Author Topic: Reverse engineering Tektronix TDS3GV module for TDS3000 series oscilloscopes? (Read 25027 times)

Icchan · « **on:** December 07, 2016, 10:03:31 am »

Hi everyone.

I've had a possession of older Tektronix TDS3032 oscilloscope for some years. It's good unit, but the lack of any expansion cards is starting to drive me crazy. I have a floppy drive (which I'm thinking to replace with floppy emulator), but RS232/VGA/GPIB option card would be a god send.

Unfortunately TDS3GV module is prohibitively expensive. It's hundreds of Euros used, and with that mount of money, one should already buy new Rigol or something else and that would be money better spent.

http://uk.rs-online.com/web/p/oscilloscope-modules/4136989/

I spent some time Googling if anyone has reverse engineered or even opened the module and if it's in any way feasible as a project to create OSH replacement for this. But found nothing.

I wonder if any forum members have aforementioned module that they could open up and photograph at least? that would at least give some idea if there's any sense even considering the idea.

Thanks for any input about this

Jwalling · « **Reply #1 on:** December 07, 2016, 11:11:35 am »

Here you go.

james_s · « **Reply #2 on:** September 27, 2019, 09:49:12 pm »

This is a very old thread but I just found it today. Fascinating, there's very little in those, it can almost be reverse engineered just from a photo. The VGA is as I suspected just a DAC which is almost certainly fed by the same signals that go to the internal LCD. The RS232 looks like just some buffers and a level shifter. The GPIB uses an off the shelf GPIB interface IC.

Just having the pinout for the RS232 portion would make it easy to replicate that part which is all I really need.

pmercier · « **Reply #3 on:** October 02, 2019, 07:11:47 am »

Hi,

can't agree more with you jame_s. I have two of the TDS3000 at home and started to wan't at least a serial interface.

I started to map the connector pinout around april and can confirm that the LCD lines are more or less directly connected to it.

The serial lines seem to be around the middle of the connector but hadn't time to confirm it.

james_s · « **Reply #4 on:** October 02, 2019, 03:49:00 pm »

Well I ended up just buying one of these things myself, at $240 it was more than I had invested in the whole scope but I'm still ahead in the grand scheme of things. Time permitting I'll reverse engineer the serial portion, that alone is enough to do the bandwidth unlock amongst other things.

alba800 · « **Reply #5 on:** October 09, 2019, 12:43:45 pm »

That would be a great thing. I'm waiting for you to have time to map the serial signals pinout.

many thanks

james_s · « **Reply #6 on:** October 09, 2019, 10:40:48 pm »

I've been swamped with my day job lately, on top of some house maintenance. I have not forgotten though, the scope with its comm module are sitting in the middle of my workbench awaiting a closer look.

fqahmad66 · « **Reply #7 on:** October 11, 2019, 05:05:47 am »

its probably a four layered pcb. hard to replicate.

james_s · « **Reply #8 on:** October 11, 2019, 05:24:29 am »

Not really, 4 layer boards aren't that big a deal anymore but I'm pretty sure it's only a regular double sided board. Not really relevant anyway since the only portion needed is the RS232 interface and there's only a handful of parts in that.

james_s · « **Reply #9 on:** October 13, 2019, 01:34:28 am »

Ok so it turns out this *is* a 4 layer board, that didn't end up being too much of an obstacle though. Tonight I sat down and went through the serial part and mapped out the pins at each end. I'm pretty confident this is correct but the usual disclaimers apply, use this information at your own risk, I'm not going to take responsibility if you fry your scope.

I haven't taken the time to draw up a schematic but the serial portion is trivial enough that this shouldn't even be necessary. The DB9 connector has TXD, RXD, CTS, RTS, DTR and DSR wired to the MAX2386 through what looks like some ESD protection, the capacitors are wired from each pin to ground. Curiously DTR is tied to ground on the input side (pin 19) of the level shifter and DSR (pin 22) is floating. The four signals that are used pass through 100R resistors directly to pins on the 100 pin connector, I don't know specifically what this connector is but has the AMP logo on it and looks like what I've seen called HiRose connectors. I don't know how the pin numbering is arranged so I've marked on the picture where all the signals go.

I've marked all of the ground pins, obviously they are not all involved in the serial interface however I suspect (and hope) the scope identifies the installed module by something as simple as grounding the right pins. If somebody decides to clone the serial interface using this information please do share the results.

pmercier · « **Reply #10 on:** October 14, 2019, 06:35:00 am »

The 100pins connector can be replaced by a standard 1.6mm pcb. It fit inside without a problem.
Thank you for the serial mapping.

pmercier · « **Reply #11 on:** October 20, 2019, 12:22:37 am »

Found my old notes from pocking inside the scope and it triggered an heavy desire to loose some sleeping hours

Looking at the pins you marked as ground, I've found the same ones for ground on the scope motherboard.

Found the board connector (hope i got the good one) and ordered a testing PCB. Am actually waiting for both of them to arrive.

From what i found when pocking around :

* The screen signal from the J500 connector is present on the extension connector directly (Don't think i'll do something with it, but ... can be fun to play with it later)
* Data (16) and address bus is accessible (found only 11 lines for the moment)
* Something that i need to check again : RTS is connected to the *WR ... seem odd

pmercier · « **Reply #12 on:** October 20, 2019, 12:23:37 am »

Forgot the link for the connnector : https://www.mouser.fr/ProductDetail/TE-Connectivity-AMP/1-1734099-0?qs=hnUcNC2tU0rNktC3%2FzE9dQ==

james_s · « **Reply #13 on:** October 20, 2019, 02:12:50 am »

Oh there you go, yeah that looks right, AMP 1-1734099-0, good find. It's not even very expensive, I'd buy one myself but I already have the original module so not much to be gained in duplicating the work of others.

