Author Topic: Tektronix THM56x Portable Scope Hack/Teardown/Discussion  (Read 2037 times)

0 Members and 1 Guest are viewing this topic.

Offline hardcoreman

  • Contributor
  • Posts: 22
  • Country: sk
Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« on: January 01, 2018, 01:01:15 am »
hello:)

i have thm560 multimeter/scope... and i want hack it to 565.

when you pull out bat. then you see pin header P300.

here is pinout which i found
1   + batt
2   power on (h pulse)
3   gnd
4   RTS
5   CTS
6   TXD
7   RXD
8   /display off signal
9   txs
10   rxs (via mux u312)
11   cks
12   ?
13   +5V
14   gnd
15   /int2 cpu ?
16   flash VPP 12V

serial lines are directly connected to cpu (there is no MAX232!!!) i connect bt4.0 module here.

now i looking for photo of boards from thm565 and flash chip dump

560 have 256k ram and 565 i think have 1Mbit ram + rtc chip

when i make dump and photos i post it here.
« Last Edit: October 09, 2018, 05:24:34 pm by hardcoreman »
 

Offline hardcoreman

  • Contributor
  • Posts: 22
  • Country: sk
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #1 on: January 01, 2018, 01:56:07 am »
FLASH DUMP ftom 560

there is 565menu inside like SET TIME BACKLIGHT etc.
 

Offline hardcoreman

  • Contributor
  • Posts: 22
  • Country: sk
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #2 on: January 08, 2018, 08:01:04 am »
internal photos from thm560
 

Offline jal1234

  • Contributor
  • Posts: 15
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #3 on: January 27, 2018, 02:33:11 pm »
internal photos from thm560
I have a working 565 and a dead 572 (aka Mac ET2020). The 572 appears to be identical to the 565, except for the firmware which is for automotive applications. What pictures do you want? I have no ability to dump firmware.

Max 232 is in the external serial adapter/power supply module. My 565 has one. It replaces the battery pack, and engages the pin header normally covered by the battery pack.

Have you found any schematics? The 572 power supply is dead, and a schematic would be helpful.

Sent from my Nexus 5 using Tapatalk

 

Offline hardcoreman

  • Contributor
  • Posts: 22
  • Country: sk
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #4 on: January 31, 2018, 03:33:30 am »
i dont know what rtc chip is inside 565... 560 dont have it. so photos will help a lot.

do you have any pc software for it?

please find someone who can read flash... then i can make 2in1 instrument... 565 and 572 in one :)
 

Offline jal1234

  • Contributor
  • Posts: 15
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #5 on: January 31, 2018, 10:47:13 am »
I'll see what pictures and info I can get you tomorrow.

What did you use to download the firmware?

Sent from my Nexus 5 using Tapatalk

 

Offline hardcoreman

  • Contributor
  • Posts: 22
  • Country: sk
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #6 on: January 31, 2018, 05:38:00 pm »
i removed flash, use eprom programmer and plcc32 to dil32 adapter... and soldered socket to scope for easy hacking
 

Offline jal1234

  • Contributor
  • Posts: 15
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #7 on: February 02, 2018, 07:02:15 am »
i removed flash, use eprom programmer and plcc32 to dil32 adapter... and soldered socket to scope for easy hacking
I took a bunch of pictures of my THM571. I noticed that you are also missing Y302 and several components around it. Are you also missing J701?

Which chip houses the flash you read out? U304? I noticed it was missing in your pictures. Did you already remove it in your photos?

There is some old Tektronix DOS only software online for the serial connection. Search for THS720 software. It only handles data snapshots or screen grabs, no live data AFAIK. There is some other more modern 3rd party software for screen grabs. Check the THS 7xx threads on this site for it. But you'll need the serial/power adapter or some alternative to use it.

