Author Topic: Tektronix THM56x Portable Scope Hack/Teardown/Discussion (Read 9030 times)

hardcoreman · « **on:** December 31, 2017, 02:01:15 pm »

hello:)

i have thm560 multimeter/scope... and i want hack it to 565.

when you pull out bat. then you see pin header P300.

here is pinout which i found
1   + batt
2   power on (h pulse)
3   gnd
4   RTS
5   CTS
6   TXD
7   RXD
8   /display off signal
9   txs
10   rxs (via mux u312)
11   cks
12   ?
13   +5V
14   gnd
15   /int2 cpu ?
16   flash VPP 12V

serial lines are directly connected to cpu (there is no MAX232!!!) i connect bt4.0 module here.

now i looking for photo of boards from thm565 and flash chip dump

560 have 256k ram and 565 i think have 1Mbit ram + rtc chip

when i make dump and photos i post it here.

hardcoreman · « **Reply #1 on:** December 31, 2017, 02:56:07 pm »

FLASH DUMP ftom 560

there is 565menu inside like SET TIME BACKLIGHT etc.

hardcoreman · « **Reply #2 on:** January 07, 2018, 09:01:04 pm »

internal photos from thm560

jal1234 · « **Reply #3 on:** January 27, 2018, 03:33:11 am »

Quote from: hardcoreman on January 07, 2018, 09:01:04 pm

internal photos from thm560

I have a working 565 and a dead 572 (aka Mac ET2020). The 572 appears to be identical to the 565, except for the firmware which is for automotive applications. What pictures do you want? I have no ability to dump firmware.

Max 232 is in the external serial adapter/power supply module. My 565 has one. It replaces the battery pack, and engages the pin header normally covered by the battery pack.

Have you found any schematics? The 572 power supply is dead, and a schematic would be helpful.

Sent from my Nexus 5 using Tapatalk

hardcoreman · « **Reply #4 on:** January 30, 2018, 04:33:30 pm »

i dont know what rtc chip is inside 565... 560 dont have it. so photos will help a lot.

do you have any pc software for it?

please find someone who can read flash... then i can make 2in1 instrument... 565 and 572 in one

jal1234 · « **Reply #5 on:** January 30, 2018, 11:47:13 pm »

I'll see what pictures and info I can get you tomorrow.

What did you use to download the firmware?

Sent from my Nexus 5 using Tapatalk

hardcoreman · « **Reply #6 on:** January 31, 2018, 06:38:00 am »

i removed flash, use eprom programmer and plcc32 to dil32 adapter... and soldered socket to scope for easy hacking

jal1234 · « **Reply #7 on:** February 01, 2018, 08:02:15 pm »

Quote from: hardcoreman on January 31, 2018, 06:38:00 am

i removed flash, use eprom programmer and plcc32 to dil32 adapter... and soldered socket to scope for easy hacking

I took a bunch of pictures of my THM571. I noticed that you are also missing Y302 and several components around it. Are you also missing J701?

Which chip houses the flash you read out? U304? I noticed it was missing in your pictures. Did you already remove it in your photos?

There is some old Tektronix DOS only software online for the serial connection. Search for THS720 software. It only handles data snapshots or screen grabs, no live data AFAIK. There is some other more modern 3rd party software for screen grabs. Check the THS 7xx threads on this site for it. But you'll need the serial/power adapter or some alternative to use it.

On the THS7xx series, Tektronix deleted/add some resistors to differentiate between models. The firmware was common, just activated by the presence or absence of the resistors. Only on the top of the line THS730 do the schematics show other hardware differences. I don't know if the THM5xx series is similar. I know the 565 had the backlite and more memory. I suspect that the 57x series we're different firmware. The 572 was the ET2020 for Mac Tools. There was also a 575 and maybe another one for automotive use.

Where do you live? US?

Sent from my Nexus 5 using Tapatalk

jal1234 · « **Reply #8 on:** February 01, 2018, 09:21:51 pm »

Docuwave 1.2 software is here:

http://www.hakanh.com/dl/index.htm

Sent from my Nexus 5 using Tapatalk

hardcoreman · « **Reply #9 on:** February 02, 2018, 10:41:52 pm »

u304 is flash with FW. on my photo flash is removed.

from photos: difference 560 and 565 is bigger sram, rtc for clock, backlight display and firmware...

JWag · « **Reply #10 on:** September 17, 2018, 08:03:05 pm »

I have recently acquired a THM565. I've been comparing it to other equipment I have and it's not producing the same measurements, except perhaps for DC voltage.

The AC RMS problems look like they were caused by leaky electrolytic caps. There was a little corrosion and electrolyte leakage around the two SMT electrolytics on the left of the attached image. They're part of the AD736 True RMS-to-DC Converter (SO-8 package U906), so that makes sense. However, even after replacement, AC RMS measurements are quite different from a couple of DMMs at most ranges.

DC measurements seem OK. I measured the output of the MC1403 voltage reference (U904), and it's bang on at 2.5V. Presumably this is the voltage reference for the MAX134?

The 'scope frequency measurements are also off. It generally reads high by 4% or so. Near as I can tell, the 25MHz oscillator on the digital board also functions as the 'scope timebase, so maybe that has drifted?

The other potential issue is that the +5 and -5 rails are measuring a little low (4.85, -4.85). Still looking into whether this can cause the problems I'm seeing.

Hints/comments welcome!

hardcoreman · « **Reply #11 on:** October 03, 2018, 04:43:08 am »

hello, maybe calibration can help. i think calbration data are at end of flash.

can you make dump?

btw you can try my flash for test

JWag · « **Reply #12 on:** October 03, 2018, 02:34:41 pm »

I think I can get the flash IC off the board (and I think I have a socket to re-mount it), but I don't have a way of dumping its contents.

hardcoreman · « **Reply #13 on:** October 05, 2018, 06:28:11 am »

hi, buy this one http://autoelectric.cn/EN/TL866_main.html works well

JWag · « **Reply #14 on:** October 06, 2018, 09:06:15 pm »

I'm glad you said that, because I went looking for a cheap one and nearly went insane reading about the various versions of this thing.

So far it's worked well.

I've attached my flash dump, and a photo of the version sticker. Interestingly, mine's an Intel 28F010. The build date written on mine is March 14, 1994, so it looks like my firmware might be a bit newer.

hardcoreman · « **Reply #15 on:** October 08, 2018, 06:46:35 pm »

in my unit there is sw1.0 and you have 2.0

i try update my unit

JWag · « **Reply #16 on:** October 08, 2018, 07:04:13 pm »

Enjoy your upgrade.

The only other PLCC-32 Flash devices I have are some AMD 29F040. I flashed my dumped firmware to one, and the meter seemed to work fine, so I think that dump is OK.

I spent a little time with ZEMU and dZ80 disassembling the firmware. Both versions seem to skip over almost everything and start executing code at 0x00800. The data between 0x00000 and 0x00800 doesn't look like code, so maybe the calibration data lives there?

I inquired about having my THM565 calibrated. Maybe I could compare the firmware before and after, and find out for sure where the calibration data is stored. Unfortunately, calibration by Tek costs US$200+.

hardcoreman · « **Reply #17 on:** October 08, 2018, 07:53:45 pm »

z80 uses banks

so dissasemby is complicated...

mmu cbr=78, bbr=00 and cbar=83

common area is 0000-2fff and banks are mapped from 3000 to 7fff
8000-ffff is common area 2

++++++++

i test your dump:

diode test is off
dc voltage look ok 5v,12v and 3v3
ac rms is off

scope
offset cca -1.37v
p-p reading 230v ac = 800v
1Mhz square - freq meauserement 1Mhz ok

we must find way how to calibrate this unit

hardcoreman · « **Reply #18 on:** October 08, 2018, 07:57:08 pm »

enable calibration is definetly made by connector in bat. comp.

serial commands ? ? ? burn config and burn cal found in flash

there is pin to feed vpp to flash, serial data and some other pins not identified yet.

JWag · « **Reply #19 on:** October 08, 2018, 08:18:37 pm »

That reminds me; I have a few pins you don't have in your table, though they need to be double checked:

Battery +
? RP601.12
Battery - (GND)
RTS0_bar (Z80.45)
CTS0_bar (Z80.46)
TXA0 (Z80.48)
RXA0 (Z80.49)
?
SPI MOSI (U310.5, Z80.55)
?
SPI SCK (U310.4, Z80.57)
?
VCC (switched)
Battery - (GND)
?
?

hardcoreman · « **Reply #20 on:** October 08, 2018, 08:55:00 pm »

i make pinout update ...

9-11 spi
4-7 rs232

hardcoreman · « **Reply #21 on:** October 09, 2018, 07:32:27 am »

config and cal. data extracted from flash

0x0-0x2f config - instrument type

0x30-0x9e cal 1
0x478-53a cal 2

i think one cal block is for dmm and one is for scope...

btw i have bad caps in rms converter too

shit

power supply

input batt voltage
output +5v -5v -18V smps and one small 5v ldo
backup for sram and rtc 5v

JWag · « **Reply #22 on:** October 09, 2018, 02:04:37 pm »

Nice work!

