Reverse engineering Tektronix TDS3GV module for TDS3000 series oscilloscopes?

[Icchan]

Hi everyone.

I've had a possession of older Tektronix TDS3032 oscilloscope for some years. It's good unit, but the lack of any expansion cards is starting to drive me crazy. I have a floppy drive (which I'm thinking to replace with floppy emulator), but RS232/VGA/GPIB option card would be a god send.

Unfortunately TDS3GV module is prohibitively expensive. It's hundreds of Euros used, and with that mount of money, one should already buy new Rigol or something else and that would be money better spent.

http://uk.rs-online.com/web/p/oscilloscope-modules/4136989/

I spent some time Googling if anyone has reverse engineered or even opened the module and if it's in any way feasible as a project to create OSH replacement for this. But found nothing.

I wonder if any forum members have aforementioned module that they could open up and photograph at least? that would at least give some idea if there's any sense even considering the idea.

Thanks for any input about this

[Jwalling]

Here you go.

[james_s]

This is a very old thread but I just found it today. Fascinating, there's very little in those, it can almost be reverse engineered just from a photo. The VGA is as I suspected just a DAC which is almost certainly fed by the same signals that go to the internal LCD. The RS232 looks like just some buffers and a level shifter. The GPIB uses an off the shelf GPIB interface IC.

Just having the pinout for the RS232 portion would make it easy to replicate that part which is all I really need.

[pmercier]

Hi,

can't agree more with you jame_s. I have two of the TDS3000 at home and started to wan't at least a serial interface.

I started to map the connector pinout around april and can confirm that the LCD lines are more or less directly connected to it.

The serial lines seem to be around the middle of the connector but hadn't time to confirm it.

[james_s]

Well I ended up just buying one of these things myself, at $240 it was more than I had invested in the whole scope but I'm still ahead in the grand scheme of things. Time permitting I'll reverse engineer the serial portion, that alone is enough to do the bandwidth unlock amongst other things.

[alba800]

That would be a great thing. I'm waiting for you to have time to map the serial signals pinout.

many thanks

[james_s]

I've been swamped with my day job lately, on top of some house maintenance. I have not forgotten though, the scope with its comm module are sitting in the middle of my workbench awaiting a closer look.

[fqahmad66]

its probably a four layered pcb. hard to replicate.

[james_s]

Not really, 4 layer boards aren't that big a deal anymore but I'm pretty sure it's only a regular double sided board. Not really relevant anyway since the only portion needed is the RS232 interface and there's only a handful of parts in that. 

[james_s]

Ok so it turns out this *is* a 4 layer board, that didn't end up being too much of an obstacle though. Tonight I sat down and went through the serial part and mapped out the pins at each end. I'm pretty confident this is correct but the usual disclaimers apply, use this information at your own risk, I'm not going to take responsibility if you fry your scope.

I haven't taken the time to draw up a schematic but the serial portion is trivial enough that this shouldn't even be necessary. The DB9 connector has TXD, RXD, CTS, RTS, DTR and DSR wired to the MAX2386 through what looks like some ESD protection, the capacitors are wired from each pin to ground. Curiously DTR is tied to ground on the input side (pin 19) of the level shifter and DSR (pin 22) is floating. The four signals that are used pass through 100R resistors directly to pins on the 100 pin connector, I don't know specifically what this connector is but has the AMP logo on it and looks like what I've seen called HiRose connectors. I don't know how the pin numbering is arranged so I've marked on the picture where all the signals go.

I've marked all of the ground pins, obviously they are not all involved in the serial interface however I suspect (and hope) the scope identifies the installed module by something as simple as grounding the right pins. If somebody decides to clone the serial interface using this information please do share the results.

[pmercier]

The 100pins connector can be replaced by a standard 1.6mm pcb. It fit inside without a problem.
Thank you for the serial mapping.

[pmercier]

Found my old notes from pocking inside the scope and it triggered an heavy desire to loose some sleeping hours

Looking at the pins you marked as ground, I've found the same ones for ground on the scope motherboard.

Found the board connector (hope i got the good one) and ordered a testing PCB. Am actually waiting for both of them to arrive.

From what i found when pocking around :

* The screen signal from the J500 connector is present on the extension connector directly (Don't think i'll do something with it, but ... can be fun to play with it later)
* Data (16) and address bus is accessible (found only 11 lines for the moment)
* Something that i need to check again : RTS is connected to the *WR ... seem odd

[pmercier]

Forgot the link for the connnector : https://www.mouser.fr/ProductDetail/TE-Connectivity-AMP/1-1734099-0?qs=hnUcNC2tU0rNktC3%2FzE9dQ==

[james_s]

Oh there you go, yeah that looks right, AMP 1-1734099-0, good find. It's not even very expensive, I'd buy one myself but I already have the original module so not much to be gained in duplicating the work of others.

If all the ground pins I marked are ground on the motherboard then I wonder how it detects that the module is installed? If wiring up a comm port doesn't just work I'll have to take another look and see if I can find any likely suspects. The serial settings are not disabled without a comm module but it does definitely know when it's there and list it on the boot screen.

Yeah the video I assume is just the exact same signals that go to the TFT, I've used the similar ADV7123 VGA DAC before and it accepts exactly the same digital RGB/H/V/Dotclock signal as these older TFT displays. I have a VGA output on my other scope and I've never actually used it, the built in display has always been adequate for me.

Makes sense that the data and address bus would be there, the GPIB interface would need that. Does sound odd about RTS going to WR, if it doesn't work I can take it apart again and double check but I'm pretty confident I got the pins traced out correctly.

