Author Topic: Reverse engineering Tektronix TDS3GV module for TDS3000 series oscilloscopes?  (Read 25189 times)

0 Members and 1 Guest are viewing this topic.

Online blackfin76

  • Regular Contributor
  • *
  • Posts: 80
  • Country: nl
If you want to debug a serial bus like I2C or SPI the extra bandwidth doesn't add anything but if you do analog design or digital interface design it may be very useful. I have a Agilent MSO7014 for serial bus debugging, but I actually prefer the TDS3000 series for analog design.
 

Offline Hairystuff

  • Contributor
  • Posts: 15
  • Country: gb
For analog stuff I used to use a Iwatsu SS-5711 but I replaced it with a Agilent 54622D, I really like the Agilent with all of its features but I thought I'd try something newer like the Tek TDS3012, I purchased a Tek TBS1104 before the Agilent but didn't like it due to its slow update rates and no intensity controls, I do like the Tek but I still find myself using the Agilent more at the moment.
 

Offline james_s

  • Super Contributor
  • ***
  • Posts: 21611
  • Country: us
The TDS3000 is quite an old design at this point, I don't think CAN, I2C, and other interfaces that are widespread were really a thing back then. It was conceived in an era of parallel bus interfaces, hence the infamous DS1742W used internally.
 

Offline pmercier

  • Contributor
  • Posts: 42
  • Country: fr
I confirm, the tds3eng did the trick !
If you can't open it, you don't own it !
 
The following users thanked this post: Icchan

Offline Hairystuff

  • Contributor
  • Posts: 15
  • Country: gb
The TDS3000 is quite an old design at this point, I don't think CAN, I2C, and other interfaces that are widespread were really a thing back then. It was conceived in an era of parallel bus interfaces, hence the infamous DS1742W used internally.

I actually dremeled the RTC after desodering it and installing a socket on board, I got to the battery in the RTC chip after grinding off the encapsulation material and installed a CR2032 holder on there so I could easily access it for replacement in the future without changing the RTC module.
« Last Edit: November 14, 2019, 06:34:16 pm by Hairystuff »
 
The following users thanked this post: Icchan

Offline Hairystuff

  • Contributor
  • Posts: 15
  • Country: gb
I confirm, the tds3eng did the trick !

Oh nice, where you able to access the serial port via the RS232TTL converter
 

Offline james_s

  • Super Contributor
  • ***
  • Posts: 21611
  • Country: us
I've done the Dallas chip hack on a number of parts in that series with success but it's still a pain. The one in my TDS3000 failed again so I made an adapter to fit the still available DS1744 in the PowerCap (replaceable battery) package. Later I found the problem with the original DS1742W was a cracked joint where one of the nickel strips that went to the original battery connects to the PCB but I had already made the adapter PCB so I just used that.
 
The following users thanked this post: Icchan

Offline Hairystuff

  • Contributor
  • Posts: 15
  • Country: gb
My solution was alot less elegant but it seems to do the job. I had one of these fail on a Fluke Lanmeter 685 and it lost all the license keys, cal data and MAC address for the unit, I was worried a similar thing would happen to the scope.
« Last Edit: November 14, 2019, 06:41:32 pm by Hairystuff »
 

Offline james_s

  • Super Contributor
  • ***
  • Posts: 21611
  • Country: us
Thankfully nothing critical is stored there in the scope. It keeps the time and date, all the settings, the error log and the power-on hours. I figured out where those are stored and the format and was able to build a little rig hand program the 5 bytes for that. The bytes from x7E0 to x7E4 (iirc) hold the number of minutes the scope has been powered on. The cal data, power cycles and reference waveforms are stored elsewhere (eeprom?)
 

Offline pmercier

  • Contributor
  • Posts: 42
  • Country: fr
Ok, i tested the tds3eng for the serial port on my TDS3014 with a USB/TTL.

I can print over the serial port, but ... the GPIB commands seem to be unavailables :\
Sent a "*IDN?" but got nothing in return.

Just to be sure i did the same on my TDS3032C and the answer where returned.

Damn !

Okay now i can stop taking photos of the screen so it's already a small win, but it bug me  |O
If you can't open it, you don't own it !
 
The following users thanked this post: Icchan

Offline Hairystuff

  • Contributor
  • Posts: 15
  • Country: gb
Ok, i tested the tds3eng for the serial port on my TDS3014 with a USB/TTL.

I can print over the serial port, but ... the GPIB commands seem to be unavailables :\
Sent a "*IDN?" but got nothing in return.

Just to be sure i did the same on my TDS3032C and the answer where returned.

Damn !

Okay now i can stop taking photos of the screen so it's already a small win, but it bug me  |O

Is the 3.39 firmware on the scope, I've heard the newer 3.41FW does not support the hack.
 

Offline james_s

  • Super Contributor
  • ***
  • Posts: 21611
  • Country: us
That's a good point, yes you do need the earlier firmware for it to work.
 

Offline Hairystuff

  • Contributor
  • Posts: 15
  • Country: gb
It's good news that pmercier was able to communicate with the ENG app module installed in conjunction with the RS232TTL interface, hopefully it's just the firmware that's only holding it back from being unlocked, plus the price gouging and rarity of the interface modules is prohibitive in taking full advantage of the scope's capabilities.
« Last Edit: November 16, 2019, 12:31:27 am by Hairystuff »
 

Offline IcchanTopic starter

  • Regular Contributor
  • *
  • Posts: 88
  • Country: fi
OMG! The work and interest you all have put into this... this was a real joy to see when I opened this old thread after few months (i've been forgetful on my old topics on this forum). I threw a rock at the lake and didn't think much of it... Thank you everyone for taking part in this!   :clap:
One of the greatest communities around! :)

Offline stas_last

  • Newbie
  • Posts: 5
  • Country: ru
Hello everyone. The pinout is correct. only instead of 3.3v I have 5v. but this is not critical. I’ll wait a long time for this connector, so I took the oscilloscope apart and soldered to the board). CPU2102 is working correctly. But for me, usb is not suitable for work for many reasons. therefore, to take screenshots, I connected esp32. RX TX GND and 5V. Who is interested in the program for screenshots on wifi.
Code: [Select]
#include <WiFi.h>
#include <WiFiClient.h>
#include <WiFiAP.h>
extern "C" {
#include "libb64/cencode.h"
}

const char *ssid = "Tek";
const char *password = "12345678";

WiFiServer server(80);
String inputString = "";
boolean stringComplete = false;
void setup() {
  Serial.begin(38400);
  WiFi.softAP(ssid, password);
  IPAddress myIP = WiFi.softAPIP();
  server.begin();
}

void loop() {
  serialEvent();
  WiFiClient client = server.available();
  if (client) {
    while (client.connected()) {
      if (client.available()) {         
        client.println("HTTP/1.1 200 OK");
        client.println("Content-Type: text/html");
        client.println();
        client.println("<html>");
        client.println("  <body>");
        if (stringComplete) {       
          client.print("    <img src=\"data:image/png;base64,");
          client.print(base64_encode_utf((uint8_t*)&inputString[0], inputString.length()));
          client.println("\" alt=\"\" />");
          inputString = "";
          stringComplete = false;
        }
        client.println("    <p>Tektronix tds3000 snapshot</p>");
        client.println("  </body>");
        client.println("</html>");
        break;
      }
    }
    client.stop();   
  }
}
String base64_encode_utf(uint8_t * data, size_t length)
{
    size_t size = base64_encode_expected_len(length) + 1;
    char * buffer = (char *) malloc(size);
    if(buffer) {
        base64_encodestate _state;
        base64_init_encodestate(&_state);
        int len = base64_encode_block((const char *) &data[0], length, &buffer[0], &_state);
        len = base64_encode_blockend((buffer + len), &_state);
        String base64 = String(buffer);
        free(buffer);
        return base64;
    }
    return String("-FAIL-");
}
void serialEvent() {
  while (Serial.available()) {
    char inChar = (char)Serial.read();
    inputString += inChar;
    if (inChar == '\n') {         
      stringComplete = true;
    }
  } 
}
set the speed on the device to 38400, instead of printing to the printer, select printing to the serial port. press the print button, the data will go to esp32, and when connected from the browser the picture will fly there. generally interesting idea for the weekend)
« Last Edit: April 01, 2020, 04:08:25 pm by stas_last »
При луне хороша одна, При солнце зовет другая. Не пойму я, с какого вина Захмелела душа молодая?
 
The following users thanked this post: tv84, Draco.You, YetAnotherTechie, arturmariojr

Offline pmercier

  • Contributor
  • Posts: 42
  • Country: fr
Thank you for the sketch.
When I took my first screen shot with the hack putting an esp inside seemed a logic step. I haven't tried it because I was concerned about the impact of the WiFi signal on the scope, especially the measurements.
Have you tried to compare the traces before and after the hack ?
If you can't open it, you don't own it !
 

Offline stas_last

  • Newbie
  • Posts: 5
  • Country: ru
At first I thought about it too .. but, I installed power filters for the ESP32, - no interference is seen by eye. The idea is more serious than the screenshots. so even if something there is interference, it does not bother. ;)
При луне хороша одна, При солнце зовет другая. Не пойму я, с какого вина Захмелела душа молодая?
 

Offline pmercier

  • Contributor
  • Posts: 42
  • Country: fr
Good to know. Thank you.
If you can't open it, you don't own it !
 

Offline stas_last

  • Newbie
  • Posts: 5
  • Country: ru
I just wanted to ask you. I can not get an answer from the oscilloscope to the requests. changed both speed and integrity control. These requests come to the oscilloscope intact (looked in the terminal), but there is no answer. only worked on the old firmware? can't it be that somewhere on the original expansion card something is closed so that the oscilloscope understands that the expansion card is connected? let's say they can be used in the original dtr dsr? :palm:
При луне хороша одна, При солнце зовет другая. Не пойму я, с какого вина Захмелела душа молодая?
 

Offline pmercier

  • Contributor
  • Posts: 42
  • Country: fr
Yes, it seem there's something else on the card that allow the correct detection of the car type to activate the serial port.
I don't have a card so i started reverse engineering the availables photo cards and for the moment, i've no time to finish it.

I tested some ideas i came along during the reverse for the card identification, but failed so far (i know i documented all of the tests, but i can't find my notes).
I even overwritten one of my software module to allow the engineer mode, but even with that, no chance.
If you can't open it, you don't own it !
 

Offline stas_last

  • Newbie
  • Posts: 5
  • Country: ru
Не так страшен чёрт, как его малюют - Russian proverb 8)
if they were sewn into 24 memory, then I think it’s not difficult. Slot machines are more difficult fact.
При луне хороша одна, При солнце зовет другая. Не пойму я, с какого вина Захмелела душа молодая?
 

Offline pmercier

  • Contributor
  • Posts: 42
  • Country: fr
It not stored in the 24c memory. Only buyable software options keys are stored inside the memory chip.
You can put any interface card in your scope without having to alter or add an option key in the 24c memory. For info the only extension card having an inbord memory is the Ethernet one. But all of them have discrete ttl logic for the buffer chips of the expansion slot. I think that it's where the card detection logic is implementing but I can't find the missing traces on the pcb to find a logic for the detection.
If you can't open it, you don't own it !
 

Offline james_s

  • Super Contributor
  • ***
  • Posts: 21611
  • Country: us
I can xray the TDS3GV module if that would be helpful for further reverse engineering. It will have to wait until after this whole Covid thing blows over though as I don't have the machine in my house. Multilayer boards get a bit messy but with careful setting of the kVp and exposure it's often possible to image the traces.
 

Offline pmercier

  • Contributor
  • Posts: 42
  • Country: fr
Found back my notes and shcematics from traces this morning. I'll take a look tonight to see what traces was missing for the reverse, but an xray would be awesome as we would be able to see where exactly the traces are going below the connector.

Stas_last : Concerning the connector you can insert a 1.6mm PCB inside the scope connector with 50 mil spaced traces. It won't be reliable for long term reccurent dis/connection, but for home usage it can be enough if you can make them stay in place.
If you can't open it, you don't own it !
 

Offline pmercier

  • Contributor
  • Posts: 42
  • Country: fr
My most advanced reverse is for a TDS3GM. But it miss many connections due to hidden traces.

@james_s i'm definitively interested in a TDS3GV xray !
If you can't open it, you don't own it !
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf