Tektronix Technical Forums are maintained by community involvement. Feel free to post questions or respond to questions by other members. Should you require a time-sensitive answer, please contact your local Tektronix support center here.
TDS420 Options Possible?
-
- Posts: 14
- Joined: February 5th, 2018, 6:52 pm
- Country: Australia
TDS420 Options Possible?
Hello,
i hope this topic is not redundant, but i have been resceaching if it is possible to recover the lost options in a TDS420.
As far i found out that no one did achieve ore post about it, just some speculations.
It would be very kind if someone who is in the know can tell if this is possible and when not why especially this is the case.
I also tried some thins, but no luck. Im very open for Suggestion.
Also im not 100% sure the options are stored in the VRam but it seams to be the case.
Thank you for your time
Regards
Igor
i hope this topic is not redundant, but i have been resceaching if it is possible to recover the lost options in a TDS420.
As far i found out that no one did achieve ore post about it, just some speculations.
It would be very kind if someone who is in the know can tell if this is possible and when not why especially this is the case.
I also tried some thins, but no luck. Im very open for Suggestion.
Also im not 100% sure the options are stored in the VRam but it seams to be the case.
Thank you for your time
Regards
Igor
-
- Posts: 14
- Joined: February 5th, 2018, 6:52 pm
- Country: Australia
Re: TDS420 Options Possible?
Hi,
Does no one know if it is even possible would be nice to know,
Thanks
regards
Does no one know if it is even possible would be nice to know,
Thanks
regards
Re: TDS420 Options Possible?
Most probably. And I'd also bet that they're saved in the NVRAM. If you have a firmware ROM dump I can take a quick look.Igorkasona1233 wrote: ↑February 5th, 2018, 7:02 pmi hope this topic is not redundant, but i have been resceaching if it is possible to recover the lost options in a TDS420.
-
- Posts: 14
- Joined: February 5th, 2018, 6:52 pm
- Country: Australia
Re: TDS420 Options Possible?
As far as i have look it should be in the NVRAM, Ok i will try to dump the Firmware. It may take a bit until i have dumped it, i think it only works over GPIB not over the serial. I never tried it with my interfaces to do this.
Thanks for the help
regards
Thanks for the help
regards
Re: TDS420 Options Possible?
It *is* possible to dump the firmware over the serial console, but it's ridiculously slow. Like < 100 *bytes* per second ! (9600bps, but the data is formatted as an ASCII hex dump. Horrible.)Igorkasona1233 wrote: ↑April 25th, 2018, 3:45 amAs far as i have look it should be in the NVRAM, Ok i will try to dump the Firmware. It may take a bit until i have dumped it, i think it only works over GPIB not over the serial. I never tried it with my interfaces to do this
Actually if you have the serial console hooked up, you could try just viewing the option words with these commands
Code: Select all
libManagerWordAt(0x50006)
libManagerWordAt(0x50007)
...
libManagerWordAt(0x5000F)
libManagerWordAtPut(0x50006, 1) <- Enable option 1M
libManagerWordAtPut(0x50007, 1) <- Enable option 05
libManagerWordAtPut(0x50008, 1) <- Enable option 13
libManagerWordAtPut(0x50009, 1) <- Enable option 2F
libManagerWordAtPut(0x5000a, 1) <- Enable option 1F
libManagerWordAtPut(0x5000c, 1) <- Enable option 2C
libManagerWordAtPut(0x5000d, 1) <- Enable option 3C
libManagerWordAtPut(0x5000e, 1) <- Enable option 4C
libManagerWordAtPut(0x5000f, 1) <- Enable option 2M
-
- Posts: 14
- Joined: February 5th, 2018, 6:52 pm
- Country: Australia
Re: TDS420 Options Possible?
