Author Topic: Tektronix THM56x Portable Scope Hack/Teardown/Discussion  (Read 8859 times)

0 Members and 1 Guest are viewing this topic.

Offline hardcoremanTopic starter

  • Contributor
  • Posts: 23
  • Country: sk
Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« on: December 31, 2017, 02:01:15 pm »
hello:)

i have thm560 multimeter/scope... and i want hack it to 565.

when you pull out bat. then you see pin header P300.

here is pinout which i found
1   + batt
2   power on (h pulse)
3   gnd
4   RTS
5   CTS
6   TXD
7   RXD
8   /display off signal
9   txs
10   rxs (via mux u312)
11   cks
12   ?
13   +5V
14   gnd
15   /int2 cpu ?
16   flash VPP 12V

serial lines are directly connected to cpu (there is no MAX232!!!) i connect bt4.0 module here.

now i looking for photo of boards from thm565 and flash chip dump

560 have 256k ram and 565 i think have 1Mbit ram + rtc chip

when i make dump and photos i post it here.
« Last Edit: October 09, 2018, 06:24:34 am by hardcoreman »
 

Offline hardcoremanTopic starter

  • Contributor
  • Posts: 23
  • Country: sk
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #1 on: December 31, 2017, 02:56:07 pm »
FLASH DUMP ftom 560

there is 565menu inside like SET TIME BACKLIGHT etc.
 

Offline hardcoremanTopic starter

  • Contributor
  • Posts: 23
  • Country: sk
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #2 on: January 07, 2018, 09:01:04 pm »
internal photos from thm560
 

Offline jal1234

  • Contributor
  • Posts: 18
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #3 on: January 27, 2018, 03:33:11 am »
internal photos from thm560
I have a working 565 and a dead 572 (aka Mac ET2020). The 572 appears to be identical to the 565, except for the firmware which is for automotive applications. What pictures do you want? I have no ability to dump firmware.

Max 232 is in the external serial adapter/power supply module. My 565 has one. It replaces the battery pack, and engages the pin header normally covered by the battery pack.

Have you found any schematics? The 572 power supply is dead, and a schematic would be helpful.

Sent from my Nexus 5 using Tapatalk

 

Offline hardcoremanTopic starter

  • Contributor
  • Posts: 23
  • Country: sk
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #4 on: January 30, 2018, 04:33:30 pm »
i dont know what rtc chip is inside 565... 560 dont have it. so photos will help a lot.

do you have any pc software for it?

please find someone who can read flash... then i can make 2in1 instrument... 565 and 572 in one :)
 

Offline jal1234

  • Contributor
  • Posts: 18
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #5 on: January 30, 2018, 11:47:13 pm »
I'll see what pictures and info I can get you tomorrow.

What did you use to download the firmware?

Sent from my Nexus 5 using Tapatalk

 

Offline hardcoremanTopic starter

  • Contributor
  • Posts: 23
  • Country: sk
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #6 on: January 31, 2018, 06:38:00 am »
i removed flash, use eprom programmer and plcc32 to dil32 adapter... and soldered socket to scope for easy hacking
 

Offline jal1234

  • Contributor
  • Posts: 18
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #7 on: February 01, 2018, 08:02:15 pm »
i removed flash, use eprom programmer and plcc32 to dil32 adapter... and soldered socket to scope for easy hacking
I took a bunch of pictures of my THM571. I noticed that you are also missing Y302 and several components around it. Are you also missing J701?

Which chip houses the flash you read out? U304? I noticed it was missing in your pictures. Did you already remove it in your photos?

There is some old Tektronix DOS only software online for the serial connection. Search for THS720 software. It only handles data snapshots or screen grabs, no live data AFAIK. There is some other more modern 3rd party software for screen grabs. Check the THS 7xx threads on this site for it. But you'll need the serial/power adapter or some alternative to use it.

On the THS7xx series, Tektronix deleted/add some resistors to differentiate between models. The firmware was common, just activated by the presence or absence of the resistors. Only on the top of the line THS730 do the schematics show other hardware differences. I don't know if the THM5xx series is similar. I know the 565 had the backlite and more memory. I suspect that the 57x series we're different firmware. The 572 was the ET2020 for Mac Tools. There was also a 575 and maybe another one for automotive use.

Where do you live? US?

