wouldn't be a big problem, but would that be useful in any way? That flash is not going to die anytime soon, the NVRAMs will. Meanwhile you can find the latest firmwares for the respective series in several places.

In order to flash, multiple problems exist. The floppy is too small, so you'd have to chop it up and make a small tool to do so automatically. Next you'd need to write a small piece of 68k flash code (similar to target.bin in tekfwtool) and somehow reboot the CPU into that instead of the VxWorks OS, or write some VxWorks compatible flash program and then hope during flashing the OS does not access it.

I think the trade-off effort vs. benefit would no longer be okay here. If you want to flash, get a GPIB interface.

The reason for making these small scripts was to allow people to easily safeguard and eventually replace their NVRAMs without buying a GPIB interface, or, worse, start opening up the scope and desolder the whole thing or even destroying it in the process of attempting to do so.

[OH2LIY]

Here is my dump from 754C fw:5.3e modified to 784C plus added options via GPIB...

TNX!

[flyte]

An update regarding the tool:

In order for the writing script to work on several older models like the TDS524A, you should flip the calibration/write protection switch. Most firmwares refuse to boot when flipping the switch and thus the floppy disk script can't start, so you may have to flip the switch the exact moment the floppy disk light comes on for the first time, after boot. This is because part of the calibration in the NVRAM is hardware write-protected. Later models like the TDS754D have that part of the calibration stored in EEPROMs on the acquisition board, and have no NVRAM write protection.

I can confirm replacing the old DS1650Y of a TDS524 by a regular DS1250Y does work without faults. The DS1650Y only has the extra functionality to write protect certain partitions of the NVRAM. As the script does not perform any unlocking, replacing the DS1650Y with a DS1650Y (in case you'd ever manage to get an original one) might not work, if Tektronix decided to also use that partition locking feature.

In case you'd need a genuine DS1486 or DS1250Y and not the Asian counterfeits from Ebay, please P.M. me, I have some more left.

[Galen]

Hi Flyte,
Thanks a lot for developing this excellent tool. It will help many TDS owners like me.
I have a TDS540C with firmware v5.0e, with 1F, 1M, 2F option. Tried this tool which use buffer when dumping, the floppy lights 2 times during startup, but didn't start to dump when start the scope. Tried a few times, still doesn't work.
Then I tried the minimal floppy dumper, it works, and got the dump.bin on the disk. But I didn't try to use it to write back as minimal writer does not use a buffer and may cause writing problem as stated in the info.txt.
The disk quality is good as it works when using minimal dumper. So, do you think where is the problem? Maybe my scope setting need some change? Or what procedure I should follow when using the bufferred dumper?

Thanks again.

[Galen]

Upload the NVRAM dump of my TDS540C (firmware 5.0e) dump image here. Only the minimal dumper works. So don't know if this  dump.bin is correct or not.
My TDS540C NVRAM chips are  DS1486 and DS1650Y.

[Rollin Hand]

Hello
How you separete from the dump the contents for the ds1486 and the ds1250 for use to program the chips with a burner.Thanks

[Galen]

You can make change to the address in the startup.bat,  then you can get the dump for each chip seperately. I didn't try this, but look into the startup.bat, this should work.

[Ice-Tea]

You must be the most thanked 11-post poster in the history of the EEVBLOG!

Well done!

[Galen]

Update the progress. After I got the 640K NVRAM dump (used a few disks to dump a few times, to make sure dump quality), I decided to have a try to write it back to the NVRAM. Inserted the disk into the scope and push the on button. After 2 times floppy drive lighting on, the scope restarted. Withdraw the disk immediately. The scope continued the startup process, a little different with normal startup. Finally, the familiar screen appeared, all options still there. No other different, just the time display changed to the time when this dump was made. This indicated the writing was successful. Great! I have been worrying about the NVRAM battery after I got this old TDS540C. Now, no worry!
Thanks Flyte again! Great tool!

[Galen]

Then another question is, it's said the options are stored in DS1486, address from 0x04000000 to 0x4020000, this means if I know the address, then can revise that data and use floppy to write back. No need for GPIB card and driver/software which is not very easy to play with. Right?

Anybody know the option bit address?

[Galen]

Found dxl's post on:  https://www.eevblog.com/forum/testgear/hackingupgrading-old-scope-(tds754d)/msg492404/#msg492404
--------------------------------------------------------------------------------------
dxl wrote:
on the TDS784D i looked at, the addresses where:
NVRAM:0400081C 0000                                dc.w 0                  ; 5 - TV Trig
NVRAM:0400081E 0000                                dc.w 0                  ; 6 - Option 1M
NVRAM:04000820 0000                                dc.w 0                  ; 7
NVRAM:04000822 0001                                dc.w 1                  ; 8 - Option 13
NVRAM:04000824 0001                                dc.w 1                  ; 9 - Option 1F
NVRAM:04000826 0001                                dc.w 1                  ; A - Option 2F
NVRAM:04000828 0000                                dc.w 0                  ; B
NVRAM:0400082A 0001                                dc.w 1                  ; C - Option 2C
NVRAM:0400082C 0000                                dc.w 0                  ; D - Option 3C
NVRAM:0400082E 0000                                dc.w 0                  ; E - Option 4C
NVRAM:04000830 0001                                dc.w 1                  ; F - Option 2M
Those adresses could be completely different on your scopes firmware, and i think the data has a checksum associated.
-------------------------------------------------------------------------------------------
So I used a DS1486 dump, tried to change the 0000 at address 0000082A (the dump file address start from 00000000), then floppy write back to DS1486, the 2C option didn't appear when restarted the TDS540C. Looks like I didn't find the right address?

[Galen]

Upload the DS1486 dump here, it's from TDS540C, Fv5.0e. For study and find the option bit.

[Galen]

Problem solved! The solution is 'flip the calibration/write protection switch'. As Flyte's update in this post, flip the switch when the floppy drive light for the first time; when re-starting, flip this switch back to protect position.

Using this magic, I added 2C option for my scope. Check through the COMM function buttons, all there same with the user manual stated. Thanks Flyte, again!

[eKretz]

That is great! Very cool that this works. I'd thank the O.P. 10 times if I could...I love my TDS.

[Rollin Hand]

Can you post the startup file for each of the dallas chips ,I modify the startup file to ""taskSpawn ("nvramdumper",1,0x0,40800,sysExecScript,"fd0:/nvdump.app") "  and I got another dump of 640 k or can you tell me how to divide the 640 k dump.
Thank you

[Galen]

@ Rollin Hand, I used the minimal dumper, as the buffer one didn't work on my scope.

For DS1486,  use:
nvrBase=0x4000000
nvrSize=0x20000

For DS1650, use:
nvrBase=0x4020000
nvrSize=0x80000

Hope this can help you.

Galen

[Rollin Hand]

Galen :

it works on my tds724d without moving the protection switch .
I got 2 files with the limited dump with the ranges changed, after inspect the  files with an hex editor I saw the data with options on the file the next step is to burn the 2 dallas chips .Thank you

[casinada]

Rollin,
You don't need the protection to read or dump information from the scope, only when you want to write back to it. 

[sorenkir]

Hi,
Minimal dump seems to work on my TDS520B (firmware v4.1e), without moving the protection switch.

I have tried 3 times and compared the files.
I have a few differences each time.
I am assuming this is normal as they are always at about the same addresses (?)...

Code: [Select]

>fc /b "DUMP TDS520B 20190303.BIN" "DUMP TDS520B 20190303 (2).BIN"
Comparaison des fichiers DUMP TDS520B 20190303.BIN et DUMP TDS520B 20190303 (2).BIN
00000000: 18 89
00000001: 30 18
00000002: 59 31
00000004: 21 22
00000010: 02 03
0000141E: FE E2
0000141F: 9D 9F
00001AEF: E0 E2
00001AF0: 31 15

>fc /b "DUMP TDS520B 20190303 (2).BIN" "DUMP TDS520B 20190303 (3).BIN"
Comparaison des fichiers DUMP TDS520B 20190303 (2).BIN et DUMP TDS520B 20190303 (3).BIN
00000000: 89 95
00000002: 31 39
0000141E: E2 B3
0000141F: 9F 98
00001AEF: E2 DB
00001AF0: 15 E6

Michel.

[flyte]

Great to read you find it useful, I hope it'll save many scopes from the waste bin!   

A combined reply to various questions:

• As configured by default, the tool grabs both the contents of the DS1486 and DS1250Y in one file, as they are adjacent in memory space. The DS1486 comes first starting at dump position 0x0, then the DS1250Y starts at position 0x20000 until 0xA0000. You can simply split the file using a hex editor, no need for multiple scripts.
• I do not recommend this unless you have alternative ways to recover from failure and are sure about the backup, but for the brave who want to test whether it really works as expected and plan for the ultimate rescue action, you should write a random garbage dump of the same size to your NVRAMs first. As I said, make sure it doesn't turn into ultimate destruction ... . Then power up the scope, it will reboot, may hang on invalid data, but it will load default NVRAM values eventually, including a (wrong) default calibration. Then write the NVRAMs using the tool and everything should be back to normal. I tried this on a TDS754D and it worked.
• The protection switch flipping right before writing starts only seems required on older models. The D-series scopes can be written without flipping the switch.
• The structure of the dump varies with model and firmware number, but seems unchanged across major versions and equivalent hardware. E.g. TDS520D/../TDS724D/754D/784D running 7.x all have the same structure. There is a checksum over several sections in the dump, if time allows and it makes sense to do so (due to the many variants), I may write a small tool which computes the checksum, so you can be sure the dump taken is correct.
• Dumps will indeed never be the same. For a start, at position 0x0 there is the DS1486 clock which simply ticks further until the end of times. Then there is also a vast part of the NVRAM used for saving (GUI) settings and error logs, and diagnostic results. The most critical part is the section which stores calibration constants and the section configuring the hardware. All other sections may be initialized to default values without penalty to the user.