On the THS7xx series, Tektronix deleted/add some resistors to differentiate between models. The firmware was common, just activated by the presence or absence of the resistors. Only on the top of the line THS730 do the schematics show other hardware differences. I don't know if the THM5xx series is similar. I know the 565 had the backlite and more memory. I suspect that the 57x series we're different firmware. The 572 was the ET2020 for Mac Tools. There was also a 575 and maybe another one for automotive use.

Where do you live? US?

Sent from my Nexus 5 using Tapatalk

 

Offline jal1234

  • Contributor
  • Posts: 15
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #8 on: February 02, 2018, 08:21:51 am »
Docuwave 1.2 software is here:

http://www.hakanh.com/dl/index.htm

Sent from my Nexus 5 using Tapatalk

 
The following users thanked this post: JWag, hardcoreman

Offline hardcoreman

  • Contributor
  • Posts: 22
  • Country: sk
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #9 on: February 03, 2018, 09:41:52 am »
u304 is flash with FW. on my photo flash is removed.

from photos: difference 560 and 565 is bigger sram, rtc for clock, backlight display and firmware...
 

Offline JWag

  • Contributor
  • Posts: 18
  • Country: us
  • ICT ATE Engineer
    • My blog.
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #10 on: September 18, 2018, 06:03:05 am »
I have recently acquired a THM565. I've been comparing it to other equipment I have and it's not producing the same measurements, except perhaps for DC voltage.

The AC RMS problems look like they were caused by leaky electrolytic caps. There was a little corrosion and electrolyte leakage around the two SMT electrolytics on the left of the attached image. They're part of the AD736 True RMS-to-DC Converter (SO-8 package U906), so that makes sense. However, even after replacement, AC RMS measurements are quite different from a couple of DMMs at most ranges.



DC measurements seem OK. I measured the output of the MC1403 voltage reference (U904), and it's bang on at 2.5V. Presumably this is the voltage reference for the MAX134?

The 'scope frequency measurements are also off. It generally reads high by 4% or so. Near as I can tell, the 25MHz oscillator on the digital board also functions as the 'scope timebase, so maybe that has drifted?

The other potential issue is that the +5 and -5 rails are measuring a little low (4.85, -4.85). Still looking into whether this can cause the problems I'm seeing.

Hints/comments welcome!
« Last Edit: September 18, 2018, 06:04:57 am by JWag »
 

Offline hardcoreman

  • Contributor
  • Posts: 22
  • Country: sk
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #11 on: October 03, 2018, 02:43:08 pm »
hello, maybe calibration can help. i think calbration data are at end of flash.

can you make dump?

btw you can try my flash for test
 

Offline JWag

  • Contributor
  • Posts: 18
  • Country: us
  • ICT ATE Engineer
    • My blog.
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #12 on: October 04, 2018, 12:34:41 am »
I think I can get the flash IC off the board (and I think I have a socket to re-mount it), but I don't have a way of dumping its contents.
 

Offline hardcoreman

  • Contributor
  • Posts: 22
  • Country: sk
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #13 on: October 05, 2018, 04:28:11 pm »
hi, buy this one http://autoelectric.cn/EN/TL866_main.html works well
 
The following users thanked this post: JWag

Offline JWag

  • Contributor
  • Posts: 18
  • Country: us
  • ICT ATE Engineer
    • My blog.
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #14 on: October 07, 2018, 08:06:15 am »
I'm glad you said that, because I went looking for a cheap one and nearly went insane reading about the various versions of this thing.  |O  So far it's worked well.

I've attached my flash dump, and a photo of the version sticker. Interestingly, mine's an Intel 28F010. The build date written on mine is March 14, 1994, so it looks like my firmware might be a bit newer.



 
The following users thanked this post: edavid

Offline hardcoreman

  • Contributor
  • Posts: 22
  • Country: sk
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #15 on: October 09, 2018, 05:46:35 am »
in my unit there is sw1.0 and you have 2.0 :) i try update my unit
 

Offline JWag

  • Contributor
  • Posts: 18
  • Country: us
  • ICT ATE Engineer
    • My blog.
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #16 on: October 09, 2018, 06:04:13 am »
Enjoy your upgrade. :)

The only other PLCC-32 Flash devices I have are some AMD 29F040. I flashed my dumped firmware to one, and the meter seemed to work fine, so I think that dump is OK.

I spent a little time with ZEMU and dZ80 disassembling the firmware. Both versions seem to skip over almost everything and start executing code at 0x00800. The data between 0x00000 and 0x00800 doesn't look like code, so maybe the calibration data lives there?

I inquired about having my THM565 calibrated. Maybe I could compare the firmware before and after, and find out for sure where the calibration data is stored. Unfortunately, calibration by Tek costs US$200+.
« Last Edit: October 09, 2018, 07:19:45 am by JWag »
 

Offline hardcoreman

  • Contributor
  • Posts: 22
  • Country: sk
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #17 on: October 09, 2018, 06:53:45 am »
z80 uses banks :( so dissasemby is complicated...

mmu cbr=78, bbr=00 and cbar=83

common area is 0000-2fff and banks are mapped  from 3000 to 7fff
8000-ffff is common area 2

++++++++

i test your dump:

diode test is off
dc voltage look ok 5v,12v and 3v3
ac rms is off

scope
offset cca -1.37v
p-p reading 230v ac = 800v
1Mhz square - freq meauserement 1Mhz ok

we must find way how to calibrate this unit
« Last Edit: October 09, 2018, 06:36:07 pm by hardcoreman »
 

Offline hardcoreman

  • Contributor
  • Posts: 22
  • Country: sk
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #18 on: October 09, 2018, 06:57:08 am »
enable calibration is definetly made by connector in bat. comp.

serial commands ? ? ? burn config and burn cal found in flash

there is pin to feed vpp to flash, serial data and some other pins not identified yet.
« Last Edit: October 09, 2018, 06:38:07 pm by hardcoreman »
 

Offline JWag

  • Contributor
  • Posts: 18
  • Country: us
  • ICT ATE Engineer
    • My blog.
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #19 on: October 09, 2018, 07:18:37 am »
That reminds me; I have a few pins you don't have in your table, though they need to be double checked:

  • Battery +
  • ? RP601.12
  • Battery - (GND)
  • RTS0_bar (Z80.45)
  • CTS0_bar (Z80.46)
  • TXA0 (Z80.48)
  • RXA0 (Z80.49)
  • ?
  • SPI MOSI (U310.5, Z80.55)
  • ?
  • SPI SCK (U310.4, Z80.57)
  • ?
  • VCC (switched)
  • Battery - (GND)
  • ?
  • ?
 

Offline hardcoreman

  • Contributor
  • Posts: 22
  • Country: sk
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #20 on: October 09, 2018, 07:55:00 am »
i make pinout update ...

9-11 spi
4-7 rs232
 
The following users thanked this post: JWag

Offline hardcoreman

  • Contributor
  • Posts: 22
  • Country: sk
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #21 on: October 09, 2018, 06:32:27 pm »
config and cal. data extracted from flash

0x0-0x2f config - instrument type

0x30-0x9e cal 1
0x478-53a cal 2

i think one cal block is for dmm and one is for scope...

btw i have bad caps in rms converter too :D shit :)


power supply

input batt voltage
output +5v -5v -18V smps and one small 5v ldo
backup for sram and rtc 5v

 

Offline JWag

  • Contributor
  • Posts: 18
  • Country: us
  • ICT ATE Engineer
    • My blog.
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #22 on: October 10, 2018, 01:04:37 am »
Nice work!

The first time I worked on one of these meters, it had a bad power supply I couldn't fix. When I got this one a couple of months ago, I took some measurements in case I killed one of the regulators (all with respect to battery negative):
C610 positive side: 9V (battery?)
C611 positive side: 8.2
C602 positive side: 4.8
C616 positive side: 4.9
C600 positive side: 4.8
C603 neg side: -4.8
C618 neg side: -4.8
C601 neg side: -13
U606.1 4.9V
C606 pos side: 4.8


Those LTC1174 devices are crazy expensive, especially for 20+ year old tech.
 

Offline jal1234

  • Contributor
  • Posts: 15
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #23 on: October 10, 2018, 01:25:13 am »
I've got a 565, and a Mac Tools ET2020 which is a 565 with different firmware for automotive use. The ET2020 has a bad power supply. For whatever reason, sitting around with dead batteries kills the supplies. I'd bought one off eBay, and it worked before I got it (confirmed it was the same unit). When I got it, you could hear a faint click, but no display. Both seller and I were baffled. There is a 565 that's been listed on eBay for sometime as new, but clicks, with no display.
Does anyone have schematics of the PS, or understand what fails? We seem to be able to get schematics of every other Tekyronix scope, just not these.  Barring that, would anyone in the states be willing to pull the glass from the ET2020 and transplant it to my working 565? I really want the automotive features of the 2020. Obviously , you could copy the firmware for others to use.
 

Offline jal1234

  • Contributor
  • Posts: 15
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #24 on: October 10, 2018, 01:43:48 am »
Damn spell correct. Meant "pull the flash", not glass...
 

Offline JWag

  • Contributor
  • Posts: 18
  • Country: us
  • ICT ATE Engineer
    • My blog.
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #25 on: October 10, 2018, 02:05:55 am »
I've been watching that dodgy eBay 565 for a while, hoping the seller does a Best Offer or something.

Does anyone have schematics of the PS, or understand what fails? We seem to be able to get schematics of every other Tekyronix scope, just not these.  Barring that, would anyone in the states be willing to pull the glass from the ET2020 and transplant it to my working 565? I really want the automotive features of the 2020. Obviously , you could copy the firmware for others to use.

There aren't any PS schematics I'm aware of, but it's not tremendously complex, especially if you have a working one to compare against. It is mostly two LTC1174s generating the positive and negative rail voltages for the whole device, plus a small LDO generating 5V for the Real Time Clock and SRAM.

I'd be up for doing a transplant (or maybe repair). The SMT on this is pretty easy to work with, and I didn't have any trouble removing the flash IC from mine. Plus, I have replacement caps for your RMS converter circuit, which (if hardcoreman and I are any indication) are probably leaking electrolyte. :) I'd love to have another 565 firmware to compare against.

« Last Edit: October 10, 2018, 02:08:39 am by JWag »
 

Offline jal1234

  • Contributor
  • Posts: 15
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #26 on: October 10, 2018, 05:23:55 am »
I've been watching that dodgy eBay 565 for a while, hoping the seller does a Best Offer or something.

Does anyone have schematics of the PS, or understand what fails? We seem to be able to get schematics of every other Tekyronix scope, just not these.  Barring that, would anyone in the states be willing to pull the glass from the ET2020 and transplant it to my working 565? I really want the automotive features of the 2020. Obviously , you could copy the firmware for others to use.

There aren't any PS schematics I'm aware of, but it's not tremendously complex, especially if you have a working one to compare against. It is mostly two LTC1174s generating the positive and negative rail voltages for the whole device, plus a small LDO generating 5V for the Real Time Clock and SRAM.

I'd be up for doing a transplant (or maybe repair). The SMT on this is pretty easy to work with, and I didn't have any trouble removing the flash IC from mine. Plus, I have replacement caps for your RMS converter circuit, which (if hardcoreman and I are any indication) are probably leaking electrolyte. :) I'd love to have another 565 firmware to compare against.
I'll send you a PM.

Thanks!

Jon
 

Offline hardcoreman

  • Contributor
  • Posts: 22
  • Country: sk
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #27 on: October 10, 2018, 06:33:28 am »
565 flash is normaly working in 560 :)  big sram and rtc installed

and in my 560 v1.0, i unlocked 565 features. just made copy of config area from 565 image to 560...
 
The following users thanked this post: JWag

Offline JWag

  • Contributor
  • Posts: 18
  • Country: us
  • ICT ATE Engineer
    • My blog.
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #28 on: October 21, 2018, 04:42:21 am »
jal1234's meters have arrived. Here's the first dump, from the MAC ET-2020 (also known as the THM571). Note that this one is 256kB.

I have some ideas about its power supply failure. I think I'll make a repair thread about it.
 

Offline JWag

  • Contributor
  • Posts: 18
  • Country: us
  • ICT ATE Engineer
    • My blog.
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #29 on: October 21, 2018, 05:56:00 am »
jal1234's THM565 firmware is attached.

Despite having the same text on the sticker as my unit, they are significantly different. The firmware I posted earlier from my 565 has "VERSION 2.00" inside. The firmware attached here from jal1234's 565 is "VERSION 1.03". Obviously they were both updated at some point in their history?
 

Offline jal1234

  • Contributor
  • Posts: 15
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #30 on: October 21, 2018, 05:57:09 am »
Interesting that the 2020 flash is larger than the 565. Probably all of the pre-set guided tests and templates for automotive use vs. general use. At least that's my theory!
 

Offline jal1234

  • Contributor
  • Posts: 15
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #31 on: October 21, 2018, 06:00:29 am »
jal1234's THM565 firmware is attached.

Despite having the same text on the sticker as my unit, they are significantly different. The firmware I posted earlier from my 565 has "VERSION 2.00" inside. The firmware attached here from jal1234's 565 is "VERSION 1.03". Obviously they were both updated at some point in their history?
What's the build date on your hardware vs. mine? I think it's on the sticker on the back of the units.
 

Offline JWag

  • Contributor
  • Posts: 18
  • Country: us
  • ICT ATE Engineer
    • My blog.
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #32 on: October 21, 2018, 08:28:59 am »
What's the build date on your hardware vs. mine? I think it's on the sticker on the back of the units.

My 565 is dated April 1995, yours is April 1994. Your ET-2020 is dated May 1994.
 

Offline jal1234

  • Contributor
  • Posts: 15
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #33 on: October 21, 2018, 08:50:16 am »
What's the build date on your hardware vs. mine? I think it's on the sticker on the back of the units.

My 565 is dated April 1995, yours is April 1994. Your ET-2020 is dated May 1994.
Thanks. Is there someway to upgrade my firmware to your newer version, but keep my calibration info? Tektronix is lousy at letting people know what is included in newer versions of firmware, but I assume it's bug fixes. Interesting that the flash labels stayed the same. They must have updated them as they went out the door.
 

Offline hardcoreman

  • Contributor
  • Posts: 22
  • Country: sk
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #34 on: October 22, 2018, 12:31:38 am »
newest fw in this topic is v2.0

in v2.0 calibration is 0x19A00

in v1.x calibratioin is 0x1F000

simple copy is working.


in 571 , hm i think there is way to switch it to 565 (560,550) mode...


 

Offline hardcoreman

  • Contributor
  • Posts: 22
  • Country: sk
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #35 on: October 23, 2018, 04:54:50 pm »
https://www.tek.com/oscilloscope/thm5u02

firmware update module, to version 2.0

so it looks 2.0 is last version
 

Offline jal1234

  • Contributor
  • Posts: 15
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #36 on: October 24, 2018, 01:09:14 am »


https://www.tek.com/oscilloscope/thm5u02

firmware update module, to version 2.0

so it looks 2.0 is last version

I wonder what the significance of thm5u02 is? How did you find this under that designation? Never heard of it before.
 

Offline hardcoreman

  • Contributor
  • Posts: 22
  • Country: sk
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #37 on: October 24, 2018, 04:21:18 pm »
i found it when i looking for info about calibration. i think it was a module which plug in expansion connector and then make flash update... flash update is only possible with ext. vpp source applied.
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf