Reverse Engineering TDS2CM/TDS2MM

[sd_tony]

Inspired by the genius guys who reverse engineered TDS3GV/TDS3EM and created a module to bring out RS232 and other interfaces on other thread, I'm trying to start a new thread for reverse engineering TDS2CM/TDS2MM for TDS200 series scopes.

TDS200 series could be one of the most popular scopes for beginners and hobbyists, there are still lots of used one available and are affordable for beginners, however, the monochrome display with 320x240 display is kind of outdated, an extension module (TDS2CM or TDS2MM) is needed to have RS232/Centronics/GPIB interfaces to send data to PC for better vision/processing, however, these extension modules are still very expensive these days. TDS2CM can be hacked to TDS2MM to have some additional features like FFT, rising time measurement etc., but that still doesn't justify the high price.

The goal here is to create a low cost and easy to make module by reverse engineering existing TDS2CM/TDS2MM module, more modern and cheaper parts can be used to create the module without having to find the vintage parts created in 90s.

By looking at the pictures of TDS2CM/TDS2MM, it's not difficult to create a block diagram to understand how it works. Basically it has a UART transceiver + MAX238 for RS232; a NI 488.2 controller for GPIB, a 8-channel D flip-clop (and two PALs?) for Centronics, as well as PROM, SRAM, and a HTC245 chip. The TH245 chip might be the one-byte ROM as module ID as descripted on the other thread.

Two things I'm still not very clear here:
1. why does this module has PROM and SRAM? there is no processor on this module, so the PROM and SRAM can only be used by the processor on scope controller board, does that mean the processor in scope will run the code stored in this module and utilize the SRAM as well? that looks strange though.

2. I'm not sure about the purpose of the two PAL chips, I guess they are some logic chips to convert CPU 8-bit data to printer acceptable data, but if that is not the case, and they involved in interface communication that will be a nightmare because we will need to reverse engineer them.

Anybody has done similar thing before? any ideas/clues/hints/comments are welcome.

[oPossum]

I did some poking around with a multimeter...

U103 74HCT245 is the data bus buffer
U202 74ALS374 is the parallel port data latch
U203 PALCE16V8H is used for the parallel port control signals
U104 PALCE16V8H is probably address decoding for ROM, RAM, and I/O chips (didn't trace all of the pins)

Everything is on the bus of the 68k CPU. The firmware in the module extends the firmware in the 'scope. The additional RAM is probably needed for various buffers.

Making an exact or functional equivalent is certainly possible but it will cost far more than just buying one.

[sd_tony]

Thanks your quick response, glad to know that one PAL is for parallel port, and the other might be for address decoding. Do you happen to still have the poking results, for example, the signal name on the 50-pin connector? That will be very helpful for me to start with.

To save cost, I'm not going to make a exact same module, parallel port and GPIB will be removed, only serial port + PROM (can be replaced by flash) and SRAM should be enough. Hopefully the firmware in scope will not check if GPIB controller exists or not.

Block diagram has been updated based on your information, thanks again.

[coromonadalix]

I have a TDS2MM in one scope at my job

for a start,  but i have tons of work at my job  cant play to long in it  in a day ...

db9 to u201  MAX238

db9-7  to pin 1
db9-3  to pin 2
db9-2  to pin 3
db9-8  to pin 7
db9-4  to pin 24
db9-6  to pin 23
db9-9  Ring    doesn't seem connected ??
db9-1  DCD    doesn't seem connected ??


u201 (MAX238)  pins  going into u200 (scn68681c1)

u201-4   to  u200-35

[sd_tony]

Thank you coromonadalix! can you help probe the signals between 50-pin extension connector and ICs like U200, U202, U203 and U104? we will be more interested in the connections between this connector and the controller ICs/ROM/RAM on board. oPossum mentioned that U103 is data buffer, so probably the data port of seral controller, parallel buffer, and GPIO controller will be connected to U103. 

[oPossum]

I just traced the PALs to the chip selects and parallel port. I didn't trace anything to the 50 pin connector because I don't have a pinout for that.

[coromonadalix]

ooooooh   i can work faster with that  schematic     i'll try to complete it  to the 50 pin header    pls be patient a little   

thks 

i'll check to make a dump of the eeprom since its socketed  .....  but for the pal's    its another story,  i can not damage the card ....

[sd_tony]

Great! that really helps! I just opened my TDS210 and probed the signals on 50-in extension connector. Most of signals are from 68K CPU except pin-33, pin-35, pin-45 which are connected to ASIC (U201 MM9527-VCE). I guess one of these pins are card detection, and the others may be interrupt some some other control signals.

OPossum or coromonadalix, can you help find out where these three pins are connected to on TDS2CM/MM module?

[daisizhou]

Sir, is TDS-2012C supported?

[oPossum]

U205 is a 28C64 EEPROM

Mostly complete schematic attached

[sd_tony]

Awesome, oPossum! can you quickly double check that P45 is really left open or it is actually pulled to ground (or to VCC, very unlikely though) through a 5K or 10 resistor? this pin is the only one which can be used as card detection signal, or else how does scope know the extension module is connected? by reading RPOM directly? it's possible, but not a typical design.

[sd_tony]

Sir, is TDS-2012C supported?

No, looks like TDS2CM/MM is for TDS210/220/224 only, TDS2012 has different extensions to support GPIB and other interface

[oPossum]

Pin 45 is open - does not go anywhere. Checking for a signature in the PROM is a much more robust way to detect the presence of firmware than just looking at a single pin. The PROM can be validated with a checksum/crc to ensure the entire contents are accessible and valid.