[pmercier]

Little update. Received the connnectors today. They're a perfect match.
I soldered dupond wires for the 3.3v serial/usb module directly on the provided pins and ... worked like a charm once i removed the hardware control flow from the scope config.

Sended : *IDN?
Got : TEKTRONIX,TDS 3032C,0,CF:91.1CT FV:v4.05 TDS3FFT:v1.00 TDS3TRG:v1.00

 

[ArcticGeek]

@pmercier

Nice work.

Can you clarify what the wires you soldered on were connected to?   I assume these were the serial connections that you soldered:  TX, RX, CTS, and RTS....is that correct?   And these wires were then connected to some sort of TTL/RS232 level translator IC?

Mike

[james_s]

Woohoo!

Would have saved me $250 (well, $230 by the time I bought a connector) to know that but somebody had to do it. Glad to hear it works and is really that simple.

The wires are soldered to TXD, RXD, CTS and RTS, refer to my screenshot of the bottom of the board where it is labeled.

The signals are 3.3V logic so you will need something like a MAX232 or one of those USB to LVTTL serial modules. They go direct to the CPU or one of the ASICs so I highly recommend some ESD protection as was incorporated in the original comm module. 

Downgrade to firmware 3.39 and then send the following:
        PASSWORD PITBULL
        MCONFIG TDS3054

Power cycle and it should boot up saying it's a TDS3054B. Run SPC and you should be good to go.

You can then update to the latest firmware and run SPC again.

Actually I believe the B models can go all the way up to TDS3064 which is 600MHz 5GS/sec. Mine is a TDS3014 (no letter) so I was "only" able to upgrade it to 500MHz.

[pmercier]

Hi,

some update. I received my pcb order to have the connector available outside to play with this saturday.

I just tried to use the serial port of my TDS3000(A) but with no success.

Seem like the A model, we must use the hardware RTS/CTS control flow (don't have anything to test against for the moment) or the serial port is disabled by default (fuxxored).
I would more easyli go for the second idea as there is nothing about a serial port in the menus (my 3032C has serial port config event without an extension card).
So getting a Floppy emulator to downgrade the firmware seem now less urgent

BTW for the screen as it's connected "directly" to the lcd connector the signal is present as soon as the scope is on.

pin 2, 11: DotClock 25MHz
pin 3 : HSync 31.5Khz (lonw 31,72us)
pin 4 : VSync 60,16Khz (low 16,62ms)
Pin 6-9 : Red [0-3]
Pin 51,52,54,55 : Green [0-3]
Pin 56,57,59,60 : Blue [0-3]

I have mapped the datalines and some of the address lines too but for the moment i can't confirm their axact assignation(just some guess).

After some more playing i think like james_s that some pins are used to detect the type of extension card. But it seem more tricky than some lines to ground.

I have a bunch of pins that have no signal on them :

High state  : 13, 15, 24, 65, 66
Low state :  14, 16, 18, 19, 20, 22, 23, 25, 61, 62, 63, 64

Given the position of the pins i suspect the LC00A and LC08A to have something to to with the identification of the module.
They're probably only for the logic to enable/disable the 245's of the GPIB controller, but it can be a possibility that one of thoses is used to act as a "ROM" on the data bus for a byte to identify the module.

Edited to add pins 61 to 64.

[james_s]

Hey that breakout board is a cool idea!

If you want to work on reverse engineering this further, I can open mine up again and trace out pins that you're wondering about. The scope is definitely able to identify the module that is plugged in, it may do so by detecting the GPIP or ethernet chips on the bus, it could also be something simple like connecting specific pins to other pins.

[pmercier]

Yes am actually working on reverse engineering it based on the image only and I must say it's limited.

I'll gladly accept any help on this matter ^_^

The breakout board (thanks for the term) for this type of work is a must have !

For the pin to pin i thought so to and forgot to write it. it's on my test list for tonight if am not too tired to leave my eyes open.

[pmercier]

Done some testing on the pins with pull-up/pull-down resistors and nothing appened. No bugs, no freeze and no card detection.

I think i'll stop this brute test because it mean turing on turning off the socilloscope every time and with more than 500K combinations i'll end up with a dead finger and a broken oscilloscope 

Time to :

- JTAG on the A model ?
- repair the PSU of the C model ?
- repair the battery pack of the C model ?

 

[Hairystuff]

Not sure if this information is of any use to you guys but I found that if you use the TDS3ENG Application Module it enables the communication configuration options blindly in the utility sub menu.

[pmercier]

Good to know, thank you !
Time to find some eeprom

[james_s]

Oh maybe that's why they were all enabled on mine. I reflashed the Adv Trig module that came in mine since the latest firmware enables that by default anyway. I've actually considered reflashing both modules I have with features I actually want, because TDS3ENG enables a whole bunch of completely useless crap that clutters up the menu. I don't have (or need) the hardware necessary to test SDI video and I have no use whatsoever for the ability to measure a bunch of obsolete communication protocols.

[Hairystuff]

The comms protocol masks where kind of useless to me and the video stuff is nice to have especially the vector scope stuff but the video display stuff is not the best performance wise, I was hoping there would be some CAN/serial/I2C decoding ability but I'm not too fussed, I'm hoping that the ENG application module might enable the serial ports so that the scope can be hacked to full bandwidth without the comms/ethernet module on a non 3012B/C scope, I've never really needed anything above a 100MHz but it would be interesting to see what uses I could find for it at 500MHz.