Author Topic: Tektronix TDS1000B and TDS2000B series hacks (Read 62680 times)

harm · « **Reply #50 on:** November 28, 2016, 08:40:57 am »

Hi,
Any more news for TDS1000-2000 series hacks?

I've a TDS1002 scope with broken (monochrome) display. I want to replace/install color display. Will it work without 'hacking' the TDS1002 scope to TDS2002 and only wire the color display the right way (18pin mainboard to 15-pin display connector)?

Anyone done this before?

tautech · « **Reply #51 on:** July 16, 2017, 05:40:30 am »

Quote from: dav on May 15, 2016, 10:10:19 am

If you should find how to entering the engineering mode, please post it on the forum!

In this new thread:
https://www.eevblog.com/forum/testgear/tds-1000-2000-3000-bw-hack/

braikin · « **Reply #52 on:** March 01, 2018, 02:58:54 am »

The process in that thread didn't work for me (TDS2004B), but I was inspired to try looking at the firmware myself. Here's some of what I found, that might help people still stumbling upon this thread.

1. The model id is stored at the end Flash ROM along side the calibration data. Here's a bit of python which would patch the ROM if you're willing to desolder and re-program it. Based on observations others have made about the hardware, and the way the code branches based on model number, this will probably work. I used a TL866 to read the rom, but haven't tried programming (see #2).

with open('ROM.BIN', 'rb+') as patchedfw:
# Model IDs
#
# 0x0B = TDS2022B
# 0x0C = TDS2024B
# 0x0D = TDS2002B
# 0x0E = TDS2012B
# 0x0F = TDS2014B
# 0x10 = TDS2022B 1GS/s
# 0x11 = TDS1002B
# 0x12 = TDS1012B
# 0x13 = TDS1001B
# 0x14 = TDS2004B

patchedfw.seek(0x7f0007)
# Update model per list above.
patchedfw.write(bytearray([0xf]))

# Update Checksum
patchedfw.seek(0x7f0004)
data = patchedfw.read(0x9f2)
bytes = [ord(b) for b in data]
csum = pack(">I", sum(bytes))
patchedfw.seek(0x7f0000)
patchedfw.write(bytearray(csum))

The address references above are the physical addresses in ROM. They're mapped differently by FPGA in firmware. If you want to peek/poke from service menu, nvram starts at 0x002f0000.

2. Looking at the code, upgrading from any sample rate to another (e.g. 1GS/s to 2GS/s) will definitely result in an uncalibrated scope. Address 0x42b340 is start method which loads cal data. The very first branch in the method matches 2GS/s models and expects the cal data to be a few bytes longer.

I don't have the capability to fix cal, so I'll probably abandon further research like finding a way to do this which doesn't require ROM removed.

braikin · « **Reply #53 on:** March 03, 2018, 12:11:49 am »

Cal issue is resolved, I'll patch my ROM. If I don't break anything soldering, I'll report back what happens in a couple days.

Cal data was organized into blocks. I had a thought autocal probably manages some of these blocks too:

[factory addr=0x7f0000 sz=2546 csum=0x48242,
spc addr=0x7d652c sz=1564 csum=0x1bc53,
trig_fpc addr=0x7d0000 sz=396 csum=0x11750,
fiso_fpc addr=0x7d01c2 sz=11088 csum=0x15232b,
fiso_fpc_peak_detect_5US addr=0x7c0000 sz=11088 csum=0x14bae7,
fiso_fpc_peak_detect_10US addr=0x7c2b8e sz=11088 csum=0x16344a,
fiso_fpc_peak_detect_25US addr=0x7c571c sz=11088 csum=0x158a91,
fiso_fpc_peak_detect_50US addr=0x7c82aa sz=11088 csum=0x160cb1,
fiso_fpc_peak_detect_100US addr=0x7cae38 sz=11088 csum=0x15a601,
fiso_ch1_sample_offset addr=0x7d3d54 sz=2673 csum=0x1e307,
fiso_ch2_sample_offset addr=0x7d493e sz=2673 csum=0x105c,
fiso_ch1_pkdet_offset addr=0x7d2d50 sz=1980 csum=0x3d7d1,
fiso_ch2_pkdet_offset addr=0x7d3552 sz=1980 csum=0x325,
fiso_ch1_pkdet_lkup_corr addr=0x7d5528 sz=1980 csum=0x3dc38,
fiso_ch2_pkdet_lkup_corr addr=0x7d5d2a sz=1980 csum=0x3d71a,
trig_fpc_2 addr=0x7e0000 sz=396 csum=0x12bd9,
fiso_fpc_2 addr=0x7e01c2 sz=11088 csum=0x129b8a,
fiso_fpc_2_peak_detect_5US addr=0x7d6d60 sz=11088 csum=0x132c93,
fiso_fpc_2_peak_detect_10US addr=0x7d98ee sz=11088 csum=0x13408d,
fiso_fpc_2_peak_detect_25US addr=0x7dc47c sz=11088 csum=0x132590,
fiso_fpc_2_peak_detect_50US addr=0x7e6590 sz=11088 csum=0x1307bf,
fiso_fpc_2_peak_detect_100US addr=0x7e911e sz=11088 csum=0x12e5b2,
fiso_ch3_sample_offset addr=0x7e3d54 sz=2673 csum=0x47bef,
fiso_ch4_sample_offset addr=0x7e493e sz=2673 csum=0xf97,
fiso_ch3_pkdet_offset addr=0x7e2d50 sz=1980 csum=0x9e6d,
fiso_ch4_pkdet_offset addr=0x7e3552 sz=1980 csum=0x184af,
fiso_ch3_pkdet_lkup_corr addr=0x7e5528 sz=1980 csum=0x3d78f,
fiso_ch4_pkdet_lkup_corr addr=0x7e5d2a sz=1980 csum=0x3f20e]