Sent from my Nexus 5 using Tapatalk

 

Offline jal1234

  • Contributor
  • Posts: 18
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #8 on: February 01, 2018, 09:21:51 pm »
Docuwave 1.2 software is here:

http://www.hakanh.com/dl/index.htm

Sent from my Nexus 5 using Tapatalk

 
The following users thanked this post: JWag, hardcoreman

Offline hardcoremanTopic starter

  • Contributor
  • Posts: 23
  • Country: sk
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #9 on: February 02, 2018, 10:41:52 pm »
u304 is flash with FW. on my photo flash is removed.

from photos: difference 560 and 565 is bigger sram, rtc for clock, backlight display and firmware...
 

Offline JWag

  • Contributor
  • Posts: 20
  • Country: us
  • Former ICT ATE Engineer
    • My blog.
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #10 on: September 17, 2018, 08:03:05 pm »
I have recently acquired a THM565. I've been comparing it to other equipment I have and it's not producing the same measurements, except perhaps for DC voltage.

The AC RMS problems look like they were caused by leaky electrolytic caps. There was a little corrosion and electrolyte leakage around the two SMT electrolytics on the left of the attached image. They're part of the AD736 True RMS-to-DC Converter (SO-8 package U906), so that makes sense. However, even after replacement, AC RMS measurements are quite different from a couple of DMMs at most ranges.



DC measurements seem OK. I measured the output of the MC1403 voltage reference (U904), and it's bang on at 2.5V. Presumably this is the voltage reference for the MAX134?

The 'scope frequency measurements are also off. It generally reads high by 4% or so. Near as I can tell, the 25MHz oscillator on the digital board also functions as the 'scope timebase, so maybe that has drifted?

The other potential issue is that the +5 and -5 rails are measuring a little low (4.85, -4.85). Still looking into whether this can cause the problems I'm seeing.

Hints/comments welcome!
« Last Edit: September 17, 2018, 08:04:57 pm by JWag »
 

Offline hardcoremanTopic starter

  • Contributor
  • Posts: 23
  • Country: sk
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #11 on: October 03, 2018, 04:43:08 am »
hello, maybe calibration can help. i think calbration data are at end of flash.

can you make dump?

btw you can try my flash for test
 

Offline JWag

  • Contributor
  • Posts: 20
  • Country: us
  • Former ICT ATE Engineer
    • My blog.
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #12 on: October 03, 2018, 02:34:41 pm »
I think I can get the flash IC off the board (and I think I have a socket to re-mount it), but I don't have a way of dumping its contents.
 

Offline hardcoremanTopic starter

  • Contributor
  • Posts: 23
  • Country: sk
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #13 on: October 05, 2018, 06:28:11 am »
hi, buy this one http://autoelectric.cn/EN/TL866_main.html works well
 
The following users thanked this post: JWag

Offline JWag

  • Contributor
  • Posts: 20
  • Country: us
  • Former ICT ATE Engineer
    • My blog.
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #14 on: October 06, 2018, 09:06:15 pm »
I'm glad you said that, because I went looking for a cheap one and nearly went insane reading about the various versions of this thing.  |O  So far it's worked well.

I've attached my flash dump, and a photo of the version sticker. Interestingly, mine's an Intel 28F010. The build date written on mine is March 14, 1994, so it looks like my firmware might be a bit newer.



 
The following users thanked this post: edavid

Offline hardcoremanTopic starter

  • Contributor
  • Posts: 23
  • Country: sk
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #15 on: October 08, 2018, 06:46:35 pm »
in my unit there is sw1.0 and you have 2.0 :) i try update my unit
 

Offline JWag

  • Contributor
  • Posts: 20
  • Country: us
  • Former ICT ATE Engineer
    • My blog.
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #16 on: October 08, 2018, 07:04:13 pm »
Enjoy your upgrade. :)

The only other PLCC-32 Flash devices I have are some AMD 29F040. I flashed my dumped firmware to one, and the meter seemed to work fine, so I think that dump is OK.

I spent a little time with ZEMU and dZ80 disassembling the firmware. Both versions seem to skip over almost everything and start executing code at 0x00800. The data between 0x00000 and 0x00800 doesn't look like code, so maybe the calibration data lives there?