If all the ground pins I marked are ground on the motherboard then I wonder how it detects that the module is installed? If wiring up a comm port doesn't just work I'll have to take another look and see if I can find any likely suspects. The serial settings are not disabled without a comm module but it does definitely know when it's there and list it on the boot screen.

Yeah the video I assume is just the exact same signals that go to the TFT, I've used the similar ADV7123 VGA DAC before and it accepts exactly the same digital RGB/H/V/Dotclock signal as these older TFT displays. I have a VGA output on my other scope and I've never actually used it, the built in display has always been adequate for me.

Makes sense that the data and address bus would be there, the GPIB interface would need that. Does sound odd about RTS going to WR, if it doesn't work I can take it apart again and double check but I'm pretty confident I got the pins traced out correctly.

pmercier · « **Reply #14 on:** October 21, 2019, 08:17:04 pm »

Little update. Received the connnectors today. They're a perfect match.
I soldered dupond wires for the 3.3v serial/usb module directly on the provided pins and ... worked like a charm once i removed the hardware control flow from the scope config.

Sended : *IDN?
Got : TEKTRONIX,TDS 3032C,0,CF:91.1CT FV:v4.05 TDS3FFT:v1.00 TDS3TRG:v1.00

ArcticGeek · « **Reply #15 on:** October 21, 2019, 08:44:33 pm »

@pmercier

Nice work.

Can you clarify what the wires you soldered on were connected to? I assume these were the serial connections that you soldered: TX, RX, CTS, and RTS....is that correct? And these wires were then connected to some sort of TTL/RS232 level translator IC?

Mike

james_s · « **Reply #16 on:** October 21, 2019, 11:21:19 pm »

Woohoo!

Would have saved me $250 (well, $230 by the time I bought a connector) to know that but somebody had to do it. Glad to hear it works and is really that simple.

The wires are soldered to TXD, RXD, CTS and RTS, refer to my screenshot of the bottom of the board where it is labeled.

The signals are 3.3V logic so you will need something like a MAX232 or one of those USB to LVTTL serial modules. They go direct to the CPU or one of the ASICs so I highly recommend some ESD protection as was incorporated in the original comm module.

Downgrade to firmware 3.39 and then send the following:
PASSWORD PITBULL
MCONFIG TDS3054

Power cycle and it should boot up saying it's a TDS3054B. Run SPC and you should be good to go.

You can then update to the latest firmware and run SPC again.

Actually I believe the B models can go all the way up to TDS3064 which is 600MHz 5GS/sec. Mine is a TDS3014 (no letter) so I was "only" able to upgrade it to 500MHz.

pmercier · « **Reply #17 on:** November 03, 2019, 11:40:25 pm »

Hi,

some update. I received my pcb order to have the connector available outside to play with this saturday.

I just tried to use the serial port of my TDS3000(A) but with no success.

Seem like the A model, we must use the hardware RTS/CTS control flow (don't have anything to test against for the moment) or the serial port is disabled by default (fuxxored).
I would more easyli go for the second idea as there is nothing about a serial port in the menus (my 3032C has serial port config event without an extension card).
So getting a Floppy emulator to downgrade the firmware seem now less urgent

BTW for the screen as it's connected "directly" to the lcd connector the signal is present as soon as the scope is on.

pin 2, 11: DotClock 25MHz
pin 3 : HSync 31.5Khz (lonw 31,72us)
pin 4 : VSync 60,16Khz (low 16,62ms)
Pin 6-9 : Red [0-3]
Pin 51,52,54,55 : Green [0-3]
Pin 56,57,59,60 : Blue [0-3]

I have mapped the datalines and some of the address lines too but for the moment i can't confirm their axact assignation(just some guess).

After some more playing i think like james_s that some pins are used to detect the type of extension card. But it seem more tricky than some lines to ground.

I have a bunch of pins that have no signal on them :

High state : 13, 15, 24, 65, 66
Low state : 14, 16, 18, 19, 20, 22, 23, 25, 61, 62, 63, 64

Given the position of the pins i suspect the LC00A and LC08A to have something to to with the identification of the module.
They're probably only for the logic to enable/disable the 245's of the GPIB controller, but it can be a possibility that one of thoses is used to act as a "ROM" on the data bus for a byte to identify the module.

Edited to add pins 61 to 64.

james_s · « **Reply #18 on:** November 04, 2019, 04:38:30 am »

Hey that breakout board is a cool idea!

If you want to work on reverse engineering this further, I can open mine up again and trace out pins that you're wondering about. The scope is definitely able to identify the module that is plugged in, it may do so by detecting the GPIP or ethernet chips on the bus, it could also be something simple like connecting specific pins to other pins.

pmercier · « **Reply #19 on:** November 04, 2019, 08:12:39 am »

Yes am actually working on reverse engineering it based on the image only and I must say it's limited.

I'll gladly accept any help on this matter ^_^

The breakout board (thanks for the term) for this type of work is a must have !

For the pin to pin i thought so to and forgot to write it. it's on my test list for tonight if am not too tired to leave my eyes open.

pmercier · « **Reply #20 on:** November 04, 2019, 11:27:18 pm »

Done some testing on the pins with pull-up/pull-down resistors and nothing appened. No bugs, no freeze and no card detection.

I think i'll stop this brute test because it mean turing on turning off the socilloscope every time and with more than 500K combinations i'll end up with a dead finger and a broken oscilloscope

Time to :

- JTAG on the A model ?
- repair the PSU of the C model ?
- repair the battery pack of the C model ?