The 4 sections who's size change when upgrading to 2GS/s are `fiso_ch?_sample_offset`. I did an auto cal, and observed checksum changed for those.

braikin · « **Reply #54 on:** March 03, 2018, 10:33:32 pm »

Success!?

Software identifies as a TDS2024B everywhere I could think to check. I think I see more HF noise. FFT modes at 2GS/s work. 2.5ns/div works. If there's a test you'd like me to try, and I have the equipment, I don't mind giving it a try.

Obviously desoldering the the ROM isn't the easiest solution, but if you'd like to try it:

Update to the latest firmware. V22.16. This may not be required, but this is the version I reverse engineered. Earlier firmware may or may not work.
Desolder the ROM, dump its contents to a binary file.
Keep a backup of the ROM file. If something goes wrong, you can only restore your unit to old firmware if you have a copy.
Download the attached patch.py.
If you're patching a 2ch model, change rom.write(bytearray([0x0c])) to rom.write(bytearray([0x0b])).
Don't try to patch to an impossible configuration. You'll be left with a brick and required remove ROM and retry. Don't use a model with a different number of channels, don't user a model with a color display if you have black-white. If you make a mistake, the scope won't boot.
Use patch.py to update your firmware, then reprogram.
When you boot up the first time, Auto Calibration self test will fail. This isn't a problem. Just Auto Cal the scope, then cycle power.
You're done.

Tips:

Save a backup of old ROM, so you can rollback if needed.
Three LEDs in upper left should light up as soon as you power on scope. If they don't maybe ROM isn't soldered well.
If you've flashed an incompatible model number, you'll get stuck at the 3 LEDs.

braikin · « **Reply #55 on:** March 04, 2018, 12:51:13 am »

Last update... unless I find out more. I'm trying to measure rise times to confirm 200mhz. Generously, the best rise times i'm seeing are > 3ns implying < 100mhz.

Changing the Product ID doesn't seem to have increased bandwidth but did seem to enable 2GS/s. Maybe there's a small hardware difference in frontend, but that's beyond my skill to figure out. Also, the `factory` section of cal which contains stuff like: model id, serial number, etc, is about 2.5 kbytes. There may be other values that need manipulation. I'll poke around firmware a little more.

braikin · « **Reply #56 on:** March 05, 2018, 02:51:22 am »

According to the service manual models are required to be calibrated with a sine wave matching their respective bandwidth. Upgrading software doesn't change the fact the hardware is still calibrated to -3db @ 60mhz? Effectively cal data is limiting bandwidth? Seems like tinhead implied this early in the thread?

What the software change did do: my scope now expects a 200mhz signal during cal. So, I guess the next step is to recalibrate (if that were possible).

If I can get a crude signal source I may try out of curiosity. Calibration is reversible as long as my NVRAM survives another desoldering.

texaspyro · « **Reply #57 on:** March 05, 2018, 03:17:34 am »

Quote from: braikin on March 05, 2018, 02:51:22 am

If I can get a crude signal source I may try out of curiosity. Calibration is reversible as long as my NVRAM survives another desoldering.

Geeeeeez, put it in a socket!

braikin · « **Reply #58 on:** March 14, 2018, 02:08:59 am »

Success!

I'm now seeing rise times ~2ns which is consistent with 200mhz.

Attached is an updated python script to patch more data in NVRAM cal section. This script should work correctly with 2 and 4 channel color models upgrading them to 200mhz 2GS/s. Upgrading non-color models is possible, but not all the way to 200mhz. See my previous post for instructions just use this script instead (and there's no need to edit it).

Basically some of the bytes in factory cal section are used to program a low pass filter of some sort. It looks like They're calibrated to get a consistent attenuation across all channels and vertical scales. Instead I just set the filter to max. So... I may get more inconsistency between channels and vert scales, but it works. I think a full cal would be better but after a couple days on ebay I can't find an affordable way to do that.

If you're interested; the function `cal_bwl_setup` is defined in FW at addr 0x437230. This function programs the LPF between 20mhz and full bandwidth. The values it writes to the LPF are stored in the factory cal section. Bigger values = more bandwidth. My patch sets them to 0x0f which is the largest allowed value for 200mhz. There's on value per channel and vert scale; and like a say above they vary slightly. My scope probably performs a little less consistent.

Good to bring some life back to my old scope! I hope I don't find anymore issues. Digging any further into what the calibration bytes to would be tough.

I feel like I'm talking to myself in an 5 year old thread. If you're interested in how this applies to non-color models, or you have some tests I should try... feel free to let me know.

Argiros · « **Reply #59 on:** April 29, 2018, 09:42:54 pm »

I am glad that you made it! Maybe I give it a try later.
I want to say that I make a BW model to a color. I figure out the pinouts and after many search I finaly did it. I saw the red the cyan all the colors.
Unfortunately my color lcd had two spots it came with that and I put again my b/w lcd. But I finaly did it. I ordered a new color lcd and finaly i will have a color model!

braiden · « **Reply #60 on:** May 01, 2018, 01:36:52 pm »

Wow, nice work making the color display work!

Its good to know your scope works after the upgrade. It means what I've done here should work for b/w models too. I wasn't sure it would, when I accidentally programmed a model id with a channel count mismatch i got a brick. Sounds like display mismatch is more forgiving.

I still haven't been able to find affordable hardware to do a cal, but I did pick up a 500mhz freq synthesizer. Results are: frequency response is not as flat as i'd like. Everything's good through the original 60mhz. After that the sin wave amplitude creeps up (as high as 125%) before coming back to 100% at 350mhz and dropping off pretty sharply after that.

If there's interest in what you'll get with the hack I can draw a bode plot. With caveats: I assume my signal source is level (spec is +/- 0.5db). I'm using cheap cabling and termination, maybe that's adding some induction(?).

I'd like to play with the attenuation setting in cal more, but the socket i got for rom doesn't fit.

braikin · « **Reply #61 on:** May 15, 2018, 01:07:03 am »

For what its worth, here's a plot of a nominally 3 VPP sin wave from 1-499mhz. Different test setups result in very different results. I'm using the stock P2220 probe with a BNC tip adapter plugged into a 50 $\$\Omega\$$ passthru terminator connected directly to signal source output.

oaba · « **Reply #62 on:** July 19, 2018, 02:42:16 pm »

I have an TDS2002. I got the firmware out of flash Am19DL162 . How can I find the model numbers?
Hence the different firmware and flash size. Or dou you have firmwares to compare?
Thanks in advance.

braiden · « **Reply #63 on:** July 19, 2018, 02:56:59 pm »

I've only looked at TDS2002B, not the TDS2002 which may be totally different? If you're looking at a non-B model, there is this thread: https://www.eevblog.com/forum/testgear/tds-1000-2000-3000-bw-hack/

If its a "B" model, the model id is at 0x7f0007 in the physical ROM dump, and you should expect to find 0x0D corresponding to TDS2002B. Other model numbers are documented in patch_tds1k2kb_rom.py.txt linked above.

Within the "B" series there are no firmware differences between modules, they all run the same binary, the only relevant difference is the model and calibration data stored at the end of ROM, 0x7f0000 and 2546 bytes long.

vanbac · « **Reply #64 on:** August 20, 2018, 07:48:23 am »

Quote from: Argiros on April 29, 2018, 09:42:54 pm

I am glad that you made it! Maybe I give it a try later.
I want to say that I make a BW model to a color. I figure out the pinouts and after many search I finaly did it. I saw the red the cyan all the colors.
Unfortunately my color lcd had two spots it came with that and I put again my b/w lcd. But I finaly did it. I ordered a new color lcd and finaly i will have a color model!

hello you.
modele: Tds1012b mono.
I see you've made a successful switch form screen color can you give me detailed instructions how to do thank you

clodnut · « **Reply #65 on:** September 05, 2018, 06:36:29 pm »

Thanks for your work on this, braikin.

Your efforts have given my aged TDS1001B (Mono, 2 Ch, 40 MHz, 500 MS/s) a new lease of life as a 100 MHz TDS1012B.

5 ns/division scaling has become available and FFT mode confirms 1 GS/s acquisition.

I tweaked your Python code to handle model ID 0x13 -> 0x12 for the TDS1000B series. Your approach of clearing the LPF settings seems to work for the TDS1000B-series, whose max. bandwith is 100 MHz rather than 200 MHz like the TDS20xxBs.

I don't have the kit to measure the new bandwidth properly but the stock probe and a Rasberry Pi outputting a square(ish) wave gives a 2.12 ns rise time, suggesting comfortably over 100 MHz bandwidth.

The calibration seems fine by eye (no weird offsets or dodgy scaling cycling through various ranges) but, again, I'm not set up to do a full cal.

Thanks again!

vanbac · « **Reply #66 on:** September 09, 2018, 01:56:33 am »

hello clodnut.
Congratulations you've successfully upgraded can you guide me the steps to upgrade on YouTube thank you very much.

DogP · « **Reply #67 on:** October 25, 2018, 09:30:07 am »

Quote from: tautech on July 16, 2017, 05:40:30 am

Quote from: dav on May 15, 2016, 10:10:19 am
If you should find how to entering the engineering mode, please post it on the forum!
In this new thread:
https://www.eevblog.com/forum/testgear/tds-1000-2000-3000-bw-hack/

I didn't see engineering mode in that thread... did I miss it? In the case of the TDS 3000, the TDS3ENG hack is totally different, as it unlocks the available modules. The TDS 1000s and 2000s didn't have those modules, and instead "Engineering Mode" looks to be an option in the menu (similar to Service Mode).

Any further progress on any TDS 1K/2K stuff? I used to have one of these on my desk at work, and I just bought a 2024B for home. Not the best scope I've ever used, but nice and doesn't take up a lot of bench space... and the deal was too good to pass up. Since it's already the highest freq/sample rate 2024B, I guess there's no possible "upgrade".

I sifted through the firmware binary, and it looks like there are still some interesting mysteries to unlock. Maybe not all of them are important - engineering mode (doesn't look that interesting), the code to enable memory pokes from service mode (again, probably not very useful)... but how about the section with "A:\PAUL", "\GEORGE", "\RINGO", "\JOHN", and "A:\POLLY\LITHIUM". If I create one of those directories does it load up an XY plot of a Beatles or Nirvana album?

DogP

bootboot · « **Reply #68 on:** November 06, 2018, 09:45:12 am »

Hi! Can you share me the backup ROM file?
My TDS2022B Can not bootup, it dead at 3 LEDs light.

vanbac · « **Reply #69 on:** December 07, 2018, 02:43:28 pm »

Hello please help me I want to upgrade the bandwidth but I read data of ROM thank you.

clodnut · « **Reply #70 on:** December 08, 2018, 08:23:06 pm »

U902 is not the firmware flash -- it's just an I²C EEPROM, apparently containing the boot code for the USB controller (according to this earlier post).

You will need to remove the S29JL064H flash memory chip, typically designated U801.

It's the one pictured in this post earlier in this thread. It's the chip with the label in the top left of the board shown in this post.

Then you need to read the chip, patch it using braikin's Python script and re-solder it into the scope.

Good luck!

vanbac · « **Reply #71 on:** December 10, 2018, 04:24:01 pm »

Thank you for the tutorial, please wait my results.

vanbac · « **Reply #72 on:** January 04, 2019, 06:58:32 am »

thanks "clodnut" very much, i have upgraded the bandwidth, this is my model.

CaptDon · « **Reply #73 on:** May 10, 2020, 06:49:32 pm »

How would I run the .py script to program the flash device. I have an assortment
of programmers, but none would understand a .py script. It seems I need to unsolder
the flash rom device and insert into a programmer, I am o.k. that far, then what??

clodnut · « **Reply #74 on:** May 23, 2020, 07:41:59 pm »

Hi CaptDon,

Per my earlier message in this thread - you:

Remove the chip
Read it in a programmer (using whatever software is appropriate for your programmer) and save the firmware image somewhere
Use the Python script to patch the image
Write the altered image back to the chip
Reinstall the chip.

Good luck!


EEVblog Main Site	EEVblog on Youtube	EEVblog on Twitter	EEVblog on Facebook	EEVblog on Odysee

Author Topic: Tektronix TDS1000B and TDS2000B series hacks (Read 62680 times)

Share me