I inquired about having my THM565 calibrated. Maybe I could compare the firmware before and after, and find out for sure where the calibration data is stored. Unfortunately, calibration by Tek costs US$200+.
« Last Edit: October 08, 2018, 08:19:45 pm by JWag »
 

Offline hardcoremanTopic starter

  • Contributor
  • Posts: 23
  • Country: sk
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #17 on: October 08, 2018, 07:53:45 pm »
z80 uses banks :( so dissasemby is complicated...

mmu cbr=78, bbr=00 and cbar=83

common area is 0000-2fff and banks are mapped  from 3000 to 7fff
8000-ffff is common area 2

++++++++

i test your dump:

diode test is off
dc voltage look ok 5v,12v and 3v3
ac rms is off

scope
offset cca -1.37v
p-p reading 230v ac = 800v
1Mhz square - freq meauserement 1Mhz ok

we must find way how to calibrate this unit
« Last Edit: October 09, 2018, 07:36:07 am by hardcoreman »
 

Offline hardcoremanTopic starter

  • Contributor
  • Posts: 23
  • Country: sk
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #18 on: October 08, 2018, 07:57:08 pm »
enable calibration is definetly made by connector in bat. comp.

serial commands ? ? ? burn config and burn cal found in flash

there is pin to feed vpp to flash, serial data and some other pins not identified yet.
« Last Edit: October 09, 2018, 07:38:07 am by hardcoreman »
 

Offline JWag

  • Contributor
  • Posts: 20
  • Country: us
  • Former ICT ATE Engineer
    • My blog.
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #19 on: October 08, 2018, 08:18:37 pm »
That reminds me; I have a few pins you don't have in your table, though they need to be double checked:

  • Battery +
  • ? RP601.12
  • Battery - (GND)
  • RTS0_bar (Z80.45)
  • CTS0_bar (Z80.46)
  • TXA0 (Z80.48)
  • RXA0 (Z80.49)
  • ?
  • SPI MOSI (U310.5, Z80.55)
  • ?
  • SPI SCK (U310.4, Z80.57)
  • ?
  • VCC (switched)
  • Battery - (GND)
  • ?
  • ?
 

Offline hardcoremanTopic starter

  • Contributor
  • Posts: 23
  • Country: sk
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #20 on: October 08, 2018, 08:55:00 pm »
i make pinout update ...

9-11 spi
4-7 rs232
 
The following users thanked this post: JWag

Offline hardcoremanTopic starter

  • Contributor
  • Posts: 23
  • Country: sk
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #21 on: October 09, 2018, 07:32:27 am »
config and cal. data extracted from flash

0x0-0x2f config - instrument type

0x30-0x9e cal 1
0x478-53a cal 2

i think one cal block is for dmm and one is for scope...

btw i have bad caps in rms converter too :D shit :)


power supply

input batt voltage
output +5v -5v -18V smps and one small 5v ldo
backup for sram and rtc 5v

 

Offline JWag

  • Contributor
  • Posts: 20
  • Country: us
  • Former ICT ATE Engineer
    • My blog.
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #22 on: October 09, 2018, 02:04:37 pm »
Nice work!

The first time I worked on one of these meters, it had a bad power supply I couldn't fix. When I got this one a couple of months ago, I took some measurements in case I killed one of the regulators (all with respect to battery negative):
C610 positive side: 9V (battery?)
C611 positive side: 8.2
C602 positive side: 4.8
C616 positive side: 4.9
C600 positive side: 4.8
C603 neg side: -4.8
C618 neg side: -4.8
C601 neg side: -13
U606.1 4.9V
C606 pos side: 4.8


Those LTC1174 devices are crazy expensive, especially for 20+ year old tech.
 

Offline jal1234

  • Contributor
  • Posts: 18
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #23 on: October 09, 2018, 02:25:13 pm »
I've got a 565, and a Mac Tools ET2020 which is a 565 with different firmware for automotive use. The ET2020 has a bad power supply. For whatever reason, sitting around with dead batteries kills the supplies. I'd bought one off eBay, and it worked before I got it (confirmed it was the same unit). When I got it, you could hear a faint click, but no display. Both seller and I were baffled. There is a 565 that's been listed on eBay for sometime as new, but clicks, with no display.
Does anyone have schematics of the PS, or understand what fails? We seem to be able to get schematics of every other Tekyronix scope, just not these.  Barring that, would anyone in the states be willing to pull the glass from the ET2020 and transplant it to my working 565? I really want the automotive features of the 2020. Obviously , you could copy the firmware for others to use.
 

Offline jal1234

  • Contributor
  • Posts: 18
Re: Tektronix THM56x Portable Scope Hack/Teardown/Discussion
« Reply #24 on: October 09, 2018, 02:43:48 pm »
Damn spell correct. Meant "pull the flash", not glass...
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf