Author Topic: Tektronix TDS3000 Oscilloscope Modules TDS3UAM (Read 38031 times)

circlethecat · « **on:** October 11, 2012, 06:47:39 pm »

Hello,

The TDS3000 scopes are getting a bit long in the tooth but I still like them. Extra features can be enabled with plug-in modules, most aren't that useful really but the TDS3AAM adds a few nice math utilities. Anyway, there is information scattered around the internet about a TDS3UAM module which enables all the features - I've just collected it together in the attached document, might be useful to someone.

Does anybody know how to clear the error log on TDS3000 scopes? I replaced an intermittent floppy drive (yes, very old-school) but annoyingly there is still an error message shown in the log (under Utility menu). I think there is a remote (GPIB / ethernet) command but it's not documented anywhere as far as I can see?

qno · « **Reply #1 on:** October 12, 2012, 03:49:08 pm »

Try TekScopes@yahoogroups.com

Lots of repair info.

free_electron · « **Reply #2 on:** October 12, 2012, 09:34:09 pm »

hold the cal button in the back while powering up the scope. tis unlocks an extra utility menu where you can clear the errors.
the set it again: same procedure.

The trickery with the eeprom is not required. simply flash the latest scope firmware. Tek released a final build with all options enabled when they discontinued this line.

alm · « **Reply #3 on:** October 13, 2012, 12:14:21 pm »

I believe this update added FFT, advanced triggering and some of the video features, not other options like advanced analysis (more measurements, statistics, advanced waveform math) or mask testing. I think it was just to make it competitive with competitors, not to stop charging $500 for an I2C EEPROM.

circlethecat · « **Reply #4 on:** October 15, 2012, 08:05:59 pm »

@qno
Thanks, I'll try there.

@free_electron
Holding the cal button (on back of scope) during boot does enable the calibration option but I can't see any option to clear the error log. Was worth a try though, thanks.

@alm
Yes, you're spot on there. The latest firmware for TDS3000 & TDS3000B scopes is V3.41 which enables the TDS3TRG, TDS3FFT and partial TDS3VID functionality. The EEPROM trickery is required to unlock TDS3AAM, TDS3TMT, TDS3LIM and full TDS3VID. This trickery should also work for the TDS3000C which is still on sale - would be good if someone could confirm that.

WigglerAway · « **Reply #5 on:** September 06, 2013, 11:53:21 pm »

I'm digging up this post to add some new information to it.

I had a look in the oscilloscope firmware and found a couple of undocumented modules TDS3ENG and TDS3BTA.
TDS3BTA appears to enable beta functions but even more interesting TDS3ENG enables all features.

Since I had two original modules which were made redundant by the firmware upgrades (TDS3FFT and TDS3TRG). Instead of creating a TDS3UAM I reprogrammed a single one as a TDS3ENG. This enabled all the features without any hardware mods

alm · « **Reply #6 on:** September 07, 2013, 12:18:57 am »

Nice find. I'm guessing TDS3ENG stood for engineering and allowed the engineers to test all features without fiddling with half a dozen application modules that don't all fit in the scope at the same time.

WigglerAway · « **Reply #7 on:** September 08, 2013, 11:48:03 pm »

Yes the actual description in the firmware is 'Engineering All Application Module'. I had a question over private message about the firmware format and though I ought to reply here as well in case it is useful to anyone else. The TDS3000 firmware updates had a 96 byte header and was then compressed in unix compress format (LZW).

Netsniper · « **Reply #8 on:** September 09, 2013, 08:53:26 am »

Thanks WigglerAway for your job!

Where do you find the firmware of the TDS3000, do you have make an extract directly from the TDS3000 of do you use the firmware files (V3.41) available from Tektronix site?
If you use files from Tektronix, how you merge files from floppy files?

I have try to edit the firmware file of mine DPO2000 but inside I don't find anything as "DPO2COMP" or other word about option...
I have make some key for DPO2000 options, but we can only activate 2 options at same time and 3 option are available...
I have two card with 24LC16 available and I have program the first with DPO2COMP and DPO2AUTO and the second with DPO2EMB. If I plug one OR the other, it' work with option inside, but If I plug two card at same time, the DPO2000 don't want to activate all at same time and it deactivate option card.

