Tektronix TDS1000B and TDS2000B series hacks

[KK]

Anyone know of a way to upgrade bandwidth on the Tek 1000B series scopes?

Assuming the hardware is identical on the 40-70-100 MHz units.

I want to upgrade a 40mhz 1001B scope I use with iview and a logic analyzer to 100mhz.

[KK]

Looks like I will dissemble the firmware file to see how to change the identifier.

Any tear downs yet on these scopes - TDS1001b/1002b/1012b?

Anyone know the main processor offhand?

[KK]

Looks like the firmware is common for the TDS1000B/TDS2000B series Oscilloscopes.

I'm disassembling it to look at some of the remote commands. I've found some interesting things to look closer at.

VXWorks is used as the RTOS, and this scope uses a Freescale 68000 compatible processor.

[KK]

DS1339C

i2C Clock

[KK]

Firmware flash

Spansion
S29JL064H

64Mbit flash memory 4Mbx16

[KK]

DRAM. 64Mbit 512Kx32 in 4 banks.

[KK]

NS
ADG522

Can't find info. Must be the A/D.

[KK]

Unknown NS chip

EE69RD
9858-00

Another similar chip not pictured is
NS
EE63RA
9857-00

[KK]

Highspeed SRAM 128K x 8

[KK]

Main ram

SRAM 1 Mbit 64K x 16

[KK]

Altera Max II
EPM240

8K flash

[KK]

USB Driver

Cypress Semi CY7C67300-100AXI

[nctnico]

Highspeed SRAM 128K x 8

Must be sample memory

Probably not. The sampling memory (1k points?) is inside the sampling ASIC.

[tautech]

Looks like the firmware is common for the TDS1000B/TDS2000B series Oscilloscopes.

Now I'm interested.
I have TDS2102B in bits with a corroded pin on the USB chip.
I could possibly help if needed.

[KK]

Highspeed SRAM 128K x 8

Must be sample memory

Probably not. The sampling memory (1k points?) is inside the sampling ASIC.

Yeah, it's only 2.5K points

[KK]

Looks like the firmware is common for the TDS1000B/TDS2000B series Oscilloscopes.

Now I'm interested.
I have TDS2102B in bits with a corroded pin on the USB chip.
I could possibly help if needed.

Here is the latest firmware V22.16 for TDS1000B and TDS2000B series models.
The file isn't encrypted or compressed.
(too big to attach- download here)
http://www.tek.com/oscilloscope/tds1001b-software/firmware-update-tds1000b-and-tds2000b-v2216


binwalk hasn't been helpful, but I have it in Ida Pro right now and I can see some interesting routines.

There are a bunch of 488.2 commands you can send it over USB using the Tektronix open choice talker/listener app.

Some of the undocumented commands from the firmware might allow for a model identifier change (bandwidth) and/or direct bandwidth change.

There are some interesting error messages in the firmware like-

Number of channels is 2 and you have selected a 4-channel Model
Display is MONO and you have selected a COLOR Model
Number of channels is 4 and you have selected a 2 channel model
Display is COLOR and you have selected a MONO  model

success!; saving constants ...

[tinhead]

what you doing is the wrong way, the firmware is for all models, so it does not matter what inside (unless you wish to search the whole firmware for model checks and patch it then). The best way is to patch the model itself, and this has been saved somewhere. The RTC clocke does have some user bytes, but htey can't be used (without special tricks) to store model. Are there any eeproms on the board? i bet the altera cpld is readback protected, but well, just try to dump it. If the model check is really in that cpld (and not eeprom) then it is still possible to change it, e.g. by watching the bus for call just before model check in fw, and then sending the crafted info back. When eepom used, then it will be much easier. Or even simple tricks like some "not populated" parts, TEK did that on other models and one can hack them very easy (which still did't change anything, without calibration mainly useless - and to run cal one need anyway some gears, so ppl who can calobrate have enought money anyways to buy higher TEK models).

[KK]

Interesting ideas.

Is it possible Tektronix made one motherboard for both the model series and then configures them with commands after final assembly to what kind of model it should be. I am pursuing the theory that I can issue a command to change the max bandwidth and/or model.

I have other oscilloscopes, this is just used with my tla714 logic analyzer for iview. The type of screen it uses and feature set are mostly irrelevant as I'm looking at the waveform on Windows 7 anyway.

Bandwidth matters. I decided to buy the lowest bandwidth model because I figured hacking it up to the max would be possible.

[KK]

The 'B' series of these scopes introduced a USB port. Amongst the many advantages is that it works with the TLA Logic Analyzer software to overlay the scope signal with the logic analyzer signals and sync the signals.

They all have (only ) 2.5K points memory. Although that doesn't matter in my application.

TDS1000B is a 2-channel monochrome LCD Series-

1001B - 40 Mhz / 500 MS/s
1002B - 60 Mhz / 1.0 GS/s
1012B - 100 Mhz / 1.0 GS/s

TDS2000B series is a 2 or 4 channel color LCD series-

2 channels-

2002B - 60 Mhz / 1.0 GS/s
2012B - 100 Mhz / 1.0 GS/s
2022B - 200 Mhz / 2.0 GS/s

4 channels-

2004B - 60 Mhz / 1.0 GS/s
2014B - 100 Mhz / 1.0 GS/s
2024B - 200 Mhz / 2.0 GS/s

[KK]

Looks like the firmware is common for the TDS1000B/TDS2000B series Oscilloscopes.

Now I'm interested.
I have TDS2102B in bits with a corroded pin on the USB chip.
I could possibly help if needed.

Do you mean TDS2012B ?

Is your chipset identical to mine?

[tautech]

Looks like the firmware is common for the TDS1000B/TDS2000B series Oscilloscopes.

Now I'm interested.
I have TDS2102B in bits with a corroded pin on the USB chip.
I could possibly help if needed.

Do you mean TDS2012B ?

Is your chipset identical to mine?

Yes, yes.

[KK]

Looks like the firmware is common for the TDS1000B/TDS2000B series Oscilloscopes.

Now I'm interested.
I have TDS2102B in bits with a corroded pin on the USB chip.
I could possibly help if needed.

Do you mean TDS2012B ?

Is your chipset identical to mine?

Yes, yes.

Do the two white labeled chips flash & cpld have the same codes printed on them?

[tautech]

U800, F163. 166600
U801, F163. 166100. V21.20

In bits ATM.
Fails boot.
Pin 22 on U900 (USB chip) corroded through.

I need to be off grog for a week  to have a steady hand to attempt to solder a very fine wire to the pad.
Other option is replacement. Bit nervous about that, but I will just have to man up.
Got plenty of other gear, so it's low priority.

[KK]

Identical. So the only difference between the 1000B and 2000B 2 channel series is the display module.

Perhaps we can get these scopes up to 200Mhz

[tautech]

Identical. So the only difference between the 1000B and 2000B 2 channel series is the display module.

Perhaps we can get these scopes up to 200Mhz

That would turn heads. 
I have no gear for any in depth sniffing etc, only a decoding DSO.
I will help if I can.

The only advice I could offer is to take note of tinhead's interest.