Hairystuff · « **Reply #21 on:** November 13, 2019, 09:34:47 pm »

Not sure if this information is of any use to you guys but I found that if you use the TDS3ENG Application Module it enables the communication configuration options blindly in the utility sub menu.

pmercier · « **Reply #22 on:** November 13, 2019, 09:38:52 pm »

Good to know, thank you !
Time to find some eeprom

james_s · « **Reply #23 on:** November 14, 2019, 02:49:29 am »

Oh maybe that's why they were all enabled on mine. I reflashed the Adv Trig module that came in mine since the latest firmware enables that by default anyway. I've actually considered reflashing both modules I have with features I actually want, because TDS3ENG enables a whole bunch of completely useless crap that clutters up the menu. I don't have (or need) the hardware necessary to test SDI video and I have no use whatsoever for the ability to measure a bunch of obsolete communication protocols.

Hairystuff · « **Reply #24 on:** November 14, 2019, 09:12:09 am »

The comms protocol masks where kind of useless to me and the video stuff is nice to have especially the vector scope stuff but the video display stuff is not the best performance wise, I was hoping there would be some CAN/serial/I2C decoding ability but I'm not too fussed, I'm hoping that the ENG application module might enable the serial ports so that the scope can be hacked to full bandwidth without the comms/ethernet module on a non 3012B/C scope, I've never really needed anything above a 100MHz but it would be interesting to see what uses I could find for it at 500MHz.

blackfin76 · « **Reply #25 on:** November 14, 2019, 10:19:31 am »

If you want to debug a serial bus like I2C or SPI the extra bandwidth doesn't add anything but if you do analog design or digital interface design it may be very useful. I have a Agilent MSO7014 for serial bus debugging, but I actually prefer the TDS3000 series for analog design.

Hairystuff · « **Reply #26 on:** November 14, 2019, 02:09:31 pm »

For analog stuff I used to use a Iwatsu SS-5711 but I replaced it with a Agilent 54622D, I really like the Agilent with all of its features but I thought I'd try something newer like the Tek TDS3012, I purchased a Tek TBS1104 before the Agilent but didn't like it due to its slow update rates and no intensity controls, I do like the Tek but I still find myself using the Agilent more at the moment.

james_s · « **Reply #27 on:** November 14, 2019, 05:08:03 pm »

The TDS3000 is quite an old design at this point, I don't think CAN, I2C, and other interfaces that are widespread were really a thing back then. It was conceived in an era of parallel bus interfaces, hence the infamous DS1742W used internally.

pmercier · « **Reply #28 on:** November 14, 2019, 05:27:48 pm »

I confirm, the tds3eng did the trick !

Hairystuff · « **Reply #29 on:** November 14, 2019, 06:22:24 pm »

Quote from: james_s on November 14, 2019, 05:08:03 pm

The TDS3000 is quite an old design at this point, I don't think CAN, I2C, and other interfaces that are widespread were really a thing back then. It was conceived in an era of parallel bus interfaces, hence the infamous DS1742W used internally.

I actually dremeled the RTC after desodering it and installing a socket on board, I got to the battery in the RTC chip after grinding off the encapsulation material and installed a CR2032 holder on there so I could easily access it for replacement in the future without changing the RTC module.

Hairystuff · « **Reply #30 on:** November 14, 2019, 06:24:59 pm »

Quote from: pmercier on November 14, 2019, 05:27:48 pm

I confirm, the tds3eng did the trick !

Oh nice, where you able to access the serial port via the RS232TTL converter

james_s · « **Reply #31 on:** November 14, 2019, 06:28:59 pm »

I've done the Dallas chip hack on a number of parts in that series with success but it's still a pain. The one in my TDS3000 failed again so I made an adapter to fit the still available DS1744 in the PowerCap (replaceable battery) package. Later I found the problem with the original DS1742W was a cracked joint where one of the nickel strips that went to the original battery connects to the PCB but I had already made the adapter PCB so I just used that.

Hairystuff · « **Reply #32 on:** November 14, 2019, 06:38:52 pm »

My solution was alot less elegant but it seems to do the job. I had one of these fail on a Fluke Lanmeter 685 and it lost all the license keys, cal data and MAC address for the unit, I was worried a similar thing would happen to the scope.

james_s · « **Reply #33 on:** November 14, 2019, 07:14:21 pm »

Thankfully nothing critical is stored there in the scope. It keeps the time and date, all the settings, the error log and the power-on hours. I figured out where those are stored and the format and was able to build a little rig hand program the 5 bytes for that. The bytes from x7E0 to x7E4 (iirc) hold the number of minutes the scope has been powered on. The cal data, power cycles and reference waveforms are stored elsewhere (eeprom?)

pmercier · « **Reply #34 on:** November 14, 2019, 09:14:35 pm »

Ok, i tested the tds3eng for the serial port on my TDS3014 with a USB/TTL.

I can print over the serial port, but ... the GPIB commands seem to be unavailables :\
Sent a "*IDN?" but got nothing in return.

Just to be sure i did the same on my TDS3032C and the answer where returned.

Damn !

Okay now i can stop taking photos of the screen so it's already a small win, but it bug me

Hairystuff · « **Reply #35 on:** November 14, 2019, 10:10:21 pm »

Quote from: pmercier on November 14, 2019, 09:14:35 pm

Ok, i tested the tds3eng for the serial port on my TDS3014 with a USB/TTL.

I can print over the serial port, but ... the GPIB commands seem to be unavailables :\
Sent a "*IDN?" but got nothing in return.

Just to be sure i did the same on my TDS3032C and the answer where returned.

Damn !

Okay now i can stop taking photos of the screen so it's already a small win, but it bug me

Is the 3.39 firmware on the scope, I've heard the newer 3.41FW does not support the hack.

james_s · « **Reply #36 on:** November 15, 2019, 04:36:50 am »

That's a good point, yes you do need the earlier firmware for it to work.

Hairystuff · « **Reply #37 on:** November 15, 2019, 10:41:28 am »

It's good news that pmercier was able to communicate with the ENG app module installed in conjunction with the RS232TTL interface, hopefully it's just the firmware that's only holding it back from being unlocked, plus the price gouging and rarity of the interface modules is prohibitive in taking full advantage of the scope's capabilities.

Icchan · « **Reply #38 on:** January 26, 2020, 11:01:57 pm »

OMG! The work and interest you all have put into this... this was a real joy to see when I opened this old thread after few months (i've been forgetful on my old topics on this forum). I threw a rock at the lake and didn't think much of it... Thank you everyone for taking part in this!

One of the greatest communities around!

stas_last · « **Reply #39 on:** April 01, 2020, 03:56:16 pm »

Hello everyone. The pinout is correct. only instead of 3.3v I have 5v. but this is not critical. I’ll wait a long time for this connector, so I took the oscilloscope apart and soldered to the board). CPU2102 is working correctly. But for me, usb is not suitable for work for many reasons. therefore, to take screenshots, I connected esp32. RX TX GND and 5V. Who is interested in the program for screenshots on wifi.

Code: [Select]

#include <WiFi.h>
#include <WiFiClient.h>
#include <WiFiAP.h>
extern "C" {
#include "libb64/cencode.h"
}

const char *ssid = "Tek";
const char *password = "12345678";

WiFiServer server(80);
String inputString = "";
boolean stringComplete = false;
void setup() {
  Serial.begin(38400);
  WiFi.softAP(ssid, password);
  IPAddress myIP = WiFi.softAPIP();
  server.begin();
}

void loop() {
  serialEvent();
  WiFiClient client = server.available();
  if (client) { 
    while (client.connected()) {
      if (client.available()) {          
        client.println("HTTP/1.1 200 OK");
        client.println("Content-Type: text/html");
        client.println();
        client.println("<html>");
        client.println("  <body>");
        if (stringComplete) {        
          client.print("    <img src=\"data:image/png;base64,");
          client.print(base64_encode_utf((uint8_t*)&inputString[0], inputString.length()));
          client.println("\" alt=\"\" />");
          inputString = "";
          stringComplete = false;
        }
        client.println("    <p>Tektronix tds3000 snapshot</p>");
        client.println("  </body>");
        client.println("</html>");
        break;
      }
    }
    client.stop();   
  }
}
String base64_encode_utf(uint8_t * data, size_t length)
{
    size_t size = base64_encode_expected_len(length) + 1;
    char * buffer = (char *) malloc(size);
    if(buffer) {
        base64_encodestate _state;
        base64_init_encodestate(&_state);
        int len = base64_encode_block((const char *) &data[0], length, &buffer[0], &_state);
        len = base64_encode_blockend((buffer + len), &_state);
        String base64 = String(buffer);
        free(buffer);
        return base64;
    }
    return String("-FAIL-");
}
void serialEvent() {
  while (Serial.available()) {
    char inChar = (char)Serial.read();
    inputString += inChar;
    if (inChar == '\n') {         
      stringComplete = true;
    }
  }  
}

set the speed on the device to 38400, instead of printing to the printer, select printing to the serial port. press the print button, the data will go to esp32, and when connected from the browser the picture will fly there. generally interesting idea for the weekend)

pmercier · « **Reply #40 on:** April 02, 2020, 07:31:19 am »

Thank you for the sketch.
When I took my first screen shot with the hack putting an esp inside seemed a logic step. I haven't tried it because I was concerned about the impact of the WiFi signal on the scope, especially the measurements.
Have you tried to compare the traces before and after the hack ?

stas_last · « **Reply #41 on:** April 02, 2020, 09:51:20 am »

At first I thought about it too .. but, I installed power filters for the ESP32, - no interference is seen by eye. The idea is more serious than the screenshots. so even if something there is interference, it does not bother.

pmercier · « **Reply #42 on:** April 02, 2020, 10:00:38 am »

Good to know. Thank you.

stas_last · « **Reply #43 on:** April 03, 2020, 05:24:01 am »

I just wanted to ask you. I can not get an answer from the oscilloscope to the requests. changed both speed and integrity control. These requests come to the oscilloscope intact (looked in the terminal), but there is no answer. only worked on the old firmware? can't it be that somewhere on the original expansion card something is closed so that the oscilloscope understands that the expansion card is connected? let's say they can be used in the original dtr dsr?

pmercier · « **Reply #44 on:** April 04, 2020, 01:38:52 pm »

Yes, it seem there's something else on the card that allow the correct detection of the car type to activate the serial port.
I don't have a card so i started reverse engineering the availables photo cards and for the moment, i've no time to finish it.

I tested some ideas i came along during the reverse for the card identification, but failed so far (i know i documented all of the tests, but i can't find my notes).
I even overwritten one of my software module to allow the engineer mode, but even with that, no chance.

stas_last · « **Reply #45 on:** April 05, 2020, 05:23:49 am »

Не так страшен чёрт, как его малюют - Russian proverb

if they were sewn into 24 memory, then I think it’s not difficult. Slot machines are more difficult fact.

pmercier · « **Reply #46 on:** April 05, 2020, 11:56:44 am »

It not stored in the 24c memory. Only buyable software options keys are stored inside the memory chip.
You can put any interface card in your scope without having to alter or add an option key in the 24c memory. For info the only extension card having an inbord memory is the Ethernet one. But all of them have discrete ttl logic for the buffer chips of the expansion slot. I think that it's where the card detection logic is implementing but I can't find the missing traces on the pcb to find a logic for the detection.

james_s · « **Reply #47 on:** April 05, 2020, 06:59:38 pm »

I can xray the TDS3GV module if that would be helpful for further reverse engineering. It will have to wait until after this whole Covid thing blows over though as I don't have the machine in my house. Multilayer boards get a bit messy but with careful setting of the kVp and exposure it's often possible to image the traces.

pmercier · « **Reply #48 on:** April 08, 2020, 11:42:19 am »

Found back my notes and shcematics from traces this morning. I'll take a look tonight to see what traces was missing for the reverse, but an xray would be awesome as we would be able to see where exactly the traces are going below the connector.

Stas_last : Concerning the connector you can insert a 1.6mm PCB inside the scope connector with 50 mil spaced traces. It won't be reliable for long term reccurent dis/connection, but for home usage it can be enough if you can make them stay in place.

pmercier · « **Reply #49 on:** April 09, 2020, 09:52:28 pm »

My most advanced reverse is for a TDS3GM. But it miss many connections due to hidden traces.

@james_s i'm definitively interested in a TDS3GV xray !

stas_last · « **Reply #50 on:** April 14, 2020, 06:28:49 am »

slightly modified for esp32. Now works on web sockets. made a save button.

Quote

I attach the archive.

YuukiJapanTech · « **Reply #51 on:** May 11, 2020, 07:27:52 pm »

Hi.
I have the TDS3GM, which has no VGA output compared to the TDS3GV, but the other features are similar.

I disconnected the connector to check the pattern of the logic IC.
All patterns from the connector to the logic IC are visualized, so please refer to them.

TDS3GM was also a 4-layer board, but when it was transmitted by a very strong light, the second and third layers had only VCC and GND.

I also wrote pin assignments on the photos I analyzed for VGA, etc. Thank you for the analysis!
I think the VGA DA converter IC use ADV7120, can probably other use BU3616K.

I would like to complete a board that fully supports TDS3GV someday, so I'll do my best to analyze it...

pschirrer · « **Reply #52 on:** May 26, 2020, 03:37:11 pm »

Hello,

I have a TDS3014 and just connected the Serial cable using a USB FTDI TTL to USB adapter, like described earlier in this post.
The scope is receiving the characters I type (checked using the debug feature of the RS232 menu). The scope is sending data when performing a screen dump through RS232, but it is not responding to commands sent to the RS232 port (*IDN? command for example). I can see it received it (debug menu), there is no error reported, but no characters are sent (0 sent in the debug menu).

Anybody know what is happening ? How can I get the scope accept commands ? I would like to offload the channel data to do some post analysis.

Thanks.

pmercier · « **Reply #53 on:** May 28, 2020, 12:13:20 pm »

You will have to downgrade your firmware to 3.39. With the newest version I don't get an answer too event if the debug see the communication (except for the print screen).

pmercier · « **Reply #54 on:** May 28, 2020, 12:47:01 pm »

@YuukiJapanTech Here what i have reversed from reverse engineering the schematic from different photos (maching yours too)

Screen
2 DotClk (25Mhz)
3 HSync (31.5KHz)
4 VSync (60Hz)
6, 7, 8, 9 Red
51, 52, 54, 55 Green
56, 57, 59, 60 Blue

Ethernet (SNI)
15 Tx
16 Rx
17 TENA
18 CLSN
19 RENA
20 TCLK
22 RCLK

Adrs
37 A11
39 A10
40 A9
41 A8
42 A7
43 A6
44 A5
46 A4
47 A3
48 A2
49 A1
50 A0

Data
82 D0
83 D1
84 D2
85 D3
87 D4
88 D5
89 D6
90 D7
92 D15
93 D14
94 D13
95 D12
97 D11
98 D10
99 D9
100 D8

Ctrl
22 /INT
24 CARD_INSERTED (5K to ground for 3GM)
81 R/W

Power
12 3v3
72 5v

Grounds 1, 5, 10, 21, 32, 38, 45, 53, 58, 67, 80, 86, 91 and 96

Serial (from james_s) :
68 TxD
69 RxD
70 RTS
71 CTS

They are the ones i have written in my notebook, but i've more on the reverse schematic (don't remember the one i reversed). I'll have access to it once am back to home tonight.

Edit:

D0 to D7 was flipped, they now have the good pinout
I've 8 more pins, but as i still haven't finished the reverse, i don't know was they are exactly. They are control signals for the card, but don't know for the moment what they are doing.

pschirrer · « **Reply #55 on:** May 28, 2020, 05:22:12 pm »

Hello pmercier,

Sorry, I forgot to mention that the scope reports version 3.39...

So what should I do ?

pmercier · « **Reply #56 on:** May 28, 2020, 06:17:43 pm »

Do you have all options activated ?

pschirrer · « **Reply #57 on:** May 29, 2020, 12:03:08 pm »

Hello pmercier,
I guess so, I have updated one of the modules to "TDS3ENG" and they show all activated.

Regards

pmercier · « **Reply #58 on:** May 29, 2020, 02:24:30 pm »

Strange. Look like i have this problem with my 3K model A too with the latest firmware version. I cant downgrade for the moment as I have no more floppy drive

pmercier · « **Reply #59 on:** May 29, 2020, 02:26:04 pm »

My bad. Look like I made a mistake in one of my previous response. I had no problems getting the IDN response on my model C, but not on my model A.

buffdriver · « **Reply #60 on:** May 31, 2020, 05:05:07 am »

Hi,

This is my first post. I've bought a TDS3012 and while awaiting delivery, I'm reading up on both the bandwidth and module hacks. Since I won't have access to a communication module, I am interested in getting serial access via this solution.

Quote from: pschirrer on May 26, 2020, 03:37:11 pm

The scope is sending data when performing a screen dump through RS232, but it is not responding to commands sent to the RS232 port (*IDN? command for example). I can see it received it (debug menu), there is no error reported, but no characters are sent (0 sent in the debug menu).

Quote from: pmercier on May 29, 2020, 02:26:04 pm

I had no problems getting the IDN response on my model C, but not on my model A.

I've read through the thread several times, but I'm not sure of the current status for non-B or -C units. Has anyone had success with getting one of these earlier scopes to respond to serial commands?

Thanks,

buffdriver

pmercier · « **Reply #61 on:** June 03, 2020, 05:36:08 pm »

I have a -A and a -C. I was able to send serial command to the C version and it responded. But due to a TOO recent firmware on the A it won't answer any command at all.

av500 · « **Reply #62 on:** June 05, 2020, 11:15:10 am »

Quote from: pmercier on May 28, 2020, 12:47:01 pm

24 CARD_INSERTED (5K to ground for 3GM)

same for TDS3GV which I bought just before you posted that 5K to GND value which probably is enough to fake it :/

james_s · « **Reply #63 on:** June 05, 2020, 05:43:15 pm »

Quote from: pmercier on May 29, 2020, 02:24:30 pm

Strange. Look like i have this problem with my 3K model A too with the latest firmware version. I cant downgrade for the moment as I have no more floppy drive

Isn't it just a standard PC slim floppy drive? Looks like they can be bought for a few dollars, seems like it's worth having one around if only for the ability to update the firmware.

Galen · « **Reply #64 on:** June 06, 2020, 12:57:17 pm »

The drive is a slim type standard floppy drive. Not a specialized part for Tek.

pmercier · « **Reply #65 on:** June 06, 2020, 02:12:18 pm »

@james_c : I've a lot of floppy drives, but all of them avec missing something : real usable floppies ... So i've buyed a slim floppy emulator for my 3000A but i haven't been able to make it work. Need to test it again with a normal floppy emulator (and make a slim to HE34 adaptator ...)

@av500 : No it's not enough to make the scope accept a "virtual" extension card. I've already confirmed that

Galen · « **Reply #66 on:** June 06, 2020, 03:57:26 pm »

for the video signal, the ADV7120 has 8 bit input for each color, but based on pmercier's pin list, the scope only has 4 bit for each color? is this correct?

pmercier · « **Reply #67 on:** June 06, 2020, 04:51:44 pm »

The scope provide only 4bits per colour on the connector. Checked directly on the mother board.

Galen · « **Reply #68 on:** June 06, 2020, 09:50:41 pm »

Quote from: pmercier on June 06, 2020, 04:51:44 pm

The scope provide only 4bits per colour on the connector. Checked directly on the mother board.

Thanks pmercier, very helpful pin list.
Then, for each color, are the rest 4 bit pins of ADV7120 grounded or pulled up to 5V?

james_s · « **Reply #69 on:** June 06, 2020, 09:54:20 pm »

I've used the ADV7123 in other things before, the datasheet says to ground unused inputs. If you tie them high you'll never be able to display black.

Galen · « **Reply #70 on:** June 07, 2020, 04:49:48 am »

Quote from: james_s on June 06, 2020, 09:54:20 pm

I've used the ADV7123 in other things before, the datasheet says to ground unused inputs. If you tie them high you'll never be able to display black.

Thanks James_s. I ordered a few ADV7120 and 74LCX245. But the connector is not cheap. I may try to use a PCB with finger contacts for the test first.

Jwalling · « **Reply #71 on:** June 07, 2020, 09:23:54 am »

Quote from: Galen on June 06, 2020, 12:57:17 pm

The drive is a slim type standard floppy drive. Not a specialized part for Tek.

Not always true, earlier ones had a wider drive, but otherwise standard interface. The wider drives were also used on some of the TDS500 to TDS700 scopes as well. Because of this, there are two different rear covers to accommodate the different size drives.

madao · « **Reply #72 on:** June 07, 2020, 10:35:00 am »

wider slim floppy is not a tek special. it is using also in HP oscilloscope and some notebook (very old)
Wider slim floppy drive is excatly wide as 3.5" standard FDD.

Thanks for reserve engineering of TDS3GM /GV Module.

Greetings
matt

james_s · « **Reply #73 on:** June 07, 2020, 06:39:57 pm »

Quote from: Galen on June 07, 2020, 04:49:48 am

Thanks James_s. I ordered a few ADV7120 and 74LCX245. But the connector is not cheap. I may try to use a PCB with finger contacts for the test first.

Isn't the connector only about $10? It would be expensive if you needed a bunch of them but for just one that doesn't seem too bad to me.

Galen · « **Reply #74 on:** June 07, 2020, 07:33:55 pm »

Yes James, found another source, price only 3 bucks each. Ordered 3 pieces.

pschirrer · « **Reply #75 on:** June 12, 2020, 08:36:07 am »

Quote from: av500 on June 05, 2020, 11:15:10 am

Quote from: pmercier on May 28, 2020, 12:47:01 pm

24 CARD_INSERTED (5K to ground for 3GM)

same for TDS3GV which I bought just before you posted that 5K to GND value which probably is enough to fake it :/

Hi I soldered a resistor directly on the connector between pins 24 and GND, but no expansion card reported by the scope (TD3014 SW Rev 3.39), not sure it is enough...

Regards

pmercier · « **Reply #76 on:** June 12, 2020, 08:57:10 am »

Hi, quick answer :
yes it's not enough for the oscilloscope to detect the good card. It just allow the scope to detect a card was inserted.
I finished the reverse just recently and got the scope to detect a specific card but I didn't had the time these last days to publish any results. I'll do it this weekend.

pmercier · « **Reply #77 on:** June 20, 2020, 12:27:26 am »

I know I promised to publish and share my results last week end. I got delayed by mother nature who put a wasp nest inside my car ... they got me pretty bad. At least I wasn't driving at that time.

So now that am on foot again, I took the time to create a build log for the project I had in mind when starting the reverse. All of the informations are posted there : https://hackaday.io/project/172242-extension-card-for-tds3000-scopes/log/179520-the-actual-informations

Only the two last logs have informations not present here.

Hope it'll be useful.

No original card was inserted when taking this photo

Galen · « **Reply #78 on:** June 21, 2020, 03:28:18 am »

Thanks pemecier, very useful information.

buffdriver · « **Reply #79 on:** June 22, 2020, 11:54:00 pm »

My thanks as well! With the information presented here and on the hackaday site, I was able to mimic the presence of a serial communication module and send the necessary commands to turn my TDS3012 into a TDS3052.

I will continue to monitor the progress and would definitely consider building a board to have persistent serial, vga, and/or ethernet capability. I really appreciate all who have contributed.

sicco · « **Reply #80 on:** November 03, 2020, 11:20:46 am »

Here's where I am with my attempt to make a super TDS3GV / TDS3EM plug-in module. Nothing is tested yet - still waiting for JLCBCB.

Design objectives:

1. An alternative to the RTC Dallas DS1742W chip on the scope main board. All but one DS1742 pins are on the 100 pin expansion connector. So I'll have a DS1744W with battery/xtal cap on this board.
2. A DB9 serial port. Isolated. But if needed, with a DB9 Bluetooth adapter +5V powered via pin 9.
3. An isolated USB version for that same serial port because PCs no longer have DB9 COM ports these days...
4. Accommodate the ESP32 DevKitC so that we can do the WiFi trick as per https://www.eevblog.com/forum/testgear/reverse-engineering-tektronix-tds3gv-module-for-tds3000-series-oscilloscopes/msg3014688/#msg3014688.
5. Allow for FTDI USB-TTL 6 pin header serial port.
6. Add RJ-45 10BaseT Ethernet via a legacy MC68160.

For the DS1744W alternative RTC I still need to work out how to best mute the existing DS1742W on the main board. The latter seems to get its /CS from the PowerPC XPC860 /CS2 at pin D4. Unclear yet if my assumption is right that the RTC is mapped at address 0x000000 and the CS can thus be derived from just the A0-A19 address bus. If not then it will be an extra flying lead from /CS2 pin D4 of the PowerPC, to my board's DS1744W. Maybe route that via EXTCLK on the 100 pin connector. Stay tuned...

blackfin76 · « **Reply #81 on:** November 06, 2020, 03:49:27 pm »

Quote from: sicco on November 03, 2020, 11:20:46 am

Here's where I am with my attempt to make a super TDS3GV / TDS3EM plug-in module. Nothing is tested yet - still waiting for JLCBCB.

Goed bezig

james_s · « **Reply #82 on:** November 06, 2020, 06:31:32 pm »

Quote from: pmercier on June 20, 2020, 12:27:26 am

I know I promised to publish and share my results last week end. I got delayed by mother nature who put a wasp nest inside my car ... they got me pretty bad. At least I wasn't driving at that time.

So now that am on foot again, I took the time to create a build log for the project I had in mind when starting the reverse. All of the informations are posted there : https://hackaday.io/project/172242-extension-card-for-tds3000-scopes/log/179520-the-actual-informations

Only the two last logs have informations not present here.

Hope it'll be useful.

No original card was inserted when taking this photo

Nicely done! That's quite a clever way of identifying the type of expansion module, using parts that were cheap in the late 90s.

sicco · « **Reply #83 on:** November 13, 2020, 11:19:21 pm »

My plug-in boards arrived from JLCPCB - DHL shipping takes > 1 week these days.
It works nicely - after fixing the errors I made. No Ethernet though.

Details: see cross reference https://www.eevblog.com/forum/repair/reverse-engineer-dallas-ds1742w/msg3324732/#msg3324732

mankan · « **Reply #84 on:** November 14, 2020, 07:44:49 pm »

I also got my boards yesterday

Soldered it up today and upgraded to TDS3054 and then a FW upgrade. I've not yet programmed the ESP (Wemos mini D1). The plan is to have a simple web server that publishes screen shots.

Should I connect the /RST line to the ESP RST pin?

mankan · « **Reply #85 on:** November 14, 2020, 09:39:52 pm »

I've realized I was a bit greedy

I've now changed model to TDS3052.

sicco · « **Reply #86 on:** November 15, 2020, 10:13:40 am »

Nice board also. The /RST I think is the PowerPC reset input. The power on reset. I don’t think that the CPU or anything else on the main board drives it, so assume it’s a main board input on the 100 pin connector. If so then you could drive it from your ESP Wemo - to reset the scope. But why would you?

The web-server that i used was a direct copy of what was on this forum elsewhere, from Russia. Arduino, ESP32 DevKit-c. Stumbled initially by not having the file system for the index.html and java script, plus some other plugins, but could google and github download my way through all the compile/load error messages so that it worked eventually.
Still due: make the web server connect as client to my home WiFi, so my SSID from my network, instead of this ESP32 DevKit acting as independent WiFi router with its own SSID.

sicco · « **Reply #87 on:** November 15, 2020, 04:28:25 pm »

The ESP32DevKit-c can still do old style Bluetooth serial port profile. As can PC's. So here the Arduino project that enables that as an option to go wireless short distance.

mankan · « **Reply #88 on:** November 15, 2020, 04:45:44 pm »

@sicco Very elegant.

Where can I find the "Tek Screen Capture Utility"?

At the moment I have a webserver and a NTP client running and have been struggling with reading the PNG data from the serial port. At the moment it takes 5s including retries and delays. I'll try adjust the RxBufferSize next thanks to your screen dump.

sicco · « **Reply #89 on:** November 15, 2020, 05:10:51 pm »

http://www.mattmillman.com/tools/tdsscreencap/ is where I found it.

mankan · « **Reply #90 on:** November 15, 2020, 05:58:49 pm »

Can anyone explain why I need to pull up resistors on the TX/RX pins?
Without them the Wemos D1 mini won't start running the sketch when connected to the scope. One clue could be that my LED is lit, pin D0/GPIO16/~WAKE. I did not read up on reserved ESP8266 GPIO pins when I made the board.
Attaching my schematics and the Wemos one I think I have.

sicco · « **Reply #91 on:** January 23, 2021, 03:23:22 pm »

My most recent 'budget version' plugin boards arrived this week.

More on https://www.eevblog.com/forum/testgear/tds3000c-series-bw-sampling-hack/

Gyagel · « **Reply #92 on:** February 22, 2021, 10:44:26 pm »

Is there anybody with recent revision PCB from Russia here? I would like to buy 1 piece.
Please, PM me!

AnJu · « **Reply #93 on:** June 16, 2021, 08:17:08 pm »

Quote from: Gyagel on February 22, 2021, 10:44:26 pm

Is there anybody with recent revision PCB from Russia here? I would like to buy 1 piece.
Please, PM me!

Yes. PM sent!

JacquesBBB · « **Reply #94 on:** July 25, 2022, 02:57:01 pm »

Hi All,

I have a TDS2CM communication board. Do you think there a way to make a cable from the 100-pin connector of the TDS3032 to the 50 pin connector of the TDS2CM that will make it work and provide RS232, GPIB and centronics ports to the TDS3032 ?

coromonadalix · « **Reply #95 on:** July 26, 2022, 04:50:33 pm »

@Jacquesbbb

it is not for the same scope series

JacquesBBB · « **Reply #96 on:** July 26, 2022, 10:15:12 pm »

I know well that TDS220 is not the same series as TDS3000 but the functions of the interface are the same, so maybe part of them can be retrieved from the TDS2CM module. At least the serial interface. I wonder if the GPIB from the TDS2CM could be used for a TDS3000.

JacquesBBB · « **Reply #97 on:** July 28, 2022, 10:35:57 pm »

I got the 100 pins connector.
soldered 5 wires

67 : GND
68 :TxD
69 : RxD
70 :RTS
71 :CTS

Connected a serial to USB dongle based on a RS232 FTDI chip using 3.3V option

Use a serial terminal emulator on my mac ( Coolterm)

set the communication on the TDS3032 ( with ENG dongle) version 3.39 with all options.
Baud rate : 9600
flagging : none
EOL : CR/LF

set the comm on coolterm

Baudrate : 9600
Data bits : 8
parity : none
stop bits : 1
CTS on

I have made a test by printing through the serial port. I properly received a postcript file on the terminal.

Nevertheless, I have no answer when I send : *IDN?

What am I missing ?

Thanks for all

sicco · « **Reply #98 on:** July 29, 2022, 04:27:03 am »

Two things to check:

1. Signals are TTL logic levels, not RS232. So high (3V3) when idle, low when active.
2. Pin numbering on the 100 pins connector: the counting for pcb edge connector is different from the counting used on the original Molex part.

sicco · « **Reply #99 on:** July 29, 2022, 06:17:40 am »

And note that this serial port only gets active after plugin module detection. Each tds3xx plugin has an 8 bit ID that is sensed during bootup. Typically using a 74xx245 IC, that pushes the ID on the databus when a CE line is driven low. See posts higher up.

If after a boot the scope does not say that it has a serial module plugged in, then it will ignore the Rx,Tx pins that you used.

JacquesBBB · « **Reply #100 on:** July 29, 2022, 07:53:29 am »

Thanks a lot, Sicco

I use normally 3.3V TTL . This is the setting I put on my TTL to usb adapter (foca v2.2)https://wiki.iteadstudio.com/Foca

I have now verified that the data I type is properly received by the TDS by looking to the debug zone
If I type : *IDN?
I see in the 30 last car
*IDN?\015

so this is correct as I configured with CR (\015)

ON the opposite, No communication Module is detected, but reading the past posts from pmercier

Quote from: pmercier on October 21, 2019, 08:17:04 pm

Little update. Received the connnectors today. They're a perfect match.
I soldered dupond wires for the 3.3v serial/usb module directly on the provided pins and ... worked like a charm once i removed the hardware control flow from the scope config.

Sended : *IDN?
Got : TEKTRONIX,TDS 3032C,0,CF:91.1CT FV:v4.05 TDS3FFT:v1.00 TDS3TRG:v1.00

I understand that the 100 pins connectors + TTL to USB was sufficient.

sicco · « **Reply #101 on:** July 29, 2022, 08:45:00 am »

Some have tried pulling low the relevant databus lines through eight 1k resistors. Not the best of all ways to do it, but that will make it detect a Communications Card also.

JacquesBBB · « **Reply #102 on:** July 29, 2022, 05:45:59 pm »

Succeed !

I have carefully followed the instructions of pmercier
https://hackaday.io/project/172242-extension-card-for-tds3000-scopes/log/179520-the-actual-informations

and build the mock communication card based on a SN74HC245N (which I had in stock in PDIP form).

Communication with the TDS3032 was then immediate

*IDN?
TEKTRONIX,TDS 3032,0,CF:91.1CT FV:v3.39 TDS3GM:v1.00 TDS3ENG:v1.00 TDS3FFT:v1.00 TDS3TRG:v1.00
PASSWORD PITBULL
MCONFIG TDS3052
*IDN?
TEKTRONIX,TDS 3052,0,CF:91.1CT FV:v3.39 TDS3GM:v1.00 TDS3ENG:v1.00 TDS3FFT:v1.00 TDS3TRG:v1.00

and it seems the scope was converted to TDS3052

Thanks to all who helped by direct interaction or by putting usable information online.

JacquesBBB · « **Reply #103 on:** July 29, 2022, 10:35:33 pm »

A cleaner realisation of the mock TDS3GM,

the strange list of communication modules with both "None" and "TDS3GM"
Isnt that contradictory ?

The rise time after the upgrade using Leo Bodnar device.


EEVblog Main Site	EEVblog on Youtube	EEVblog on Twitter	EEVblog on Facebook	EEVblog on Odysee