Hacking/Upgrading old scope (TDS754D)

[AwArD_RzD]

Just got a nice TDS754D for 700$ on Ebay, 500Mhz 2gs/s 4 channel, very bright screen and the front panel is very clean, this will be a nice high bandwidth addition for my lab, the only downside, the scope have only the STD option so a floppy, rs-232 and the FFT advanced math function.

I found the user and the service manual and i didn't find anything about the memory upgrade in it and it seem this generation of scope is buried in the late 90 internet because i only found this PDF http://globaltestsupply.com/datasheets/tdsxf2c.pdf explaining the instruction how to upgrade it with the Option Key disk, so it seem to be only a software upgrade.

Is there any other method to modify the firmware to unlock the memory or other option inside the scope  , i didn't found the Option key disk for now, so if someone know how to unlock the option without it or have a copy of this disk i will be interested to try it.

Thanks !!

[dxl]

There are two ways:

a) You need a console Adapter like this:
     http://www1.tek.com/forum/viewtopic.php?f=5&t=5526&p=10588&hilit=pitbull#p10588
     
     Interesting commands on my TDS7xx scopes:

     libManagerWordAtPut(0x50006, 1) <- Enable option 1M
     libManagerWordAtPut(0x50007, 1) <- Enable option 05
     libManagerWordAtPut(0x50008, 1) <- Enable option 13
     libManagerWordAtPut(0x50009, 1) <- Enable option 2F
     libManagerWordAtPut(0x5000a, 1) <- Enable option 1F
     libManagerWordAtPut(0x5000c, 1) <- Enable option 2C
     libManagerWordAtPut(0x5000d, 1) <- Enable option 3C
     libManagerWordAtPut(0x5000e, 1) <- Enable option 4C
     libManagerWordAtPut(0x5000f, 1) <- Enable option 2M

b) Use a GPIB Adapter

I don't remember the exact syntax, but it should be:

PASSWORD "PITBULL"
WORDCONSTANT:ATPUT 327686,1

Where the decimal number (327686 in that case) is the same number as in the console-port-example above, just in decimal.

Note that you have to set the flash write protection switch to unlock to write those settings.

[AwArD_RzD]

Thanks you very much,

since i start to have many GPIB stuff in the lab i think to buy an adapter and doing that over the GPIB but i found that little thing cost an arm and leg. There some homemade/clone on Ebay like this one http://www.ebay.ca/itm/USB-to-GPIB-Adapter-rev4-/281376900064?pt=LH_DefaultDomain_2&hash=item41835ec3e0 .

he sold some and never had complain and for this price if it do the job this will be great. Anyone know the limitation for these thing ?

[Wuerstchenhund]

since i start to have many GPIB stuff in the lab i think to buy an adapter and doing that over the GPIB but i found that little thing cost an arm and leg. There some homemade/clone on Ebay like this one http://www.ebay.ca/itm/USB-to-GPIB-Adapter-rev4-/281376900064?pt=LH_DefaultDomain_2&hash=item41835ec3e0 .

he sold some and never had complain and for this price if it do the job this will be great. Anyone know the limitation for these thing ?

Why pay that much for a very basic GPIB interface when a few bucks more give you a fully Agilent compatible clone with certain driver support?
www.ebay.ca/itm/S82357-GPIB-USB-interface-Agilent-82357B-compatible-/171387561919

[AwArD_RzD]

since i start to have many GPIB stuff in the lab i think to buy an adapter and doing that over the GPIB but i found that little thing cost an arm and leg. There some homemade/clone on Ebay like this one http://www.ebay.ca/itm/USB-to-GPIB-Adapter-rev4-/281376900064?pt=LH_DefaultDomain_2&hash=item41835ec3e0 .

he sold some and never had complain and for this price if it do the job this will be great. Anyone know the limitation for these thing ?

Why pay that much for a very basic GPIB interface when a few bucks more give you a fully Agilent compatible clone with certain driver support?
www.ebay.ca/itm/S82357-GPIB-USB-interface-Agilent-82357B-compatible-/171387561919

Because i don't know anything about the GPIB stuff and this unit caught my attention, but i will probably buy the one you linked, the more i read the more i see that even if they use the same standard, speaking with the GPIB device seem to need some understanding of the driver/software to be sure everything work perfectly. I have a HP8594e in the lab and the TDS754D is in the mail, as old device i don't think to have difficulty with a know driver/clone.

Does i need the GPIB cable to speak with 1 unit, i assume the cable is to link many unit but does it work if i plug the GPIB interface direct in the port ?

[Wuerstchenhund]

Does i need the GPIB cable to speak with 1 unit, i assume the cable is to link many unit but does it work if i plug the GPIB interface direct in the port ?

Yes, you can plug in the GPIB adapter directly into the instrument.

[AwArD_RzD]

Thanks Wuerstchenhund

Is there any option to backup the NVRAM over the GPIB before i attempt something ? Since i have no idea if the nvram/battery was ever replaced i will need to put that on my to do list.

I saw many post where people de-solder the Dallas nvram but it seem there a chance where i kill the battery with the heat and loose the data inside, i see many tds500 post where this happened but no one seem to ever did that with the tds754d. Since i don't have the unit for now i really don't know how it look inside or what's the chip inside and the service manual don't tell anything about the nvram model only the 5 year shelf life.

[dxl]

I wrote a tool for reading/writing memory from TDS700 series scope a while ago:

http://stackframe.org/tektool.shtml

[nctnico]

I have unsoldered several NVRAMs from TDS5xx/6xx/7xx scopes and never had a problem. One thing you must do is solder the NVRAM in a socket and then use an EPROM programmer to read the contents. Unsoldered pins make very poor contact in a ZIF socket.

[AwArD_RzD]

I wrote a tool for reading/writing memory from TDS700 series scope a while ago:

http://stackframe.org/tektool.shtml

Thanks i will take a look.

I have unsoldered several NVRAMs from TDS5xx/6xx/7xx scopes and never had a problem. One thing you must do is solder the NVRAM in a socket and then use an EPROM programmer to read the contents. Unsoldered pins make very poor contact in a ZIF socket.

Do you know the nvram model for the tds754d ? I found no picture of the inside or mention in the documentation, i talked with the vendor and it seem this unit was a backup and was on a shelf for a long time so i will probably backup and change  the chip asap. I have a order pending at Digikey if it's still available there i will put it in the order.

[nctnico]

I wouldn't bother replacing the NVRAM. Just make a backup and use when necesary. My TDS scopes still have their original NVRAM and they are a lot older than yours.

[AwArD_RzD]

I wouldn't bother replacing the NVRAM. Just make a backup and use when necesary. My TDS scopes still have their original NVRAM and they are a lot older than yours.

Only want to be on the safe side and well if i need to desolder the thing to do the backup, why not replacing it. Everything is always fine till you need really need to use the scope.

I'm a electro-mechanical technician, when we do repair/maintenance we always check everything because if the assembly chain / process stop, this can sometime cost 1K$/minute (and more) to the owner and well this can cost your job at this rate, it's just a crazy job side effect applied to my hobby environment  

[nctnico]

I make a living using my oscilloscopes so I make sure I have two. If one fails I just use the other.

[romantao]

I'm also a recent proud owner of a tek754A which i scored for 500$ in very good cosmetic state and fixed by changing the hybrid board relays

I'm not sure if i misread some forum post but I have the idea that, at least in the tds7xx series, the nvram only keeps the scope settings and activated options (which can be reactivated using gpib interface). The calibration values are not stored there but in some eeprom in the acquisition board. Therefore it's not so critical to replace the nvram as in the 5xx and 6xx series.

Someone correct me if i'm wrong!

[AwArD_RzD]

I'm not sure if i misread some forum post but I have the idea that, at least in the tds7xx series, the nvram only keeps the scope settings and activated options (which can be reactivated using gpib interface). The calibration values are not stored there but in some eeprom in the acquisition board. Therefore it's not so critical to replace the nvram as in the 5xx and 6xx series.

Someone correct me if i'm wrong!

Well if it's the case this explain why no one talk about the nvram in the tds700 series, i only see a bunch of post about 500 series. I saw someone talking about the calibration in the ACQ board but no documentation confirmed that either.

I think i will backup the NVRAM and solder a socket to reconnect it, if it fail and this cause the unit stop functioning/loose option this will be easier to replace it, and i'm very curious about some post telling that if the master switch is on the NVRAM is power by the power supply, so if i never unplug the scope i think the nvram battery will die with the scope in many year of useful use! 

[AwArD_RzD]

Is there a problem to read the nvram with the TL866CS ?

I updated the minipro software in preparation for the backup but it seem the software only test the DS1250, when selected, a windows open to test the device, but you can't read or write on it, if i select the other dallas ic now all the option to read write test are enabled.

There some ic with RW and test in the name but the ds1250 is the only option i can choose. I don't have the chip so i can't know if it's just a test and after the option are enabled.

Anyone have a clue about that, the device is listed to be compatible with the minipro but compatible to what extend.

Thanks !!

[AwArD_RzD]

I'm also a recent proud owner of a tek754A which i scored for 500$ in very good cosmetic state and fixed by changing the hybrid board relays

I'm not sure if i misread some forum post but I have the idea that, at least in the tds7xx series, the nvram only keeps the scope settings and activated options (which can be reactivated using gpib interface). The calibration values are not stored there but in some eeprom in the acquisition board. Therefore it's not so critical to replace the nvram as in the 5xx and 6xx series.

Someone correct me if i'm wrong!

There many post saying that too, but i just spoke with a tek support specialist, he had very short answer (and not answering everything i asked), he never mentioned the eeprom on the acquisition board, for him everything is in the nvram and if i want to replace it i will need to pay a tek service center to replace the nvram and i need a complete re-calibration..... This smell like TEK don't care and want my $$$ to replace a simple battery... the only good side of the conversation, he was blazing fast replying.

i have two ds1250y-100 in the mail, i will do some test with my tlc866 to see if i can do something with before messing with the real stuff, it seem the software only test the module but maybe the test is to read the entire content of the nvram and after i can save the bin file but this not explain why there some ic like the ds1225 with the RW and Test after the name....  .

well if someone can confirm this (quoted from tektronix forum) this will help me and probably many more people with TDS500/600/700 model tek scope.

Re: TDS 500 600 700 calibration/options affected by new NVRAM?

Postby tech8 on Mon Oct 15, 2012 10:55 pm
The "factory adjustment" (cal) constants are stored in a flash part on the acquisition board in "B/C/D" model TDS500/600/700's. I remember that for sure. Some of the later "A" models (like the 684A, 744A, 784A) probably do also. Option and SPC constants are stored on the processor board NVRAM on all TDS models.

[AwArD_RzD]

There are two ways:

a) You need a console Adapter like this:
     http://www1.tek.com/forum/viewtopic.php?f=5&t=5526&p=10588&hilit=pitbull#p10588
     
     Interesting commands on my TDS7xx scopes:

     libManagerWordAtPut(0x50006, 1) <- Enable option 1M
     libManagerWordAtPut(0x50007, 1) <- Enable option 05
     libManagerWordAtPut(0x50008, 1) <- Enable option 13
     libManagerWordAtPut(0x50009, 1) <- Enable option 2F
     libManagerWordAtPut(0x5000a, 1) <- Enable option 1F
     libManagerWordAtPut(0x5000c, 1) <- Enable option 2C
     libManagerWordAtPut(0x5000d, 1) <- Enable option 3C
     libManagerWordAtPut(0x5000e, 1) <- Enable option 4C
     libManagerWordAtPut(0x5000f, 1) <- Enable option 2M

b) Use a GPIB Adapter

I don't remember the exact syntax, but it should be:

PASSWORD "PITBULL"
WORDCONSTANT:ATPUT 327686,1

Where the decimal number (327686 in that case) is the same number as in the console-port-example above, just in decimal.

Note that you have to set the flash write protection switch to unlock to write those settings.

Any one know the exact location in the nvram of these option? I made a programmer/reader in VHDL with my Cyclone V GX starter kit and a custom adapter pcb and i did a backup of the DS1250Y in a M25P40 Serial Flash, now i want to try to "hack" these option to see if i can enable the 1M and the 2C option. Since the NVRAM is a 4Mb device, the address range is 0x0000 to 0x7FFFF very different range than the console example from Dxl. I tried last winter to use the gpib with no success, maybe i don't have the right syntax. I tried to find in the backup a string of data looking like my current option based on the quote from Dxl with no success. Now as a new dad i have some other priority but I will have some time to try thing in 2-3 week so if someone have some clue of where in the NVRAM i can find these option or how i can do that on the GPIB so i can start to prepare for this modification any help will be greatly appreciated.

[dxl]

Hi,

on the TDS784D i looked at, the addresses where:


NVRAM:0400081C 0000                                dc.w 0                  ; 5 - TV Trig
NVRAM:0400081E 0000                                dc.w 0                  ; 6 - Option 1M
NVRAM:04000820 0000                                dc.w 0                  ; 7
NVRAM:04000822 0001                                dc.w 1                  ; 8 - Option 13
NVRAM:04000824 0001                                dc.w 1                  ; 9 - Option 1F
NVRAM:04000826 0001                                dc.w 1                  ; A - Option 2F
NVRAM:04000828 0000                                dc.w 0                  ; B
NVRAM:0400082A 0001                                dc.w 1                  ; C - Option 2C
NVRAM:0400082C 0000                                dc.w 0                  ; D - Option 3C
NVRAM:0400082E 0000                                dc.w 0                  ; E - Option 4C
NVRAM:04000830 0001                                dc.w 1                  ; F - Option 2M

Those adresses could be completely different on your scopes firmware, and i think the data has a checksum associated.

Regards
dxl

[AwArD_RzD]

Thanks !!


I retried to send command over the gpib and this time this worked, the option 2C and the 2M are enabled, the only thing i don't understand it's how i know i have a 1M or 2M board, tried both and the it's the same menu, or maybe i don't understand the added memory or limitation.

i'm waiting for an another nvram to replace this old one, found out at the last minute that the Nvram replacement i bought a year ago corrupt the content i wrote on it... and the good one i used to test my setup is now in piece because i wanted to see inside .... big mistake  next time i will test them all before doing something   

I will take a snapshot of the new memory and compare it with the original one, i will be good to see the byte used to store the new value, i will post my result to compare to your TDS784D.

[andy2000]

I have a TDS784D, and the only thing stored in the DS1286, and DS1250 are the options, error log, and various user data like probe cal and SPC.  I think the options are actually in the DS1286, but I could be wrong since it's been a few of years since I worked on my 784D.  If you have a way to reset the options, then you don't need to worry about losing the NVRAM.  Calibration is stored in a a pair of EEPROMs on the acquisition board. 

You can tell which acquisition board you have by looking at the size of the SRAM chips.  I forget the sizes off the top of my head, but the smaller size has fewer pins than the larger size.  If there are unused PCB pads on the SRAM chips, then you definitely have the smaller memory. 

You can turn a TDS754D into a TDS784D by removing four caps on the acquisition board and rearranging some jumper resistors to change the ID.

[dxl]

The Option 1M boards have 32 pins AS7C1024 Memory chips if i recall correctly, while the option 2M boards have physically much larger rams in a TQFP-100 or TQFP-128 housing.

Regards
dxl

[klaus11]

Some trick to Hack/upgrade a TDS5052B 

[AwArD_RzD]

The Option 1M boards have 32 pins AS7C1024 Memory chips if i recall correctly, while the option 2M boards have physically much larger rams in a TQFP-100 or TQFP-128 housing.

Regards
dxl

I have 16x MT58L64L32F-7.5A, 64K x 32 , pcb fully populated so i have a 2M board, at first i didn't find any option for the extended memory but it's in another menu, ext acquisition, now i can enable the full 8M sample !! Tek menu are weird sometime, i used this scope for a year now and i still find some new menu now and then.

Thank you dxl, next step, programming the new nvram and i will compare the memory content before and after the hack, and i will post my result, at least for my version of the firmware this maybe can help someone who have a programmer but don't have a gpib adapter.

[Andy Watson]

For the record:
I can confirm that pushing "PASSWORD PITBULL",  followed by "WORDCONSTANT:ATPUT 327689,1", up the GPIB connector, with the cal-switch enabled, will enable the 2F maths option on a TDS510A.   

[nctnico]

Dammit! I just sold my TDS510A a couple of weeks ago. Having the 2F option enabled might have increased it's value 

[Andy Watson]

Dammit! I just sold my TDS510A a couple of weeks ago. Having the 2F option enabled might have increased it's value 

I can tell you with 100% certainty that this upgrade worked would have worked on your ex 510A.

[AwArD_RzD]

Well took more than a month to receive the Nvram but i have some interesting result.

Before doing the hack i did a backup of the Nvram so no 2M option or 2C. I did the hack and after everything was unlocked and working. Today i programmed the new Nvram with the original non hacked data and well the option still there after a reboot, so if i didn't by error replaced the original backup with the hacked one i can confirm the option are not stored in the Nvram. Well i don't know really what stored there because i don't have any data mismatch when i compare the two even after 1 month of use and test.

Maybe it's all in the te28f160 flash IC? anyway i hope this will help anyone who want to try the hack.

[andy2000]

Well took more than a month to receive the Nvram but i have some interesting result.

Before doing the hack i did a backup of the Nvram so no 2M option or 2C. I did the hack and after everything was unlocked and working. Today i programmed the new Nvram with the original non hacked data and well the option still there after a reboot, so if i didn't by error replaced the original backup with the hacked one i can confirm the option are not stored in the Nvram. Well i don't know really what stored there because i don't have any data mismatch when i compare the two even after 1 month of use and test.

Maybe it's all in the te28f160 flash IC? anyway i hope this will help anyone who want to try the hack.

I'm pretty sure the options are stored in the Dallas clock chip.  The main NVRAM is used for things like stored waveforms, SPC, and probe cal. 

[AwArD_RzD]

Repair thread https://www.eevblog.com/forum/repair/tds754d-not-booting-anymore/


Well that didn't last long...    

Did some test worked great power off the scope, take a 1 hour eating break. Baby sleeping still have time to do more test, power the scope go to the bathroom 2 min come back, all the led still on, no screen, no response. Reboot same thing.... 

Reopen the scope led display stuck to .8, if i cycle the unit fast sometime i have a .E , or a .8 .E .8 sequence showing very fast or a weird c (a,f,g segment on).

what i did before (for anyone not following this post), Hacked the scope for the 2m 2c option, worked great for a month till today, replaced the ds1250 Nvram by a fresh one with the backup of the old one.

Troubleshooting.
2 fan blowing on the scope case open.

-Tried to cycle the scope many time.    Same thing
-Replaced the fresh nvram with the old working one.   Same thing
-All the cable are tight in the right slot.
-Waited 5 minute, same state, tried to talk via GPIB, got an error, the scope dosen't reply..

Start to read the service PDF.

-All voltage OK
-All voltage look good on my other scope.
-Frequency good at the pin 25 of the J2 connector.
-Tried the s1001 switch with the help of some other post on the Tek forum. Same thing.
-Tried many combination with other board removed. Same thing.

With all the troubleshooting and following the flow chart the only thing this manual screaming is Replace the A11 DRAM Processor/Display module.

Checked the thermal signature with my E4 and nothing weird show up... No cap leak and nothing out of place visually.

I have the impression that the cpu is stuck on reset or briked. I tried to probe the Nvram to see if the CPU toggle the CSn pin and nothing happen.....

damn.. never again ... if it ain’t broke, don’t fix it     

For now i have a 16 Kg paper weight, if someone have an idea....

[Mosaic]

need advice on replacing nvram on a 694c. anyone has pics or a clip doc.? mine is still alive.

[Vince]

Any news on this repair ? Been almost 2 years since  the last message, but none the less I am still curious about it ! Were you able to repair it in the end ? What was the cause of problem exactly ?

[PrecisionAnalytic]

Repair thread https://www.eevblog.com/forum/repair/tds754d-not-booting-anymore/

I have the impression that the cpu is stuck on reset or briked.

Eh, any progress?

[AwArD_RzD]

Sorry for the late reply but life and stuff

I still have the scope but unfortunately it still broken, I bought another TDS754 and i have keep the dead one for spare part.

For what i remember i was able to talk to it via the serial interface (the hack where you use the CPU board edge connector with the serial interface) so i'm sure that the Cpu was not dead but it seem that i maybe zaped something or did some damage to a IC inside when i have put the scope back in is case.

I found that someone replied to me in the TEK forum https://forum.tek.com/viewtopic.php?t=138426

I remember to have seen that but i never completed any troubleshooting because i had my first child and it seem time fly when that happen So it seem that the problem is or affect video memory on the cpu board from the log i posted.

I'm about to buy a house,  i will have more space and i will probably dust off the scope and look at it again on the side but for now i'm designing a power amplifier and this take much of my time and bench space. In the last 3 year since the problem i was able to get many stuff about the scope (PDF, Schematic) that i didn't have in 2015. The price for used part seem to have lowered too maybe i will buy the cpu board and see if it boot and start from there.

I'm not very active on this forum (well on any forum) so i don't except to post any update soon but i will give update when i go for it.

Thanks for the interest.

[Vince]

Thanks for the update 

[madao]

Is there a problem to read the nvram with the TL866CS ?

I updated the minipro software in preparation for the backup but it seem the software only test the DS1250, when selected, a windows open to test the device, but you can't read or write on it, if i select the other dallas ic now all the option to read write test are enabled.

There some ic with RW and test in the name but the ds1250 is the only option i can choose. I don't have the chip so i can't know if it's just a test and after the option are enabled.

Anyone have a clue about that, the device is listed to be compatible with the minipro but compatible to what extend.

Thanks !!

Today have i using this tools.

Dumping of  NVSRAM , it run fine.
But writing of NVSRAM:    corrupte file 


I have desoldering DS1486 and writing him with TL866A  (choosing  DS1245Y ) and it is a success.
(Wrong time is not really a problem :-).

O'scope is  TDS754D with old acquisition board (C-Typ, 672-4041-00) and new CPU Board (671-4349-00)  FW: 6.6e

regards
Matt