Hacking my TDS460A to have options 1M/2F?

[TriodeTiger]

I was extremely excited when I scored a Tek TDS460A on eBay for <$300 (to be reviewed and internals exposed some day soon) but learned it didn't have the memory option (and 2F, for DSP and math) so I couldn't do FFT I looked forward to for basic stuff (granted, I could record it on a spreadsheet and plot an FFT in matlab, rinse and repeat, but...)

I then learned that at least on the 540A/7xx, it is a software option:
http://www1.tek.com/forum/viewtopic.php?f=5&t=5526&p=10588&hilit=pitbull#p10591

I realised then that I haven't ever seen "hardware option" having anything to do with options 1M (memory) or 2F!

Do you think it's possible to upgrade it? The 540 looks purely like the next in the family, not some significantly different scope. unless i'm wrong, i guess i'll need to find a GPIB card and an ancient computer with an ISA bus to run the console program (yuck) , so if anyone has pointers on anything, shoot.

[AwArD_RzD]

I'm in the same boat as you but i still don't have my TDS754d and my GPIB adapter yet.

There many information on the Tek forum about these series of scope, it seem you can check your board to see if you have some un-populated pad where you can define if you have the memory in hardware to do the software hack. I don't have the link unfortunately. (checked too much page in the last 2 day to remember where).

Check this image, this will give you an hint where to find the memory http://green-magic.nl/Download/TDS460A/TDS460A-3.jpg it's at the right of the 2  big QFP, check the data sheet and calculate how much memory you have. (the original page http://www.circuitsonline.net/forum/view/94488/1/condensatoren+waarvoor?query=condensatoren+waarvoor&mode=or , i don't know what language it is but you can always translate it maybe he tell the option he have).

On my part i will un-solder the NVram do a backup and try to change the memory where the option should be, well Trial and error is the key when you don't have any useful info.

[TriodeTiger]

Your reply means a lot to me, it got me interested in getting my hands dirty

Here's a comparable shot:

(note: mine is from early '95, theirs late '97 going by the dates on the memory. I guess theirs is revision 3 judging by the URL name.)

it's at the right of the 2  big QFP, check the data sheet and calculate how much memory you have.

There's 16 32Kx8 SRAM = 4M

I learned from the service manual, that the CPU assembly is within the unused option slot. It makes sense, as there's a battery attached to it for backup and all.

I'm guessing the upgrade is purely those unpopulated SRAMs (+6MB), as the machine itself uses up a significant portion of the 8M on there. As a bonus at least, the RAM appears quite cheap on fleabay

Think I should splurge and try installing those, or do they look like for something else maybe? at least it looks like the pads, from the reflow, have a hefty amount of solder to sink the ICs in to once I get them. I guess then I'd have to either educate myself on how to read NVRAM (I'd hope an Arduino could help, heh.) and hack away at it, as it seems to be the cheaper option than making some sorta GPIB rig.

[TriodeTiger]

From all I've read with similar stories to mine, it was a firmware switch, and the specific offset appears to be the same among many 4/5/6xx scopes so I have hope for that. 0x50006 for 1M, -09 for 2F.

So... a little help is required!

1. Hackery:
On the CPU board, there is a battery attached to a DS1211 (a non-volatile SRAM controller) and 4 1MB SRAMs, under a load of gel-like conformal coating nonetheless (yuck.)

So..

To muck around with the NVRAM, with a programmer/'duino, what is my course of action? Can I fly some leads in to one of the SRAM and is it simply cascaded with the others? Do other scopes have a configuration like this, and how to do they back theirs up? (can't find any actual specifics on the process..)

2. GPIB:
I just looked at GPIB-to-USB adapters and they all look *pricey*  and I'm assuming RS232 ain't gonna touch the firmware.

I no longer have a computer with an ISA/PCI slot, for a GPIB card, but that might come out to the same as the USB option. Are the people doing GPIB using one or the other or something more clever?

3. Be happy with what I've got.  nah.

[AwArD_RzD]

Well you don't have many choice, since everything is soldered on the board you will need to find a way to extract the content before messing the memory content, DXL posted a link on my topic for my tds754d http://stackframe.org/tektool.shtml, to read the content via the GPIB.
Maybe you can use the source code modify it to fit your need. Since i can de solder my nvram (i have one like this http://www.ebay.ca/itm/251245225991?ssPageName=STRK:MEWNX:IT&_trksid=p3984.m1497.l2649 ), i will not mess with software and code so i can't help you with this method.

You can always buy a FPGA dev kit (like the de0 nano) and find the schematic of your scope write vhdl/verilog to extract and re upload the data, tap the signal on the bus and extract the content of the nvram to the FPGA SDRAM (be aware of the logic level!! the de0 nano is 3.3v so a level shifter will probably needed) . So if the offset is wrong and your scope brick or do weird thing you will have a some kind of "backup". This is a realy good project if you want to have fun.

But i'm sure there a better way somewhere, maybe tektronix had a tool to read/write the content??

If you look for a GPIB adapter Wuerstchenhund posted a fully Agilent compatible clone in my post http://www.ebay.ca/itm/S82357-GPIB-USB-interface-Agilent-82357B-compatible-/171387561919 , for my part i bought the F version it's 10$ more and they say it's faster, but it still in the mail so no review for now.

[David Hess]

Since the oscilloscope is working, I would be leery of physically damaging it and restrict myself to non-invasive procedures while attempting to activate the options.

[vaualbus]

I will nor try to do this.
On The TDS scope the think you read for the option 1M is only workinf on some scope not all, for example my no revision TDS540 scope the trich didn't work. At the I found a sram image for the TDS540 which have option 1M and 2F enable and use that.
Also is impossible that the scope have 4M of memory is too high.
And the trick is done by using the console port that I don't know if in your scope is presenteand the command would be different.
You coould lost all the calibration data If the procedure fail.
On the TDS500, 600, and 700 If you lose the cal data there is a way to restore the original factory data but I don't know If also work on the previous scope.

Also I think you overpaid a little bit the scope I would have buy a TDS500 (I buy mine at 250$ but broken, follow my posts on it If want to see how I repair it) instead.
Also check and change all the caps they leak a lot.

[nctnico]

I agree. The locations (addresses) for the options are different for different series of scopes. People tend to track them by analysing what the firmware reads from the NVRAM during startup using a logic analyser. That is a lot of work.

[vaualbus]

Ya a lot of work and we even not know If the scope run like the TDS540 vxWorks.
So you have to connect a logic analyzer on the bus and try reverse enginiring the os call.
Very hard work I don't know If it the best think.
Sell the scope and buy a TDS540 whith the option installed and you havte the FFT less work to do!

[Watermelon]

Try to read out the NVRAM contents and drop it here. I upgraded my TDS520A with the options 1M/2F, it shouldn't be too hard finding the right adresses to edit.

[TriodeTiger]

Also I think you overpaid a little bit the scope

For $300 I got the scope in great condition, the original operating manual and 4x 400MHz Tek branded probes - I think I struck eBay gold, actually! I can sell the scope for double that (just guessing, most of them appear to sell for that) and keep the probes if anything.

DXL posted a link on my topic for my tds754d http://stackframe.org/tektool.shtml, to read the content via the GPIB.

The code appears to be using a C GPIB library, so I guess they wouldn't read the $65 GPIB-USB adapter, maybe, since they just make a serial port. I guess maybe in the end, it's the decision to spend $100 on an adapter (yuck) to get a low bandwidth spectrum analyser w/o a tracking gen, pretty much, when I might consider getting a real one. Hmmmmm...

[abyrvalg]

Is there any menu to enter something like an "option key"? We can try MDO3k/TDS7k "trick"

[drforbin]

Hi...I just bought and fixed a tds520...
I'd like to enable option 2f fft calculus. Can anyone give me the procedure?

[TriodeTiger]

Hi...I just bought and fixed a tds520...
I'd like to enable option 2f fft calculus. Can anyone give me the procedure?

Looks like either: expensive cable, or expensive mistake (if yours has conformal coating like mine, as in removing it to access the NVRAM) - although it'd be fun to see somewhat-realtime somewhat-accurate FFTs, I still have the option to just transfer the data (ugh) by floppy () and calculate in MATLAB. I guess if I did get the cable, I could both do remote transfer of the data and modify the flash. Hm. Maybe one day. Spent too much on this hobby for the year though, moving on to guitar Oh wait, now I must build many'a amplifier..