Tektronix TDS3000 Oscilloscope Modules TDS3UAM

[prof6]

Hello everyone,

Few days ago I bought a Tektronix TDS3014 scope and 10 minutes ago I succesfully "upgraded" to TDS3054 and I used TDS3ENG Hex file to activate all features. Guys, it is awesome!

Few experience what I would like to share:
- even an original plugin module has x24c02 eeprom and write NOT protected by hardware pin, you can not reprogramm it.(Seriously I do not know why, it is writeable only from 0x00 till 0x04)
- I found one atmel 24c02b eeprom on my old PC 256Mb DDR1 RAM, (but of course it is happened after that I already ordered some eeprom...) So I replaced original eeprom on the original plugin module and tadaaammm I can erase it and program to as TDS3ENG module.

In the next minutes I excitedly watched the booting up process and I wanted to see what will be content of the pop-up window immediately.
All features enabled included BETA apps as well, but I do not know what does it means but it is enabled

Thanks for everyone who wrote even one word in this topic!

[haertig]

I had no problem reprogramming the stock FFT application module with the TDS3ENG firmware - it took the first time and opened up everything as touted.

I used a Flashcat programmer from embeddedcomputers.com.  Note that whatever programmer you use, it must provide pull ups on the SDA & SCL lines to program an I2C module.  I bought one of their standard narrow SOIC8 I2C adapters which has the pull ups installed, then installed a 4 pin header in the holes conveniently provided which parallel the socket connections.  I connected to the chip in the FFT application module using a nice Pomona test clip that I bought on e-bay and  connected it back to the programmer with some standard FxF header jumpers, arranging them appropriately so things were connected to the right places.

Total cost about $50.  You could do cheaper by buying the bare programmer and using a chinesium test clip and making the appropriate jumper including pull ups.


Gray

[mcguire]

The eBay prices on TDS3FFT and TDS3TRG modules seems to be rising, presumably due to people hunting them down to reprogram them.  Has anyone come up with a way to enable these additional features without using one of the plugin key modules?

I ended up thinking about soldering an EEPROM to the board using fly-wires or something...has anyone looked into that?

                -Dave

[Dogsled]

Indeed, Was looking for some of those blank plastic modules in the later TDS series. Could glue in an EPROM, possibly some connectors?
Anyone have a few of those blanks or know where to get? They are not listed as a part in the service manual that I can see.

[mcguire]

  I have a pair of the blanks in TDS3012 in my lab.  I've put my CAD guy on the task of generating a 3D-printable model of it.  Some of the features are a bit small, but it should be doable.  I'll let you konw how it goes.

                               -Dave

[Someone]

The original details about this "hack" go way back to 2009 but only reached prominence when DCMA takedowns were being used to kill off the promotion of it. From the information available on google its easy to assemble all the details needed to build something:
https://hackaday.com/2014/07/28/cloning-tektronix-application-modules/
http://daid.eu/~daid/dmca/
https://oshpark.com/shared_projects/pE9Ff8iu
The first I saw of this was:
http://herzogmuehlweg.de/TDS3UAM/TDS3UAM.html
discussed:
http://forum.tsebi.com/viewtopic.php?t=113

A PCB of the right dimensions with a little packing/spacer is all thats needed to do this, no need to go crazy with 3D printed cases.

[mcguire]

I have some of those PCBs on the way thanks to a PM a few days ago.  I hadn't intended to "go crazy" with 3D printed parts, but I would like to clone the module in an enclosure, and I have a CAD guy on staff who has some idle time, and several printers sitting here.  It costs me nothing, and it will then be sitting on Thingiverse.

  EDIT: Sorry man, I didn't mean for that to sound snippy.  I was running on lack of sleep.  My CAD guy will look into it on Monday, and if he deems it practical, I'll put the model on Thingiverse when it's done, just in case people want to do it that way.

                  -Dave

[Sarcarean]

I had no problem reprogramming the stock FFT application module with the TDS3ENG firmware - it took the first time and opened up everything as touted.

I used a Flashcat programmer from embeddedcomputers.com.  Note that whatever programmer you use, it must provide pull ups on the SDA & SCL lines to program an I2C module.  I bought one of their standard narrow SOIC8 I2C adapters which has the pull ups installed, then installed a 4 pin header in the holes conveniently provided which parallel the socket connections.  I connected to the chip in the FFT application module using a nice Pomona test clip that I bought on e-bay and  connected it back to the programmer with some standard FxF header jumpers, arranging them appropriately so things were connected to the right places.

Total cost about $50.  You could do cheaper by buying the bare programmer and using a chinesium test clip and making the appropriate jumper including pull ups.


Gray

Hi Gray! Thanks for supporting FlashcatUSB, but small correction the website is Embeddedcomputers.net :-)

[volvo_nut_v70]

An refresh to the original document/instructions in post 1 and inclusion of Gray's TDS3ENG post. Many thanks to gamalot and haertig for your kind assistance!!

[Ordinaryman1971]

Did anybody made few of those boards and have some spares? I need two for my scopes.

[perdrix]

This is just a stupid question - how to open the existing TDS3FFT to reprogram the ROM?

Don't want to destroy it in the process of opening it ...

David

[analogRF]

This is just a stupid question - how to open the existing TDS3FFT to reprogram the ROM?

Don't want to destroy it in the process of opening it ...

David

just have to pry it open with a knife or cutter carefully. it has four pins on the corners that fit into four holes. I broke them the first time
but easily can be glued back when you are done.

[analogRF]

a silly question, if I enable all the options on my tds3000b , is there gonna be a problem if I decide to sell it? like on ebay or something?
I mean can someone post the picture of the screen that shows all the options enabled? I know someone is selling BW hacked TDS3000
on ebay but not the options so that got me curious

[MarkL]

This is just a stupid question - how to open the existing TDS3FFT to reprogram the ROM?

Don't want to destroy it in the process of opening it ...

David

Why open it?  You don't need to open it.  It's an I2C EEPROM with write already enabled.

I was able to write to my TDS3FFT module without breaking it open.  I used the clips shown in the PDF posted by volvo_nut_v70 to (gently!) grab onto the SIM contacts.

Those clips are Tektronix 206-0364-01.  You can get them for about $1 each if you don't explicitly search for the part number.   "tektronix test clips" will find them, but cheaper.  (I guess the seller(s) couldn't be bothered to research the part number.)

[MarkL]

a silly question, if I enable all the options on my tds3000b , is there gonna be a problem if I decide to sell it? like on ebay or something?
I mean can someone post the picture of the screen that shows all the options enabled? I know someone is selling BW hacked TDS3000
on ebay but not the options so that got me curious

I wouldn't show it.  At this point it's a very well known hack, but it was made famous by Tektronix's DMCA take down order served on hack-a-day in 2014.  So, they may still have some lingering sensitivity to it, especially since they're still selling TDS3000 series (after 20+ years!).

[analogRF]

a silly question, if I enable all the options on my tds3000b , is there gonna be a problem if I decide to sell it? like on ebay or something?
I mean can someone post the picture of the screen that shows all the options enabled? I know someone is selling BW hacked TDS3000
on ebay but not the options so that got me curious

I wouldn't show it.  At this point it's a very well known hack, but it was made famous by Tektronix's DMCA take down order served on hack-a-day in 2014.  So, they may still have some lingering sensitivity to it, especially since they're still selling TDS3000 series (after 20+ years!).

thanks for pointing to that take down order. I didn't know about that. But I suppose that article was showing (teaching) how to hack the scopes.
Why selling an scope that has all its software options enabled should be a copyright violation issue?
If I am not mistaken, three options are already enabled by the latest firmware anyways.

As an example these scopes do not officially have any bandwidth upgrade kit/option offered by tektronix but there are people selling BW upgraded TDS3000 on eBay.
Another example are Keysight scopes selling on ebay that have ALL their options enabled by using the methods available on this forum. I dont think keysight have gone after those people.

[james_s]

I'm planning 'this' the last posts seem to indicate that the existing modules can be 're coded' i.e. a TD3FFT can be reprogrammed so I take it that it's an EEPROM ?

If the module itself can be reprogrammed what's the best method to connect the pins of the module to say an Arduino - the Arduino bit I can handle, the reprogramming too but the other stuff needs some input from those that are more experienced. I don't want to dismantle the app module if I don't need to.

Yes, it's just a standard serial eeprom. I opened up a module that came with mine, put a test clip on the IC and then flashed it with my TL866. There's a screw hidden under the label which you can peel back if you're careful.

[MarkL]

a silly question, if I enable all the options on my tds3000b , is there gonna be a problem if I decide to sell it? like on ebay or something?
I mean can someone post the picture of the screen that shows all the options enabled? I know someone is selling BW hacked TDS3000
on ebay but not the options so that got me curious

I wouldn't show it.  At this point it's a very well known hack, but it was made famous by Tektronix's DMCA take down order served on hack-a-day in 2014.  So, they may still have some lingering sensitivity to it, especially since they're still selling TDS3000 series (after 20+ years!).

thanks for pointing to that take down order. I didn't know about that. But I suppose that article was showing (teaching) how to hack the scopes.
Why selling an scope that has all its software options enabled should be a copyright violation issue?
If I am not mistaken, three options are already enabled by the latest firmware anyways.

As an example these scopes do not officially have any bandwidth upgrade kit/option offered by tektronix but there are people selling BW upgraded TDS3000 on eBay.
Another example are Keysight scopes selling on ebay that have ALL their options enabled by using the methods available on this forum. I dont think keysight have gone after those people.

Well, they haven't gone after anyone that we've heard about.

IIRC, Tektronix's main claim was that the information on the license module was copyrighted.

Yes, there are some options now enabled in the base software that used to require a license module, but that's not really the issue with enabling unauthorized features and selling the unit for a premium.

I'm not a lawyer.  I'm just saying if it were me, I wouldn't be advertising that I'm selling something that I didn't pay for, which Tektronix may interpret as stealing.  I would sell it with any capabilities I originally purchased and then let whoever bought it (re-)enable whatever hacked features they want.

[angrybird]

Correct me if I'm wrong, but didn't the final firmware update for the TDS3000 unlock all the software features for free?

[MarkL]

Correct me if I'm wrong, but didn't the final firmware update for the TDS3000 unlock all the software features for free?

That would be version 3.41 for the TDS3000, released in 2007.  No, it did not enable all features.

3.41 only enabled FFT and Advanced Trigger.  It also added video line triggering, which was one feature that came with the Extended Video module.

[benj38]

This thread started more than 7 years ago, but it looks like there is a tradition of briefly reviving it every once in a while, so here are my two cents.

Programming the EEPROM as a TDS3ENG, I get a warning on startup saying: "Incompatible Firmware... An application module has been detected which requires an instrument firmware upgrade....Push MENU OFF to continue using the instrument without the application module enabled."
However, contrary to the warning, pushing "MENU OFF" does not seem to disable the application module and all the new functions are available.

I see no mention of this warning in previous messages. I have tried it on both a TDS3052 and a TDS3034B, and both with the 3.39 and the 3.41 firmware (which is the latest firmware), with the same result in all cases. I thus suspect that this warning is something everybody using the TDS3ENG gets on every startup, which is a bit annoying. If anybody has a different experience, please let me know.

[benj38]

One more note regarding the different application modules for the TDS3000x series.

As far as I know, Tektronix only ever sold the following EEPROM application modules:
TDS3TRG, TDS3FFT, TDS3VID, TDS3TMT, TDS3AAM, TDS3LIM.

As mentioned earlier in this thread, TDS3TRG and TDS3FFT are enabled by default with the later firmwares. Thus, together with a home-made TDS3AUM EEPROM module (described in the OP), one gets all the modules ever sold by Tektronix.

The TDS3ENG engineering DIY module mentioned in this thread includes in addition TDS3BTA, and TDS3SDI which do not correspond to any commercially available EEPROM module ever sold. As far as I can tell, these are debugging/repair aids used internally by Tek.

The TDS3BTA stands for "Beta functions", and nobody seems to know what these are, if any. If anyone knows more, please share!

As for the TDS3SDI, there was a module sold by Tek. with this name, but it is not an EEPROM you plug into the slots at the front right of the instrument. Rather, it is a big hardware module one plugs in the back (like the Ethernet/GPIB/RS-232/VGA communication modules --- see attached image). According to its manual it: "...converts serial digital video to analog video composite and component (RGB or YPbPr) signals connected to the oscilloscope inputs". Like most modules that plug in the back of the scope, this module also adds items to the instrument's menus. The TDS3ENG EEPROM adds the same items to the menus (e.g.,  QuickMenu->Video->SUBMENU: ITU-R 601), however, without the hardware of the real TDS3SDI module, this seems of very little use.

In short, if you have the latest firmware, I see no advantage of the TDS3ENG module over the TDS3UAM module. In fact, the TDS3ENG has the disadvantage of showing me an annoying warning on every startup, which the TDS3UAM does not.

Thus, my recommendation at this point (unless new information comes in) is to forget about the TDS3ENG EEPROM, and stick to the TDS3AUM.

[MarkL]

...
Programming the EEPROM as a TDS3ENG, I get a warning on startup saying: "Incompatible Firmware... An application module has been detected which requires an instrument firmware upgrade....Push MENU OFF to continue using the instrument without the application module enabled."
However, contrary to the warning, pushing "MENU OFF" does not seem to disable the application module and all the new functions are available.

I see no mention of this warning in previous messages. I have tried it on both a TDS3052 and a TDS3034B, and both with the 3.39 and the 3.41 firmware (which is the latest firmware), with the same result in all cases. I thus suspect that this warning is something everybody using the TDS3ENG gets on every startup, which is a bit annoying. If anybody has a different experience, please let me know.

I am running 3.41 on a TDS3054 with a module reprogrammed as TDS3ENG, and I am not getting any warnings.  On power-up it does a pop-up of all the options enabled, and then proceeds back to where it was when powered off after 10 seconds (or sooner if MENU OFF pressed).

...
Thus, my recommendation at this point (unless new information comes in) is to forget about the TDS3ENG EEPROM, and stick to the TDS3AUM.

The only difference I've noticed is that the WaveAlert feature becomes visible on the plain (non B or C) model with TDS3ENG.  WaveAlert was officially introduced starting with the B version.  It seems to work ok on the plain version.  It's been several years since I experimented with these modules, but I think when I tried TDS3AUM it was not there.  Since you have a TDS3AUM, you could say for sure.

[analogRF]

One more note regarding the different application modules for the TDS3000x series.

As far as I know, Tektronix only ever sold the following EEPROM application modules:
TDS3TRG, TDS3FFT, TDS3VID, TDS3TMT, TDS3AAM, TDS3LIM.

As mentioned earlier in this thread, TDS3TRG and TDS3FFT are enabled by default with the later firmwares. Thus, together with a home-made TDS3AUM EEPROM module (described in the OP), one gets all the modules ever sold by Tektronix.

The TDS3ENG engineering DIY module mentioned in this thread includes in addition TDS3BTA, and TDS3SDI which do not correspond to any commercially available EEPROM module ever sold. As far as I can tell, these are debugging/repair aids used internally by Tek.

The TDS3BTA stands for "Beta functions", and nobody seems to know what these are, if any. If anyone knows more, please share!

As for the TDS3SDI, there was a module sold by Tek. with this name, but it is not an EEPROM you plug into the slots at the front right of the instrument. Rather, it is a big hardware module one plugs in the back (like the Ethernet/GPIB/RS-232/VGA communication modules --- see attached image). According to its manual it: "...converts serial digital video to analog video composite and component (RGB or YPbPr) signals connected to the oscilloscope inputs". Like most modules that plug in the back of the scope, this module also adds items to the instrument's menus. The TDS3ENG EEPROM adds the same items to the menus (e.g.,  QuickMenu->Video->SUBMENU: ITU-R 601), however, without the hardware of the real TDS3SDI module, this seems of very little use.

In short, if you have the latest firmware, I see no advantage of the TDS3ENG module over the TDS3UAM module. In fact, the TDS3ENG has the disadvantage of showing me an annoying warning on every startup, which the TDS3UAM does not.

Thus, my recommendation at this point (unless new information comes in) is to forget about the TDS3ENG EEPROM, and stick to the TDS3AUM.

I am on 3.41 and with TDS3ENG and I am not getting any warning either.
However, I agree with you about the totally useless options that come with TDS3ENG and TDS3AUM is probably a better choice. Not sure about that Wavealert that MarkL is talking about. I do have it but does it also appear with TDS3AUM?

EDIT: disregard my comment about Wavealert thing. My scope is 3054B and I think they do have Wavealert by default anyway.

[benj38]

The only difference I've noticed is that the WaveAlert feature becomes visible on the plain (non B or C) model with TDS3ENG.  WaveAlert was officially introduced starting with the B version.  It seems to work ok on the plain version.  It's been several years since I experimented with these modules, but I think when I tried TDS3AUM it was not there.  Since you have a TDS3AUM, you could say for sure.

The TDS3052 with TDS3AUM  has no WaveAlert. I will find some time later this week to program it with the TDS3ENG to see if it gains the WaveAlert, and report back.