The first time I worked on one of these meters, it had a bad power supply I couldn't fix. When I got this one a couple of months ago, I took some measurements in case I killed one of the regulators (all with respect to battery negative):
C610 positive side: 9V (battery?)
C611 positive side: 8.2
C602 positive side: 4.8
C616 positive side: 4.9
C600 positive side: 4.8
C603 neg side: -4.8
C618 neg side: -4.8
C601 neg side: -13
U606.1 4.9V
C606 pos side: 4.8

Those LTC1174 devices are crazy expensive, especially for 20+ year old tech.

jal1234 · « **Reply #23 on:** October 09, 2018, 02:25:13 pm »

I've got a 565, and a Mac Tools ET2020 which is a 565 with different firmware for automotive use. The ET2020 has a bad power supply. For whatever reason, sitting around with dead batteries kills the supplies. I'd bought one off eBay, and it worked before I got it (confirmed it was the same unit). When I got it, you could hear a faint click, but no display. Both seller and I were baffled. There is a 565 that's been listed on eBay for sometime as new, but clicks, with no display.
Does anyone have schematics of the PS, or understand what fails? We seem to be able to get schematics of every other Tekyronix scope, just not these. Barring that, would anyone in the states be willing to pull the glass from the ET2020 and transplant it to my working 565? I really want the automotive features of the 2020. Obviously , you could copy the firmware for others to use.

jal1234 · « **Reply #24 on:** October 09, 2018, 02:43:48 pm »

Damn spell correct. Meant "pull the flash", not glass...

JWag · « **Reply #25 on:** October 09, 2018, 03:05:55 pm »

I've been watching that dodgy eBay 565 for a while, hoping the seller does a Best Offer or something.

Quote from: jal1234 on October 09, 2018, 02:25:13 pm

Does anyone have schematics of the PS, or understand what fails? We seem to be able to get schematics of every other Tekyronix scope, just not these. Barring that, would anyone in the states be willing to pull the glass from the ET2020 and transplant it to my working 565? I really want the automotive features of the 2020. Obviously , you could copy the firmware for others to use.

There aren't any PS schematics I'm aware of, but it's not tremendously complex, especially if you have a working one to compare against. It is mostly two LTC1174s generating the positive and negative rail voltages for the whole device, plus a small LDO generating 5V for the Real Time Clock and SRAM.

I'd be up for doing a transplant (or maybe repair). The SMT on this is pretty easy to work with, and I didn't have any trouble removing the flash IC from mine. Plus, I have replacement caps for your RMS converter circuit, which (if hardcoreman and I are any indication) are probably leaking electrolyte.

I'd love to have another 565 firmware to compare against.

jal1234 · « **Reply #26 on:** October 09, 2018, 06:23:55 pm »

Quote from: JWag on October 09, 2018, 03:05:55 pm

I've been watching that dodgy eBay 565 for a while, hoping the seller does a Best Offer or something.

Quote from: jal1234 on October 09, 2018, 02:25:13 pm
Does anyone have schematics of the PS, or understand what fails? We seem to be able to get schematics of every other Tekyronix scope, just not these. Barring that, would anyone in the states be willing to pull the glass from the ET2020 and transplant it to my working 565? I really want the automotive features of the 2020. Obviously , you could copy the firmware for others to use.

There aren't any PS schematics I'm aware of, but it's not tremendously complex, especially if you have a working one to compare against. It is mostly two LTC1174s generating the positive and negative rail voltages for the whole device, plus a small LDO generating 5V for the Real Time Clock and SRAM.

I'd be up for doing a transplant (or maybe repair). The SMT on this is pretty easy to work with, and I didn't have any trouble removing the flash IC from mine. Plus, I have replacement caps for your RMS converter circuit, which (if hardcoreman and I are any indication) are probably leaking electrolyte. I'd love to have another 565 firmware to compare against.

I'll send you a PM.

Thanks!

Jon

hardcoreman · « **Reply #27 on:** October 09, 2018, 07:33:28 pm »

565 flash is normaly working in 560

big sram and rtc installed

and in my 560 v1.0, i unlocked 565 features. just made copy of config area from 565 image to 560...

JWag · « **Reply #28 on:** October 20, 2018, 05:42:21 pm »

jal1234's meters have arrived. Here's the first dump, from the MAC ET-2020 (also known as the THM571). Note that this one is 256kB.

I have some ideas about its power supply failure. I think I'll make a repair thread about it.

JWag · « **Reply #29 on:** October 20, 2018, 06:56:00 pm »

jal1234's THM565 firmware is attached.

Despite having the same text on the sticker as my unit, they are significantly different. The firmware I posted earlier from my 565 has "VERSION 2.00" inside. The firmware attached here from jal1234's 565 is "VERSION 1.03". Obviously they were both updated at some point in their history?

jal1234 · « **Reply #30 on:** October 20, 2018, 06:57:09 pm »

Interesting that the 2020 flash is larger than the 565. Probably all of the pre-set guided tests and templates for automotive use vs. general use. At least that's my theory!

jal1234 · « **Reply #31 on:** October 20, 2018, 07:00:29 pm »

Quote from: JWag on October 20, 2018, 06:56:00 pm

jal1234's THM565 firmware is attached.