I have once tried it over the Serial Port and only a view commands are working like clearing the Log, but all the other ones are not working but i may try it again. I did not got the tekfwtool working yet it does not see the NI ViSA... . I Have read that some did play around with the idea doing it over the Serial Port. Something i found quite odd is that i no one ever succeed in enabling Options on a 420.fenugrec wrote: ↑April 28th, 2018, 6:15 pmIt *is* possible to dump the firmware over the serial console, but it's ridiculously slow. Like < 100 *bytes* per second ! (9600bps, but the data is formatted as an ASCII hex dump. Horrible.)Igorkasona1233 wrote: ↑April 25th, 2018, 3:45 amAs far as i have look it should be in the NVRAM, Ok i will try to dump the Firmware. It may take a bit until i have dumped it, i think it only works over GPIB not over the serial. I never tried it with my interfaces to do this
Actually if you have the serial console hooked up, you could try just viewing the option words with these commandsIf you're lucky, those would match the option #s for later scopes :Code: Select all
libManagerWordAt(0x50006) libManagerWordAt(0x50007) ... libManagerWordAt(0x5000F)
libManagerWordAtPut(0x50006, 1) <- Enable option 1M
libManagerWordAtPut(0x50007, 1) <- Enable option 05
libManagerWordAtPut(0x50008, 1) <- Enable option 13
libManagerWordAtPut(0x50009, 1) <- Enable option 2F
libManagerWordAtPut(0x5000a, 1) <- Enable option 1F
libManagerWordAtPut(0x5000c, 1) <- Enable option 2C
libManagerWordAtPut(0x5000d, 1) <- Enable option 3C
libManagerWordAtPut(0x5000e, 1) <- Enable option 4C
libManagerWordAtPut(0x5000f, 1) <- Enable option 2M
Re: TDS420 Options Possible?
To be clear, I meant the serial "service console" connection only accessible inside the unit's case, not the regular RS232 interface on the back panel.Igorkasona1233 wrote: ↑April 29th, 2018, 1:46 pmI have once tried it over the Serial Port and only a view commands are working like clearing the Log, but all the other ones are not working
-
- Posts: 14
- Joined: February 5th, 2018, 6:52 pm
- Country: Australia
Re: TDS420 Options Possible?
I know, going to try some things the in the next view daysfenugrec wrote: ↑April 29th, 2018, 3:49 pmTo be clear, I meant the serial "service console" connection only accessible inside the unit's case, not the regular RS232 interface on the back panel.Igorkasona1233 wrote: ↑April 29th, 2018, 1:46 pmI have once tried it over the Serial Port and only a view commands are working like clearing the Log, but all the other ones are not working
-
- Posts: 14
- Joined: February 5th, 2018, 6:52 pm
- Country: Australia
Re: TDS420 Options Possible?
Im probably to stupid to use a console but i only got the "scopeErrorLogDumpToConsole" to work every other one just is a undefind symbol.
Code: Select all
-> scopeErrorLogDumpToConsole
No error log entries
alue = 149 = 0x95
-> help
undefined symbol: help
-> libManagerWordAt 0x50006
undefined symbol: libManagerWordAt
->
Re: TDS420 Options Possible?
Code: Select all
-> help
undefined symbol: help
Some other commands you could try : "lkup" and "lkAddr 0x1000000", those may help find which other commands are defined.
-
- Posts: 14
- Joined: February 5th, 2018, 6:52 pm
- Country: Australia
Re: TDS420 Options Possible?
Ok here the results
Something interesting is that i always get something weird in the two lines
"Start PowerhOw Diag SAquence
ccountant probe routines"
they seem to be different every time i start the instrument, I dont know what is causing that, i might look at the signals with an analyser and see what is going on there.
interesting command Lkup, at the end i also tried the lkAddr but as suspected also did not work
Also i tried to dump the NVRAM and firmare through GPIB but not really successful only got a part of the Firmware i think. Maybe the address space is different in the TDS420 this was only a crude attempt
Code: Select all
Bootrom Header Checksum passed.
Bootrom Total Checksum passed.
BootRom Check Sum passed.
Bus Error Timeout test passed.
Bus Error Write to Bootrom passed.
GPIB Test passed.
Kernel Diagnostics Complete.
Calling SDM (monitor) Routine.
SDM (monitor) not enabled.
Enabling Bus Control register. Value = 0x2
Flashrom Programming Voltage is OFF.
Flashrom DSACK and JumpCode test passed.
Flashrom Checksums passed.
Bootrom Diagnostics Complete.
Transferring control to the Flashrom.
sysDramControllerInit
sysDramByteStrobeTest
sysDramTest
bcopy(<Idata>)
bzero(<bss>)
intVecBaseSet(getVbr())
sysSymTbl=standAloneSymTbl
sysDevDramTest
0x0 bytes of development dram found
validateDataSpace
Outer Kernel DSACK Test
Pending Interrupt Test
Walk IPL to Zero Test
Timer Int Test
Start PowerhOw Diag SAquence
ccountant probe routines
Probe for unexpected pending ints
Dsp Instr mem size
Dsp D2 mem size
Dsp D1 mem size
Dsy Vect0 mem size
Dsy Vect1 mem size
Dsy Wfm0 mem size
Dsy Wfm1 mem size
Dsy Text0 mem size
Dsy Text1 mem size
Acq number of digitizers
Acq mem size
Cpu timer interval uSec
Cpu Dram size
NvRam mem size
Opt RS232/ Cent presence
Acq 8051 presence
Acq ADG209C presence
Acq record length size
syWaitClock ................... pass
clockCalVerify ................. pass
cpuDiagBatTest ................. pass
cpuDiagAllInts ................. pass
cpuEEromLibDiag ................ pass
calLibDefaultCk ................ pass
dspForcedBus ................... pass
dsp68kD2MemTest ................ pass
optRS232DuartIO ................ UNTESTED
dsp68kMemTest .................. pass
dspRunVerify ................... pass
dspBusRequestTest .............. pass
dspImplicitBusAccess ........... pass
dspTristarMemTest .............. pass
dspDsyToDspInts ................ pass
dspAcqToDspInts ................ pass
nvLibrariansDiag ............... pass
dsyDiagResetReg ................ pass
atBusTest ...................... pass
dsyDiagResetReg ................ pass
dsyDiagVscReg .................. pass
dsyDiagPPRegMem ................ pass
dsyDiagRasRegMem ............... pass
dsyDiagRegSelect ............... pass
dsyDiagRamdacRegMem ............ pass
dsyDiagAllMem .................. pass
dsySeqYTModeV0Intens ........... pass
dsyDiagSeqXYModeV1 ............. pass
dsyRastModeV0Walk .............. pass
dsyRastModeV1Attrib ............ pass
dsyWaitClock ................... pass
attn8051testResult ............. pass
attnDACReadback ................ pass
acq8051testResult .............. pass
adgRegDiag ..................... pass
dsyWaitClock ................... pass
adgMemTestDiag ................. pass
trigComparatorTest ............. pass
trigDBERunsAfter ............... pass
tbiRampTest .................... pass
acqRampDiagAll ................. pass
dsyWaitClock ................... pass
fpDiagConf ..................... pass
$Header: scopeSTR.version,v 1.94 93/03/29 14:05:04 aland Exp $
->
Smalltalk/V Sun Version 1.12
Copyright (C) 1990 Object Technology International Inc.
"Start PowerhOw Diag SAquence
ccountant probe routines"
they seem to be different every time i start the instrument, I dont know what is causing that, i might look at the signals with an analyser and see what is going on there.
interesting command Lkup, at the end i also tried the lkAddr but as suspected also did not work
Code: Select all
lkup
_verState 0x01001bcb text
_verSource 0x01001beb text
_verRevision 0x01001bd9 text
_verHeader 0x01001b60 text
_verDate 0x01001bb0 text
_verAuthor 0x01001b9f text
_v 0x01152d80 text
_ttExcludeSetup 0x01153aae text
_tt 0x01000a82 text
_ts 0x01004954 text
_tr 0x010049ac text
_ti 0x01004aa2 text
_td 0x01004a1a text
_sysNvRamSet 0x0100215a text
_sysNvRamGet 0x01002134 text
_syncClock 0x01153284 text
_sdata 0x02f01000 data
_scopeErrorLogDumpToConsole 0x01117b8c text
_scopeErrorLogClear 0x01117222 text
_runScope 0x01001a0c text
_repeatRun 0x01004102 text
_repeat 0x0100415a text
_repairSemOn 0x0116a408 text
_repairSemOff 0x0116a3fa text
_pu_diag 0x0110c246 text
_periodi 0x010040b2 text
_periodRun 0x01004064 text
_patGen 0x011491c0 text
_pL 0x02f12478 bss
_mRegs 0x01005f20 text
_m 0x01004c2e text
_logIBuffer 0x0110bcce text
_lkup 0x01005808 text
_i 0x01004708 text
_dumpPort 0x01118ef4 text
_dumpMepe 0x011190ae text
_dumpConstants 0x01142424 text
_dumpCalSet 0x011426c8 text
_dumpBuffer 0x01118c80 text
_devs 0x010057fa text
_debugMode 0x02f2811c bss
_d 0x01004d5e text
_centronicsPutMsgHardcopy 0x01132b34 text
_centronicsPutC 0x01132a5c text
_bzero 0x0115ca88 text
_bfill 0x0115c930 text
_bcopy 0x0115c722 text
_bcmp 0x0115c9d2 text
value = 1 = 0x1
-> lkAddr 0x1000000
undefined symbol: lkAddr
->
- Attachments
-
- tds420.zip
- (1.29 MiB) Downloaded 361 times
Re: TDS420 Options Possible?
Code: Select all
nvLibrariansDiag
Funny, that looks like a buffering bug in the firmware where "Start PowerOn Diag Sequence" gets"Start PowerhOw Diag SAquence ccountant probe routines"
they seem to be different every time i start the instrument,
interleaved with "hwAccountant probe routines", but that wouldn't explain why a few characters are dropped. I wouldn't worry too much about it.
Code: Select all
lkup
ROM dump : from what I see you seem to have succesfully dumped the main ROM mapped at 0x0100 0000, but there's probably a part missing - you stopped at 3MB (0x012f ffff) but I'm pretty sure there's more. I see references to lkAddr , help, and the usual vxworks commands inside it; I'm not sure why they're not available. Perhaps only available under certain conditions ?
In any case, I've found some interesting things that look very similar to the later firmwares I'm more familiar with. What options are you missing ? So far, I see
Code: Select all
1M 0x50006
Math 0x5000F
0x50006 actually means "librarian #5, item #0006". The "librarian" is a piece of code + some data tables which associate the librarian #, and item #, to an NVRAM address. So it is possible to manually figure out where it's stored in the NVRAM, but way easier to just use libManagerWordAtPut. Your firmware almost certainly has that function, it's just a matter of finding and running it.
-
- Posts: 14
- Joined: February 5th, 2018, 6:52 pm
- Country: Australia
Re: TDS420 Options Possible?
I know, that it is not important but found it funny, saw it also this in someones else's scope.Funny, that looks like a buffering bug in the firmware where "Start PowerOn Diag Sequence" gets
interleaved with "hwAccountant probe routines", but that wouldn't explain why a few characters are dropped. I wouldn't worry too much about it.
No, lkup returns the same commands
Yup that dump is the Main Firmware but i got an error before it all was dumped, im maybe using the wrong address range.
You have quite a knowledge about those systems like vxworks, is there anything to read about it or is it just accumulated knowledge

I did not intentionally stop at 0x012f ffff, i used the Tekfwtool and got always the error "read_memory: invalid response: S" either S or + as invalid response. Maybe im using wrong arguments.
The options 1M and Math are missing, interesting to know about the libManager.
I dont want to occupy your time with my dumb questions, sorry.
Re: TDS420 Options Possible?
Well I'm almost 100% sure you have the correct start address 0x0100 0000, because I recognize the first few hundred bytes as very similar to other ROMs.Igorkasona1233 wrote: ↑May 25th, 2018, 8:55 amYup that dump is the Main Firmware but i got an error before it all was dumped, im maybe using the wrong address range.
About your tekfwtool error, that's strange. You could try starting a short dump at 0x0130 0000 with debugging enabled, see what it says.
Hmm, mostly accumulated knowledge from looking at my scope's firmware disassembly, as well as some threads here, in particular posts by @strick and @cap . I don't know a lot about vxworks but I played with the console a bit, so I know it can usually look into a global symbol table to find the requested function, and calls it directly. In your case, it seems the default "smalltalk" console is independant from vxworks; you'd have to find out how to get the vxworks console enabled.is there anything to read about it or is it just accumulated knowledge
Yep the options are definitely verified/changed through the libManager mechanism that I described. Your questions are not dumb at all, this stuff is very undocumented.The options 1M and Math are missing, interesting to know about the libManager.
I dont want to occupy your time with my dumb questions, sorry.
-
- Posts: 14
- Joined: February 5th, 2018, 6:52 pm
- Country: Australia
Re: TDS420 Options Possible?
I thought so too, also besause of "COPYRIGHT TEKTRONIX INC, 1989,1990,1991,1992" in the beginning.
Ok i will try it to see what is causing the error, with debugging enabled.
That is also what i encountered that there is little to none information about this anywhere.
I will try to read up things about others scopes etc. maybe i can find a way to get access to the commands.
Thank you for your Help so far!
Ok i will try it to see what is causing the error, with debugging enabled.
That is also what i encountered that there is little to none information about this anywhere.
I will try to read up things about others scopes etc. maybe i can find a way to get access to the commands.
Thank you for your Help so far!
-
- Posts: 14
- Joined: February 5th, 2018, 6:52 pm
- Country: Australia
Re: TDS420 Options Possible?
How do i actually use the debug feature, i tried some things, looking in the "tekfwtool.c" i found the arguments, maybe you can give me a hint how to type the command, just using the -d is not working 

Re: TDS420 Options Possible?
strange, either -d or --debug should work... did you compile yourself ?Igorkasona1233 wrote: ↑May 26th, 2018, 9:07 amHow do i actually use the debug feature, just using the -d is not working :)
-
- Posts: 14
- Joined: February 5th, 2018, 6:52 pm
- Country: Australia
Re: TDS420 Options Possible?
No, i used the EXE, -d or --debug did not return more info, i think im cursed or something else.
Who is online
Users browsing this forum: No registered users and 9 guests