Products > Test Equipment
Reverse Engineering TDS2CM/TDS2MM
(1/8) > >>
sd_tony:
Inspired by the genius guys who reverse engineered TDS3GV/TDS3EM and created a module to bring out RS232 and other interfaces on other thread, I'm trying to start a new thread for reverse engineering TDS2CM/TDS2MM for TDS200 series scopes.

TDS200 series could be one of the most popular scopes for beginners and hobbyists, there are still lots of used one available and are affordable for beginners, however, the monochrome display with 320x240 display is kind of outdated, an extension module (TDS2CM or TDS2MM) is needed to have RS232/Centronics/GPIB interfaces to send data to PC for better vision/processing, however, these extension modules are still very expensive these days. TDS2CM can be hacked to TDS2MM to have some additional features like FFT, rising time measurement etc., but that still doesn't justify the high price.

The goal here is to create a low cost and easy to make module by reverse engineering existing TDS2CM/TDS2MM module, more modern and cheaper parts can be used to create the module without having to find the vintage parts created in 90s.

By looking at the pictures of TDS2CM/TDS2MM, it's not difficult to create a block diagram to understand how it works. Basically it has a UART transceiver + MAX238 for RS232; a NI 488.2 controller for GPIB, a 8-channel D flip-clop (and two PALs?) for Centronics, as well as PROM, SRAM, and a HTC245 chip. The TH245 chip might be the one-byte ROM as module ID as descripted on the other thread.

Two things I'm still not very clear here:
1. why does this module has PROM and SRAM? there is no processor on this module, so the PROM and SRAM can only be used by the processor on scope controller board, does that mean the processor in scope will run the code stored in this module and utilize the SRAM as well? that looks strange though.

2. I'm not sure about the purpose of the two PAL chips, I guess they are some logic chips to convert CPU 8-bit data to printer acceptable data, but if that is not the case, and they involved in interface communication that will be a nightmare because we will need to reverse engineer them.

Anybody has done similar thing before? any ideas/clues/hints/comments are welcome.
oPossum:
I did some poking around with a multimeter...

U103 74HCT245 is the data bus buffer
U202 74ALS374 is the parallel port data latch
U203 PALCE16V8H is used for the parallel port control signals
U104 PALCE16V8H is probably address decoding for ROM, RAM, and I/O chips (didn't trace all of the pins)

Everything is on the bus of the 68k CPU. The firmware in the module extends the firmware in the 'scope. The additional RAM is probably needed for various buffers.

Making an exact or functional equivalent is certainly possible but it will cost far more than just buying one.
sd_tony:
Thanks your quick response, glad to know that one PAL is for parallel port, and the other might be for address decoding. Do you happen to still have the poking results, for example, the signal name on the 50-pin connector? That will be very helpful for me to start with.

To save cost, I'm not going to make a exact same module, parallel port and GPIB will be removed, only serial port + PROM (can be replaced by flash) and SRAM should be enough. Hopefully the firmware in scope will not check if GPIB controller exists or not.

Block diagram has been updated based on your information, thanks again.
coromonadalix:
I have a TDS2MM in one scope at my job

for a start,  but i have tons of work at my job  cant play to long in it  in a day ...

db9 to u201  MAX238

db9-7  to pin 1
db9-3  to pin 2
db9-2  to pin 3
db9-8  to pin 7
db9-4  to pin 24
db9-6  to pin 23
db9-9  Ring    doesn't seem connected ??
db9-1  DCD    doesn't seem connected ??


u201 (MAX238)  pins  going into u200 (scn68681c1)

u201-4   to  u200-35


sd_tony:
Thank you coromonadalix! can you help probe the signals between 50-pin extension connector and ICs like U200, U202, U203 and U104? we will be more interested in the connections between this connector and the controller ICs/ROM/RAM on board. oPossum mentioned that U103 is data buffer, so probably the data port of seral controller, parallel buffer, and GPIO controller will be connected to U103. 
Navigation
Message Index
Next page
There was an error while thanking
Thanking...

Go to full version
Powered by SMFPacks Advanced Attachments Uploader Mod