The HP 5465X series modules for many early 90's HP DSOs have 0x5A5A in the first word. An A series DSO will see this signature and then use the firmware in the module. The later B and D series DSOs will see the signature and then enable supporting firmware within the DSO. They don't use any of the firmware in the modules. This allowed modules that where already in production to be used with the newer DSOs.

Tektronix revised the TDS2CM firmware to create the TDS2CMA for the new TDS1000/TDS2000 series. The later B & C series eliminated the module slot and added USB. There isn't a TDS2MMA because the measurement capabilities became a standard feature.
 

[sd_tony]

according to Tek programmer manual, looks like TDS2CM works for TDS200, TDS1000 and TDS2000 series, but not 1000/2000 B and C series. By the way, what are the difference exactly between TDS2CM, TDS2CMA and TDS2CMAX? only firmware different? they all look similar physically.

TDS2CM already works with TDS1000/2000, why they created TDS2CMA and TDS2CMAX?

[sicco]

There was something similar with the tds3000 and the TDS3EM ethernet module: the -b and -c tds3000 scopes cannot accommodate a tds3em plugin because the scope resident PHY hardware was added to the -b and -c mainboard / power supply. The ttl level i/o pins for Ethernet PHY chip on the plugin module were thus already occupied in the later -b and -c  scopes. A plugin module in a -b or -c scope that tries to drive those pins, will end up battling the logic output that is already wired internally to that pin. So neither driver will win and both Ethernet sockets will no longer work when plugging in that module. (actually, -b and -c. scope will refuse to boot when it sees that plugin module is inserted).

[oPossum]

TDS2CMAX is a bundle with cable and software. Same hardware as TDS2CMA.

TDS2CM and TDS2MM will only work on TDS210/220/224

[sd_tony]

Ok, does anybody has TDS2CMA firmware? my PCB board will be available this weekend, and I'm going to find out if TDS2CM and TDS2CMA are based on same hardware and just with different firmware.

[sd_tony]

Finally the PCB board arrived, after quickly put everything together, and twist the PLD firmware couple of times, it works finally. The scope identified the module as TDM2MM, it can be TDS2CM with corresponding firmware. As you can see from image, I removed parallel and GPIB port, and changed RS232 to USB port by adding a UART to USB bridge chip. With the module installed, now my TDS210 supports FFT, rising/falling time measurement as well as positive and negative pule width measurement. With the PC tool "TekScope Utility" I can get screen hardcopy, waveform, and measurements on PC, basically this module functions just like a real TDS2MM.

I have couple of spare PCBs, I'm going to list them on eBay, not to make money, but to let those who sell TDS2CM with crazy price know that this module can be made with only 1/3 to 1/5 of their listing price, and hopefully they can lower their price to a reasonable range.

[coromonadalix]

 

[sd_tony]

Does anybody has a spared blank module cover? like the picture below? somehow my scope doesn't come with this cover, looks like this cover can hold a PCB, so if I can change the width and height of the PCB board, and cut a square hole on the cover for USB connector, it will fit.

[sd_tony]

Finally I got a blank module cover, and cut a square hole to let USB connector through, the new designed PCB perfectly fit the module cover which has all the hooks/clamps to fix the PCB board.

[firefly-10]

really a super thing. I have a TDS 1002 and if I have read correctly, this module should also work on the oscilloscope.   

Only where do you get the parts you need, like the board (the layouts) and the programmed components?

Is there any more info about the project ?

Greetings

Dirk

[sd_tony]

Yes, it should work for TDS1002 although I don't have such a oscilloscope to try.

The parts are ordered from Digi-Key and eBay, mainly RAM, FLASH, data buffer, UART transceiver, and USB to UART bridge, the most difficult part to find is the 50-pin 2mm pitch connector, it's rare and expensive.

PCB layout can be designed by some free tool like KiCad, but you will need dimensions of a real TDS2CM card to make sure the board you designed has the same outline so that it will be able to fit into the cover. You can send Gerber to some PCB vender like JLC, they can get back to you in one week.

The firmware (TDS2CM and TDS2MM) for FLASH can be found in this forum, but you will have to make the image for PLD (ATF16LV8) by yourself, that's the most challenge part, this PLD has couple of functions including board ID, address decoder, as well as emulated GPIB controller. To save cost  there is no GPIB transceiver on this card, but oscilloscope will check it during boot, so you will have to find a way to fool oscilloscope that the GPIB transceiver does exist, just no GPIB device connected all the time, otherwise, the oscilloscope will hung during boot.

It's fun to remove all of these rocks on the road to make it through, I'm not sure if I can share all the source files (schematic, PCB layout, gerber, PLD image etc.) in this forum, but it will be expensive if you just want to make one module (still much less than the price of the TDS2CM card listed on eBay).

[sd_tony]

by the way, to further save the cost, I created a TDS2MM only module, it removes UART transceiver and UART to USB bridge, so it will not be able to support any communication function, but will enable FFT and rise/fall/positive pule/negative pulse measurement functions for TDS210/220/224 oscilloscope. The PCB board is similar just with different PLD image and without UART/USB related parts installed.

[TERRA Operative]

What version of the original Tek firmware do you have for the TDS2CM and TDS2MM modules?
The latest I have found is 1.04 for both. If you have a later (or other version) do you mind uploading it here?

Thanks!