In the futur...I will send my post at the forum

WigglerAway · « **Reply #9 on:** September 09, 2013, 01:32:22 pm »

Quote from: Netsniper on September 09, 2013, 08:53:26 am

Where do you find the firmware of the TDS3000, do you have make an extract directly from the TDS3000 of do you use the firmware files (V3.41) available from Tektronix site?
If you use files from Tektronix, how you merge files from floppy files?

I just looked at v3.41 available online. I didn't get very far understanding the firmware update format, I stopped after I found evidence of the TDS3ENG module so never tried to understand the relationship between disks.

Quote from: Netsniper on September 09, 2013, 08:53:26 am

I have two card with 24LC16 available and I have program the first with DPO2COMP and DPO2AUTO and the second with DPO2EMB. If I plug one OR the other, it' work with option inside, but If I plug two card at same time, the DPO2000 don't want to activate all at same time and it deactivate option card.

The 24LC16 doesn't have the hardware address lines connected internally so can't support more than one part on the bus. If they are both connected, they will both try to respond to the master at the same time (and fail).

voltsandjolts · « **Reply #10 on:** October 31, 2013, 10:23:29 pm »

Looks like the TDS3000 and TDS3000B scopes might be the same hardware for all bandwidths.
Strings on firmware disk 3:

Could Not Program Instrument Model as Commanded: HW is TDS 30X4B.
Could Not Program Instrument Model as Commanded: HW is TDS 30X2B.
Could Not Program Instrument Model as Commanded: HW is TDS 30X4 (No Suffix).
Could Not Program Instrument Model as Commanded: HW is TDS 30X2 (No Suffix).

Where X is the bandwidth designation.
Would be nice to make a TDS3014 into a TDS3054, hmm, I wonder what those commands are....

drsurfer · « **Reply #11 on:** December 08, 2013, 08:28:17 am »

Hi all, this is my first post here.

I found this thread by chance and I have some questions.

I'm trying to build a module to enable DPO2COMP and DPO2EMBD features of my MSO2024 scope, according the info I found online, mainly on http://forum.tsebi.com/viewtopic.php?f=4&t=113

My first attempt has failed

, I suspect my SIM card connector is not working properly because its position is wrong. I have no access to a dummy module: I've never seen one up close, so my first request is if anyone has a mechanical drawing or, at least, accurate measurements of it.
I have access to a 3D printer, and I could replicate the plastic shell o the module.
I could take some measurements from images found here and there, but there are many views missing, and the result would be much more less accurate.

The second question is related to the EEprom contents.
I've noticed that in the hex file from the PDF in the first message of this thread, beside the strings with the module name, there is a (fake ?) version number.
I wonder if this is required for my scope and/or modules, too.

Thanks.

digger · « **Reply #12 on:** October 09, 2014, 08:14:32 am »

resurrecting an old thread, sorry guys..

Quote from: WigglerAway on September 06, 2013, 11:53:21 pm

I had a look in the oscilloscope firmware and found a couple of undocumented modules TDS3ENG and TDS3BTA.
TDS3BTA appears to enable beta functions but even more interesting TDS3ENG enables all features.

Quote from: WigglerAway on September 08, 2013, 11:48:03 pm

Yes the actual description in the firmware is 'Engineering All Application Module'. I had a question over private message about the firmware format and though I ought to reply here as well in case it is useful to anyone else. The TDS3000 firmware updates had a 96 byte header and was then compressed in unix compress format (LZW).

hell yeah, WigglerAway. thanks! i heard of the existence of some master key, and i was getting frustrated trying to unpack the tds3000 fw.
then i came across this thread...

out of curiosity, has anyone found master/engineer keys for other tek scope series? e.g. DPO2xxxx (maybe DPO2ENGR? idk)

Quote from: drsurfer on December 08, 2013, 08:28:17 am

Hi all, this is my first post here.

I found this thread by chance and I have some questions.

I'm trying to build a module to enable DPO2COMP and DPO2EMBD features of my MSO2024 scope, according the info I found online, mainly on http://forum.tsebi.com/viewtopic.php?f=4&t=113

My first attempt has failed , I suspect my SIM card connector is not working properly because its position is wrong. I have no access to a dummy module: I've never seen one up close, so my first request is if anyone has a mechanical drawing or, at least, accurate measurements of it.
I have access to a 3D printer, and I could replicate the plastic shell o the module.
I could take some measurements from images found here and there, but there are many views missing, and the result would be much more less accurate.

in the extremely unlikely event that you still care, i can measure the blank/dummy module for you. let me know

Quote from: drsurfer on December 08, 2013, 08:28:17 am

The second question is related to the EEprom contents.
I've noticed that in the hex file from the PDF in the first message of this thread, beside the strings with the module name, there is a (fake ?) version number.
I wonder if this is required for my scope and/or modules, too.

Thanks.

yeah, i was wondering about this, too...
can someone please paste a dump of a legit TDS3xxx module just so we can see what it looks like?

thanks!

Lunasix · « **Reply #13 on:** October 09, 2014, 08:40:53 am »

https://www.eevblog.com/forum/testgear/mso2000-application-module-hack/45/

digger · « **Reply #14 on:** October 09, 2014, 09:08:49 am »

cool, unpacked tds3000c fw update,

TDS3BTA Beta Test Application Module
TDS3ENG Engineering All Application Module
TDS3XXX Advanced Unknown Application Module

i wonder if that last one actually does anything if you load it up

Lunasix · « **Reply #15 on:** October 09, 2014, 09:10:43 am »

It will ask you to update the fimware of the scope, as it doesn't know what to do with.

hafrse · « **Reply #16 on:** December 13, 2014, 02:38:34 pm »

Hi,

Wher can I find the HEX string for the TDS3ENG ?
thanks in advance!
George

voltsandjolts · « **Reply #17 on:** December 13, 2014, 05:21:09 pm »

I haven't tried this myself (see attached .hex) but I think this should work.
Its just a modification of the HEX file in the first post here.

hafrse · « **Reply #18 on:** December 14, 2014, 08:07:14 am »

Thanks for the infomration

cncjerry · « **Reply #19 on:** January 06, 2015, 05:35:21 am »

wow, what a deal. I followed the PDF and bought a pack of 24C16 chips for like $5USD shipped. Not wanting to wait for the programmer I also ordered to get here, i coded an Arduino UNO to program the 24C16. I soldered jumpers on the sim carrier and have my 24c16 on a breadboard.

The scope enables TDS3AAM, the one I wanted, but says there is a version error on the others. All versions are coded as v1.00 in the hex file. Any ideas what needs to be changed or valid versions? My scope is running 3.41, I believe.

Thanks, AAM is pretty cool. I wouldn't mind having the masking modules enabled. I will try programming the TDS3ENG to see if that works as well.

Jerry

cncjerry · « **Reply #20 on:** January 06, 2015, 05:56:13 am »

Coding TDS3ENG hit the jackpot. People hack the RIGOLs and gain about $500 in features; hack the TDS3000 series and it is about 10x that or more.

Application modules detected:
* TDS3TRG Advanced Trigger
* TDS3VID Extended Video
* TDS3FFT FFT
* TDS3AAM Advanced Analysis
* TDS3LIM Limit Test
* TDS3TMT Telecom Mask Test
* TDS3BTA Beta Enabled
* TDS3SDI 601 Digital Video

The first three were enabled with version 3.41 software. I'll probably regret having Beta enabled as I have no idea what it does, if anything.

The 601 digital video is extracted below:

The TDS3SDI module enables broadcast engineers and technicians to view ITU-R BT.601 digital video waveforms, allowing them to quickly verify source, timing and amplitude throughout any production facility. The module operates in TDS3000 Series DPOs, providing digital video engineers with a quick, single-instrument, portable solution for qualitative troubleshooting of digital video signals. The module's capabilities, combined with the portability and flexibility of the battery-capable TDS3000 DPOs, make it ideally suited for crowded video production environments, especially those hard-to-reach components behind the rack, and for testing remote video network components. The unit combines the qualitative analysis functionality of several larger units in a single, compact, portable instrument.

