TDS500 TDS700 serie C to D - Upgrading or Hacking Acquisition board

[Tantratron]

This thread reports my return of experience after more than 1 year of testing, repairing, upgrading or understanding specifically the internal working of tektronix TDS500 and TDS700 serie C and D.

N.B.1. As for the TDSxxx no suffix, serie A and serie B, there are not of my interest because of their capacitor leaking issues (many failures or recap task) plus their main board run with 68020 processor whereas the serie C and serie D with 68040 (more powerful).

On some other threads last year, some information was provided by different members on compatibility or interchange the boards, typically the advantage or universality of the main A11 board which clearly can host FV:5.x or 6.x firmwares. Via a GPIB and tekfwtool, it is then easy and documented to either dump the NVRAMs and Flash memory (hosting the FV) or write the NVRAMs and flash memory. In fact same with the EEPROM containing the factory calibration constant which can be read by GPIB but only written by floppy method.

Now the topic concerns exclusively the Acquisition board A10 where if serie C then it can only work with 5.x firmware but if serie D then only with 6.x firmware. All my tests, board swapping and SW dumping, writing... were done with two TDS540C's (one partially failed), one TDS520D (partially failed), one TDS794D and one TDS784C (partially failed) with either 5.x or 6.x firmware. Friend of mine showed me his TDS754D so I took notes of the firmware, what was printed on specific IC's and PCB's as well to have say a small database.

N.B.2. I've so far never had the chance to try any 7.x serie D but from what I understood they have a specific MainBoard and Acquisition board which is not the topic here.

Now my question of upgrading or hacking the Acquisition board: unless I'm wrong, it seems the A11 Acquisition boards of serie C or serie D are really the same components, same BOM except U600 firmware. The U600 chip per say is clearly the same, namely Motorola MC68HC705B5CFN but I notice sticker on each to be either 160-9714-00 (serie D) or 160-7851-04 (serie C).

What I'm wondering to upgrade from serie C to serie D the acquisition board, either (1) there is method upgrade or write or flash the U600 via GPIB and remote software like tekfwtool or (2) desoldering U600 from a failed Serie D Acq board then soldering in place of the U600 in a serie C board or (3) we can PLCC plug a connector on the U600 to upgrade its firmware.

Again maybe I'm wrong with my observations and conclusion if only U600 local firmware dictates if A11 Acq board is serie C or serie D, please let me know.

However if it is correct then what quickest and less destructive method to dump U600-D firmware then write or program or flash a U600-C chip ?

Thank you in advance, Albert

[Tantratron]

I'm attaching an extract of specific pages (Memory Maps) from the only TDS component Manual found on internet so far (TDS520B).

Does anyone knows if these pages contains the specific address to read or write the U600 chip in the Acquisition board for eventually controlling its firmware ?

[Tantratron]

Additional question wether it is doable or not doable to hack-upgrade the serie C Acquisition board towards D serie.

Do you know by practice and experience of advantages or improvements of D serie Acquisition boards running with 6.6 firmware versus C serie under 5.2 firmware ?

[madao]

Short answers: No

Not only motorola MCU-numbers ist others, also  4 big intergrated  ciruit "data multiplexer" (dito address range)  is others.  I have a mistake with TDS754C and new firmware (6.xx) and it starts with multiple error & fails (address range error and more. Not 100percent sure,because i have forgotten not important details )

[Tantratron]

Not only motorola MCU-numbers ist others, also  4 big intergrated  ciruit "data multiplexer" (dito address range)  is others.  I have a mistake with TDS754C and new firmware (6.xx) and it starts with multiple error & fails (address range error and more. Not 100percent sure,because i have forgotten not important details )

I've compared visually 5 different Acquisition boards (TDS520D TDS540C TDS754D TDS784C and TDS794D), the C runs with 5.x and the D's run with 6.x

Visually speaking, the PCB traces, the chips naming and layout seem to be always the same wether C serie or D serie but some chips do have heatsink so I cannot read the P/N, manufacturer:
* U600 is Motorola MC68HC705B5CFN : Acquisition Processor
* U1250 : Track Hold IC
* U700 - U750 - U800 - U850 : A/D Converters
* U100 - U200 - U300 - U400 (all ADG299G for C serie) : Demux with peak detect
* U1151 - U1152 : Transceiver
* U1600 - U1650 : Interpolator
* U1703 : Extended Trigger
* U1001 : ?
* U1050 (ADG308 for C serie and ADG368 for D serie) : Trigger

As for the only Motorola chip, it seems only MC68HC705B5CFN which has on its top a firmware version.

[Tantratron]

Today I've decided to hot air remove one custom ASIC's heatsink from a partial failed TDS520D acquisition board, namely U300 demux.

@Madao was right, its part number is different, for instance ADG339C (TDSxxx serie D) versus ADG299G (TDSxxx serie C).

As a reminder, the MCU controller or interface between A11 logic board and A10 acquisition board is Motorola MC68HC705B5CFN on both C serie and D serie. Unfortunately this is EPROM and not EEPROM hence not doable to reprogram while soldered on the PCB. One option would be to replace with MC68HC705B6CFN then write the firmware.

Extract from the Motorola datasheet... The MC68HC705B5 is a device similar to the MC68HC05B6, but with the 6 kbytes ROM and 256 bytes EEPROM replaced by a single EPROM array. In addition, the self-check routines available on the MC68HC05B6 are replaced by bootstrap firmware. The MC68HC705B5 is intended to operate as a one time programmable (OTP) version of the MC68HC05B6 or the MC68HC05B4, meaning that the application program can never be erased once it has been loaded into the EPROM. The entire MC68HC05B6 data sheet applies to the MC68HC705B5, with the exceptions outlined in this appendix.

[madao]

I know, because  newer data multiplexer runs much hotter than old IC.  Using of heatsink isn't a optical reason.
Other know: my mistake with new firmware on old unit.