Despite having the same text on the sticker as my unit, they are significantly different. The firmware I posted earlier from my 565 has "VERSION 2.00" inside. The firmware attached here from jal1234's 565 is "VERSION 1.03". Obviously they were both updated at some point in their history?

What's the build date on your hardware vs. mine? I think it's on the sticker on the back of the units.

JWag · « **Reply #32 on:** October 20, 2018, 09:28:59 pm »

Quote from: jal1234 on October 20, 2018, 07:00:29 pm

What's the build date on your hardware vs. mine? I think it's on the sticker on the back of the units.

My 565 is dated April 1995, yours is April 1994. Your ET-2020 is dated May 1994.

jal1234 · « **Reply #33 on:** October 20, 2018, 09:50:16 pm »

Quote from: JWag on October 20, 2018, 09:28:59 pm

Quote from: jal1234 on October 20, 2018, 07:00:29 pm
What's the build date on your hardware vs. mine? I think it's on the sticker on the back of the units.

My 565 is dated April 1995, yours is April 1994. Your ET-2020 is dated May 1994.

Thanks. Is there someway to upgrade my firmware to your newer version, but keep my calibration info? Tektronix is lousy at letting people know what is included in newer versions of firmware, but I assume it's bug fixes. Interesting that the flash labels stayed the same. They must have updated them as they went out the door.

hardcoreman · « **Reply #34 on:** October 21, 2018, 01:31:38 pm »

newest fw in this topic is v2.0

in v2.0 calibration is 0x19A00

in v1.x calibratioin is 0x1F000

simple copy is working.

in 571 , hm i think there is way to switch it to 565 (560,550) mode...

hardcoreman · « **Reply #35 on:** October 23, 2018, 05:54:50 am »

https://www.tek.com/oscilloscope/thm5u02

firmware update module, to version 2.0

so it looks 2.0 is last version

jal1234 · « **Reply #36 on:** October 23, 2018, 02:09:14 pm »

Quote from: hardcoreman on October 23, 2018, 05:54:50 am

https://www.tek.com/oscilloscope/thm5u02

firmware update module, to version 2.0

so it looks 2.0 is last version

I wonder what the significance of thm5u02 is? How did you find this under that designation? Never heard of it before.

hardcoreman · « **Reply #37 on:** October 24, 2018, 05:21:18 am »

i found it when i looking for info about calibration. i think it was a module which plug in expansion connector and then make flash update... flash update is only possible with ext. vpp source applied.

JWag · « **Reply #38 on:** February 16, 2019, 08:44:50 pm »

Thanks to jal1234, I have a second ET-2020 to tinker with. This time, it has version 1.03 firmware on an AMD AM28F020 flash.

The bare PCB is newer than my original '565, but it's had a harder life. That's a bonus, since I don't feel any anxiety about stripping it down further. I hope to publish a reverse-engineered schematic of the PSU section eventually.

jal1234 · « **Reply #39 on:** September 03, 2019, 12:21:52 pm »

There is a brand new YouTube video on repairing the power supply on these, published Sept 2, 2019. Basically, the 4 electrolytic caps leak electrolyte, which flows under various parts, shorting the regulators, taking one or both out. Enjoy!
https://youtu.be/NGWSTz83dHw

Jon

mrprecision · « **Reply #40 on:** May 10, 2021, 03:16:04 pm »

Two years ago, I wrote a software for my THS720P for grabbing the image from the scope and copy it to the clipboard, save it to a BMP file or print it. It should work with all devices out of this family. The interface allows all the functions of the device. I have only used the interface to setup the hard copy function and to trigger the hard copy function from remote.

Have a try: https://www.schaeck.eu/download/?dir=THS7XX%20HardCopy

reheld · « **Reply #41 on:** May 02, 2022, 11:00:55 pm »

THM565 and THM571 are lame. They will never reach the THM575

This unit also has an bad LTC regulator. It is AVL branded. AVL is an big austrian company at the automotive sector, they do nearly everything including engine development.

reheld · « **Reply #42 on:** May 06, 2022, 08:02:04 pm »

Was able to fix my unit, at the search for a new battery i‘ve found another branded Tekmeter, it was sold in black and silver as Textron Tempo Greenlee TS90 with custom firmware for telephone cable testing.

http://tedevco.com/wp-content/uploads/2016/10/MA5770-TS90-Data-Sheet.pdf


EEVblog Main Site	EEVblog on Youtube	EEVblog on Twitter	EEVblog on Facebook	EEVblog on Odysee

Author Topic: Tektronix THM56x Portable Scope Hack/Teardown/Discussion (Read 9030 times)

Share me