EEVblog Electronics Community Forum

Products => Test Equipment => Topic started by: TriodeTiger on August 02, 2014, 09:31:51 am

Title: Hacking my TDS460A to have options 1M/2F?
Post by: TriodeTiger on August 02, 2014, 09:31:51 am
I was extremely excited when I scored a Tek TDS460A on eBay for <$300 (to be reviewed and internals exposed some day soon) but learned it didn't have the memory option (and 2F, for DSP and math) so I couldn't do FFT I looked forward to for basic stuff (granted, I could record it on a spreadsheet and plot an FFT in matlab, rinse and repeat, but...)

I then learned that at least on the 540A/7xx, it is a software option:
http://www1.tek.com/forum/viewtopic.php?f=5&t=5526&p=10588&hilit=pitbull#p10591 (http://www1.tek.com/forum/viewtopic.php?f=5&t=5526&p=10588&hilit=pitbull#p10591)

I realised then that I haven't ever seen "hardware option" having anything to do with options 1M (memory) or 2F!

Do you think it's possible to upgrade it? The 540 looks purely like the next in the family, not some significantly different scope. unless i'm wrong, i guess i'll need to find a GPIB card and an ancient computer with an ISA bus to run the console program (yuck) , so if anyone has pointers on anything, shoot.
Title: Re: Hacking my TDS460A to have options 1M/2F?
Post by: AwArD_RzD on August 03, 2014, 09:24:08 pm
I'm in the same boat as you but i still don't have my TDS754d and my GPIB adapter yet.

There many information on the Tek forum about these series of scope, it seem you can check your board to see if you have some un-populated pad where you can define if you have the memory in hardware to do the software hack. I don't have the link unfortunately. (checked too much page in the last 2 day to remember where).

Check this image, this will give you an hint where to find the memory http://green-magic.nl/Download/TDS460A/TDS460A-3.jpg (http://green-magic.nl/Download/TDS460A/TDS460A-3.jpg) it's at the right of the 2  big QFP, check the data sheet and calculate how much memory you have. (the original page http://www.circuitsonline.net/forum/view/94488/1/condensatoren+waarvoor?query=condensatoren+waarvoor&mode=or (http://www.circuitsonline.net/forum/view/94488/1/condensatoren+waarvoor?query=condensatoren+waarvoor&mode=or) , i don't know what language it is but you can always translate it maybe he tell the option he have).

On my part i will un-solder the NVram do a backup and try to change the memory where the option should be, well Trial and error is the key when you don't have any useful info.
Title: Re: Hacking my TDS460A to have options 1M/2F?
Post by: TriodeTiger on August 05, 2014, 09:38:03 am
Your reply means a lot to me, it got me interested in getting my hands dirty :P

Here's a comparable shot: http://i.imgur.com/JqDVKJj.jpg (http://i.imgur.com/JqDVKJj.jpg) (note: mine is from early '95, theirs late '97 going by the dates on the memory. I guess theirs is revision 3 judging by the URL name.)

Quote
it's at the right of the 2  big QFP, check the data sheet and calculate how much memory you have.
There's 16 32Kx8 SRAM = 4M

I learned from the service manual, that the CPU assembly is within the unused option slot. It makes sense, as there's a battery attached to it for backup and all.
http://i.imgur.com/n20w2Zm.jpg (http://i.imgur.com/n20w2Zm.jpg)

I'm guessing the upgrade is purely those unpopulated SRAMs (+6MB), as the machine itself uses up a significant portion of the 8M on there. As a bonus at least, the RAM appears quite cheap on fleabay  (http://www.ebay.ca/itm/SRAM-M5M51008AFP-10L-MITS-SOIC-SOP-32-PKG-M5M51008AFP-/390117298772)

Think I should splurge and try installing those, or do they look like for something else maybe? at least it looks like the pads, from the reflow, have a hefty amount of solder to sink the ICs in to once I get them. I guess then I'd have to either educate myself on how to read NVRAM (I'd hope an Arduino could help, heh.) and hack away at it, as it seems to be the cheaper option than making some sorta GPIB rig.
Title: Re: Hacking my TDS460A to have options 1M/2F?
Post by: TriodeTiger on August 06, 2014, 08:31:12 am
From all I've read with similar stories to mine, it was a firmware switch, and the specific offset appears to be the same among many 4/5/6xx scopes so I have hope for that. 0x50006 for 1M, -09 for 2F.

So... a little help is required!

1. Hackery:
On the CPU board, there is a battery attached to a DS1211 (a non-volatile SRAM controller) and 4 1MB SRAMs, under a load of gel-like conformal coating nonetheless (yuck.)

So..

To muck around with the NVRAM, with a programmer/'duino, what is my course of action? Can I fly some leads in to one of the SRAM and is it simply cascaded with the others? Do other scopes have a configuration like this, and how to do they back theirs up? (can't find any actual specifics on the process..)

2. GPIB:
I just looked at GPIB-to-USB adapters and they all look *pricey*  |O and I'm assuming RS232 ain't gonna touch the firmware.

I no longer have a computer with an ISA/PCI slot, for a GPIB card, but that might come out to the same as the USB option. Are the people doing GPIB using one or the other or something more clever?

3. Be happy with what I've got.  :-/O nah.
Title: Re: Hacking my TDS460A to have options 1M/2F?
Post by: AwArD_RzD on August 06, 2014, 11:56:06 am
Well you don't have many choice, since everything is soldered on the board you will need to find a way to extract the content before messing the memory content, DXL posted a link on my topic for my tds754d http://stackframe.org/tektool.shtml, (http://stackframe.org/tektool.shtml,) to read the content via the GPIB.
Maybe you can use the source code modify it to fit your need. Since i can de solder my nvram (i have one like this http://www.ebay.ca/itm/251245225991?ssPageName=STRK:MEWNX:IT&_trksid=p3984.m1497.l2649 (http://www.ebay.ca/itm/251245225991?ssPageName=STRK:MEWNX:IT&_trksid=p3984.m1497.l2649) ), i will not mess with software and code so i can't help you with this method.

You can always buy a FPGA dev kit (like the de0 nano) and find the schematic of your scope write vhdl/verilog to extract and re upload the data, tap the signal on the bus and extract the content of the nvram to the FPGA SDRAM (be aware of the logic level!! the de0 nano is 3.3v so a level shifter will probably needed) . So if the offset is wrong and your scope brick or do weird thing you will have a some kind of "backup". This is a realy good project if you want to have fun.

But i'm sure there a better way somewhere, maybe tektronix had a tool to read/write the content??

If you look for a GPIB adapter Wuerstchenhund posted a fully Agilent compatible clone in my post http://www.ebay.ca/itm/S82357-GPIB-USB-interface-Agilent-82357B-compatible-/171387561919 (http://www.ebay.ca/itm/S82357-GPIB-USB-interface-Agilent-82357B-compatible-/171387561919) , for my part i bought the F version it's 10$ more and they say it's faster, but it still in the mail so no review for now.
Title: Re: Hacking my TDS460A to have options 1M/2F?
Post by: David Hess on August 06, 2014, 12:42:59 pm
Since the oscilloscope is working, I would be leery of physically damaging it and restrict myself to non-invasive procedures while attempting to activate the options.
Title: Re: Hacking my TDS460A to have options 1M/2F?
Post by: vaualbus on August 06, 2014, 04:11:22 pm
I will nor try to do this.
On The TDS scope the think you read for the option 1M is only workinf on some scope not all, for example my no revision TDS540 scope the trich didn't work. At the I found a sram image for the TDS540 which have option 1M and 2F enable and use that.
Also is impossible that the scope have 4M of memory is too high.
And the trick is done by using the console port that I don't know if in your scope is presenteand the command would be different.
You coould lost all the calibration data If the procedure fail.
On the TDS500, 600, and 700 If you lose the cal data there is a way to restore the original factory data but I don't know If also work on the previous scope.

Also I think you overpaid a little bit the scope I would have buy a TDS500 (I buy mine at 250$ but broken, follow my posts on it If want to see how I repair it) instead.
Also check and change all the caps they leak a lot.
Title: Re: Hacking my TDS460A to have options 1M/2F?
Post by: nctnico on August 06, 2014, 05:27:16 pm
I agree. The locations (addresses) for the options are different for different series of scopes. People tend to track them by analysing what the firmware reads from the NVRAM during startup using a logic analyser. That is a lot of work.
Title: Re: Hacking my TDS460A to have options 1M/2F?
Post by: vaualbus on August 06, 2014, 10:54:32 pm
Ya a lot of work and we even not know If the scope run like the TDS540 vxWorks.
So you have to connect a logic analyzer on the bus and try reverse enginiring the os call.
Very hard work I don't know If it the best think.
Sell the scope and buy a TDS540 whith the option installed and you havte the FFT less work to do!
Title: Re: Hacking my TDS460A to have options 1M/2F?
Post by: Watermelon on August 06, 2014, 11:08:53 pm
Try to read out the NVRAM contents and drop it here. I upgraded my TDS520A with the options 1M/2F, it shouldn't be too hard finding the right adresses to edit.
Title: Re: Hacking my TDS460A to have options 1M/2F?
Post by: TriodeTiger on August 07, 2014, 08:23:17 am
Also I think you overpaid a little bit the scope
For $300 I got the scope in great condition, the original operating manual and 4x 400MHz Tek branded probes - I think I struck eBay gold, actually! I can sell the scope for double that (just guessing, most of them appear to sell for that) and keep the probes if anything.

DXL posted a link on my topic for my tds754d http://stackframe.org/tektool.shtml, (http://stackframe.org/tektool.shtml,) to read the content via the GPIB.
The code appears to be using a C GPIB library, so I guess they wouldn't read the $65 GPIB-USB adapter, maybe, since they just make a serial port. I guess maybe in the end, it's the decision to spend $100 on an adapter (yuck) to get a low bandwidth spectrum analyser w/o a tracking gen, pretty much, when I might consider getting a real one. Hmmmmm...
Title: Re: Hacking my TDS460A to have options 1M/2F?
Post by: abyrvalg on August 07, 2014, 05:39:56 pm
Is there any menu to enter something like an "option key"? We can try MDO3k/TDS7k "trick"
Title: Re: Hacking my TDS460A to have options 1M/2F?
Post by: drforbin on October 18, 2014, 05:15:21 am
Hi...I just bought and fixed a tds520...
I'd like to enable option 2f fft calculus. Can anyone give me the procedure?
Title: Re: Hacking my TDS460A to have options 1M/2F?
Post by: TriodeTiger on October 21, 2014, 11:10:28 am
Hi...I just bought and fixed a tds520...
I'd like to enable option 2f fft calculus. Can anyone give me the procedure?

Looks like either: expensive cable, or expensive mistake (if yours has conformal coating like mine, as in removing it to access the NVRAM) - although it'd be fun to see somewhat-realtime somewhat-accurate FFTs, I still have the option to just transfer the data (ugh) by floppy (:P) and calculate in MATLAB. I guess if I did get the cable, I could both do remote transfer of the data and modify the flash. Hm. Maybe one day. Spent too much on this hobby for the year though, moving on to guitar :P Oh wait, now I must build many'a amplifier..