Rather than use a waveform monitor, video analyzer and digital-to-analog converter, a broadcast engineer can reach for a TDS3054 with the TDS3SDI module to troubleshoot video outputs or trace a signal. Thus, providers of video can quickly diagnose and solve the problems that keep them from delivering high-quality video products.

aquaman8 · « **Reply #21 on:** July 15, 2016, 07:47:53 pm »

Hi cncjerry,

I know it has been a while, but can you confirm which hex file you used. Did you use the hex file that voltsandjolts posted in this thread on December 14, 2014 (i.e. tds3eng.hex)? If not, could you please post the hex file you used to program your eeprom.

Thanks for your help and your time!

Mitch

voltsandjolts · « **Reply #22 on:** July 17, 2017, 08:28:36 am »

Looks like there are remote commands that can be used to upgrade your TDS3000 bandwidth.
Check this thread:

https://www.eevblog.com/forum/testgear/tds-1000-2000-3000-bw-hack/

darkstar49 · « **Reply #23 on:** August 17, 2017, 09:26:00 pm »

enclosed some info on the TDS3UAM, as the site has meanwhile disappeared...

But, as already stated earlier in this post, the TDS3UAM module (apart from the technical challenge) is a nonsense !!

Get your hands on a TDS3FFT/TRG (no longer needed as activated by default in the latest TDS3x fw), and overwrite the content as needed (TDS3ENG is the only option needed for TDS3x scopes).

These modules work in ALL non-MDO scopes where they physically fit... the nice thing with DPO3/4K being that the 'licence" can be 'transferred' from the module to the scope, so if you manage to reprogram it, you can enable all the options with a single module (one option at a time...)

BenKenobi · « **Reply #24 on:** October 05, 2017, 02:55:00 pm »

I'm planning 'this' the last posts seem to indicate that the existing modules can be 're coded' i.e. a TD3FFT can be reprogrammed so I take it that it's an EEPROM ?

If the module itself can be reprogrammed what's the best method to connect the pins of the module to say an Arduino - the Arduino bit I can handle, the reprogramming too but the other stuff needs some input from those that are more experienced. I don't want to dismantle the app module if I don't need to.

prof6 · « **Reply #25 on:** October 26, 2017, 06:49:46 pm »

Hello everyone,

Few days ago I bought a Tektronix TDS3014 scope and 10 minutes ago I succesfully "upgraded" to TDS3054 and I used TDS3ENG Hex file to activate all features. Guys, it is awesome!

Few experience what I would like to share:
- even an original plugin module has x24c02 eeprom and write NOT protected by hardware pin, you can not reprogramm it.(Seriously I do not know why, it is writeable only from 0x00 till 0x04)
- I found one atmel 24c02b eeprom on my old PC 256Mb DDR1 RAM, (but of course it is happened after that I already ordered some eeprom...) So I replaced original eeprom on the original plugin module and tadaaammm I can erase it and program to as TDS3ENG module.

In the next minutes I excitedly watched the booting up process and I wanted to see what will be content of the pop-up window immediately.
All features enabled included BETA apps as well, but I do not know what does it means but it is enabled

Thanks for everyone who wrote even one word in this topic!

haertig · « **Reply #26 on:** January 27, 2018, 10:01:19 pm »

I had no problem reprogramming the stock FFT application module with the TDS3ENG firmware - it took the first time and opened up everything as touted.

I used a Flashcat programmer from embeddedcomputers.com. Note that whatever programmer you use, it must provide pull ups on the SDA & SCL lines to program an I2C module. I bought one of their standard narrow SOIC8 I2C adapters which has the pull ups installed, then installed a 4 pin header in the holes conveniently provided which parallel the socket connections. I connected to the chip in the FFT application module using a nice Pomona test clip that I bought on e-bay and connected it back to the programmer with some standard FxF header jumpers, arranging them appropriately so things were connected to the right places.

Total cost about $50. You could do cheaper by buying the bare programmer and using a chinesium test clip and making the appropriate jumper including pull ups.

Gray

mcguire · « **Reply #27 on:** February 28, 2018, 08:40:30 pm »

The eBay prices on TDS3FFT and TDS3TRG modules seems to be rising, presumably due to people hunting them down to reprogram them. Has anyone come up with a way to enable these additional features without using one of the plugin key modules?

I ended up thinking about soldering an EEPROM to the board using fly-wires or something...has anyone looked into that?

-Dave

Dogsled · « **Reply #28 on:** February 28, 2018, 11:13:57 pm »

Indeed, Was looking for some of those blank plastic modules in the later TDS series. Could glue in an EPROM, possibly some connectors?
Anyone have a few of those blanks or know where to get? They are not listed as a part in the service manual that I can see.

mcguire · « **Reply #29 on:** March 02, 2018, 10:17:32 pm »

I have a pair of the blanks in TDS3012 in my lab. I've put my CAD guy on the task of generating a 3D-printable model of it. Some of the features are a bit small, but it should be doable. I'll let you konw how it goes.

-Dave

Someone · « **Reply #30 on:** March 03, 2018, 01:10:20 am »

The original details about this "hack" go way back to 2009 but only reached prominence when DCMA takedowns were being used to kill off the promotion of it. From the information available on google its easy to assemble all the details needed to build something:
https://hackaday.com/2014/07/28/cloning-tektronix-application-modules/
http://daid.eu/~daid/dmca/
https://oshpark.com/shared_projects/pE9Ff8iu
The first I saw of this was:
http://herzogmuehlweg.de/TDS3UAM/TDS3UAM.html
discussed:
http://forum.tsebi.com/viewtopic.php?t=113

A PCB of the right dimensions with a little packing/spacer is all thats needed to do this, no need to go crazy with 3D printed cases.

mcguire · « **Reply #31 on:** March 03, 2018, 02:54:36 am »

I have some of those PCBs on the way thanks to a PM a few days ago. I hadn't intended to "go crazy" with 3D printed parts, but I would like to clone the module in an enclosure, and I have a CAD guy on staff who has some idle time, and several printers sitting here. It costs me nothing, and it will then be sitting on Thingiverse.

EDIT: Sorry man, I didn't mean for that to sound snippy. I was running on lack of sleep. My CAD guy will look into it on Monday, and if he deems it practical, I'll put the model on Thingiverse when it's done, just in case people want to do it that way.

-Dave

Sarcarean · « **Reply #32 on:** April 26, 2018, 06:31:27 am »

Quote from: haertig on January 27, 2018, 10:01:19 pm

I had no problem reprogramming the stock FFT application module with the TDS3ENG firmware - it took the first time and opened up everything as touted.

I used a Flashcat programmer from embeddedcomputers.com. Note that whatever programmer you use, it must provide pull ups on the SDA & SCL lines to program an I2C module. I bought one of their standard narrow SOIC8 I2C adapters which has the pull ups installed, then installed a 4 pin header in the holes conveniently provided which parallel the socket connections. I connected to the chip in the FFT application module using a nice Pomona test clip that I bought on e-bay and connected it back to the programmer with some standard FxF header jumpers, arranging them appropriately so things were connected to the right places.

Total cost about $50. You could do cheaper by buying the bare programmer and using a chinesium test clip and making the appropriate jumper including pull ups.

Gray

Hi Gray! Thanks for supporting FlashcatUSB, but small correction the website is Embeddedcomputers.net :-)

volvo_nut_v70 · « **Reply #33 on:** August 08, 2019, 02:29:03 pm »

An refresh to the original document/instructions in post 1 and inclusion of Gray's TDS3ENG post. Many thanks to gamalot and haertig for your kind assistance!!

Ordinaryman1971 · « **Reply #34 on:** October 14, 2019, 07:35:08 am »

Did anybody made few of those boards and have some spares? I need two for my scopes.

perdrix · « **Reply #35 on:** March 03, 2020, 11:03:14 am »

This is just a stupid question - how to open the existing TDS3FFT to reprogram the ROM?

Don't want to destroy it in the process of opening it ...

David

analogRF · « **Reply #36 on:** March 03, 2020, 04:23:05 pm »

Quote from: perdrix on March 03, 2020, 11:03:14 am

This is just a stupid question - how to open the existing TDS3FFT to reprogram the ROM?

Don't want to destroy it in the process of opening it ...

David

just have to pry it open with a knife or cutter carefully. it has four pins on the corners that fit into four holes. I broke them the first time
but easily can be glued back when you are done.

analogRF · « **Reply #37 on:** March 03, 2020, 04:26:43 pm »

a silly question, if I enable all the options on my tds3000b , is there gonna be a problem if I decide to sell it? like on ebay or something?
I mean can someone post the picture of the screen that shows all the options enabled? I know someone is selling BW hacked TDS3000
on ebay but not the options so that got me curious

MarkL · « **Reply #38 on:** March 03, 2020, 06:01:03 pm »

Quote from: perdrix on March 03, 2020, 11:03:14 am

This is just a stupid question - how to open the existing TDS3FFT to reprogram the ROM?

Don't want to destroy it in the process of opening it ...

David

Why open it? You don't need to open it. It's an I2C EEPROM with write already enabled.

I was able to write to my TDS3FFT module without breaking it open. I used the clips shown in the PDF posted by volvo_nut_v70 to (gently!) grab onto the SIM contacts.

Those clips are Tektronix 206-0364-01. You can get them for about $1 each if you don't explicitly search for the part number. "tektronix test clips" will find them, but cheaper. (I guess the seller(s) couldn't be bothered to research the part number.)

MarkL · « **Reply #39 on:** March 03, 2020, 06:10:39 pm »

Quote from: analogRF on March 03, 2020, 04:26:43 pm

a silly question, if I enable all the options on my tds3000b , is there gonna be a problem if I decide to sell it? like on ebay or something?
I mean can someone post the picture of the screen that shows all the options enabled? I know someone is selling BW hacked TDS3000
on ebay but not the options so that got me curious

I wouldn't show it. At this point it's a very well known hack, but it was made famous by Tektronix's DMCA take down order served on hack-a-day in 2014. So, they may still have some lingering sensitivity to it, especially since they're still selling TDS3000 series (after 20+ years!).

analogRF · « **Reply #40 on:** March 04, 2020, 04:06:48 pm »

Quote from: MarkL on March 03, 2020, 06:10:39 pm

Quote from: analogRF on March 03, 2020, 04:26:43 pm
a silly question, if I enable all the options on my tds3000b , is there gonna be a problem if I decide to sell it? like on ebay or something?
I mean can someone post the picture of the screen that shows all the options enabled? I know someone is selling BW hacked TDS3000
on ebay but not the options so that got me curious
I wouldn't show it. At this point it's a very well known hack, but it was made famous by Tektronix's DMCA take down order served on hack-a-day in 2014. So, they may still have some lingering sensitivity to it, especially since they're still selling TDS3000 series (after 20+ years!).

thanks for pointing to that take down order. I didn't know about that. But I suppose that article was showing (teaching) how to hack the scopes.
Why selling an scope that has all its software options enabled should be a copyright violation issue?
If I am not mistaken, three options are already enabled by the latest firmware anyways.

As an example these scopes do not officially have any bandwidth upgrade kit/option offered by tektronix but there are people selling BW upgraded TDS3000 on eBay.
Another example are Keysight scopes selling on ebay that have ALL their options enabled by using the methods available on this forum. I dont think keysight have gone after those people.

james_s · « **Reply #41 on:** March 05, 2020, 12:33:16 am »

Quote from: BenKenobi on October 05, 2017, 02:55:00 pm

I'm planning 'this' the last posts seem to indicate that the existing modules can be 're coded' i.e. a TD3FFT can be reprogrammed so I take it that it's an EEPROM ?

If the module itself can be reprogrammed what's the best method to connect the pins of the module to say an Arduino - the Arduino bit I can handle, the reprogramming too but the other stuff needs some input from those that are more experienced. I don't want to dismantle the app module if I don't need to.

Yes, it's just a standard serial eeprom. I opened up a module that came with mine, put a test clip on the IC and then flashed it with my TL866. There's a screw hidden under the label which you can peel back if you're careful.

MarkL · « **Reply #42 on:** March 05, 2020, 03:21:18 pm »

Quote from: analogRF on March 04, 2020, 04:06:48 pm

Quote from: MarkL on March 03, 2020, 06:10:39 pm
Quote from: analogRF on March 03, 2020, 04:26:43 pm
a silly question, if I enable all the options on my tds3000b , is there gonna be a problem if I decide to sell it? like on ebay or something?
I mean can someone post the picture of the screen that shows all the options enabled? I know someone is selling BW hacked TDS3000
on ebay but not the options so that got me curious
I wouldn't show it. At this point it's a very well known hack, but it was made famous by Tektronix's DMCA take down order served on hack-a-day in 2014. So, they may still have some lingering sensitivity to it, especially since they're still selling TDS3000 series (after 20+ years!).

thanks for pointing to that take down order. I didn't know about that. But I suppose that article was showing (teaching) how to hack the scopes.
Why selling an scope that has all its software options enabled should be a copyright violation issue?
If I am not mistaken, three options are already enabled by the latest firmware anyways.

As an example these scopes do not officially have any bandwidth upgrade kit/option offered by tektronix but there are people selling BW upgraded TDS3000 on eBay.
Another example are Keysight scopes selling on ebay that have ALL their options enabled by using the methods available on this forum. I dont think keysight have gone after those people.

Well, they haven't gone after anyone that we've heard about.

IIRC, Tektronix's main claim was that the information on the license module was copyrighted.

Yes, there are some options now enabled in the base software that used to require a license module, but that's not really the issue with enabling unauthorized features and selling the unit for a premium.

I'm not a lawyer. I'm just saying if it were me, I wouldn't be advertising that I'm selling something that I didn't pay for, which Tektronix may interpret as stealing. I would sell it with any capabilities I originally purchased and then let whoever bought it (re-)enable whatever hacked features they want.

angrybird · « **Reply #43 on:** March 05, 2020, 03:21:28 pm »

Correct me if I'm wrong, but didn't the final firmware update for the TDS3000 unlock all the software features for free?

MarkL · « **Reply #44 on:** March 05, 2020, 03:50:51 pm »

Quote from: angrybird on March 05, 2020, 03:21:28 pm

Correct me if I'm wrong, but didn't the final firmware update for the TDS3000 unlock all the software features for free?

That would be version 3.41 for the TDS3000, released in 2007. No, it did not enable all features.

3.41 only enabled FFT and Advanced Trigger. It also added video line triggering, which was one feature that came with the Extended Video module.

benj38 · « **Reply #45 on:** March 22, 2020, 01:01:49 pm »

This thread started more than 7 years ago, but it looks like there is a tradition of briefly reviving it every once in a while, so here are my two cents.

Programming the EEPROM as a TDS3ENG, I get a warning on startup saying: "Incompatible Firmware... An application module has been detected which requires an instrument firmware upgrade....Push MENU OFF to continue using the instrument without the application module enabled."
However, contrary to the warning, pushing "MENU OFF" does not seem to disable the application module and all the new functions are available.

I see no mention of this warning in previous messages. I have tried it on both a TDS3052 and a TDS3034B, and both with the 3.39 and the 3.41 firmware (which is the latest firmware), with the same result in all cases. I thus suspect that this warning is something everybody using the TDS3ENG gets on every startup, which is a bit annoying. If anybody has a different experience, please let me know.

benj38 · « **Reply #46 on:** March 22, 2020, 02:03:25 pm »

One more note regarding the different application modules for the TDS3000x series.

As far as I know, Tektronix only ever sold the following EEPROM application modules:
TDS3TRG, TDS3FFT, TDS3VID, TDS3TMT, TDS3AAM, TDS3LIM.

As mentioned earlier in this thread, TDS3TRG and TDS3FFT are enabled by default with the later firmwares. Thus, together with a home-made TDS3AUM EEPROM module (described in the OP), one gets all the modules ever sold by Tektronix.

The TDS3ENG engineering DIY module mentioned in this thread includes in addition TDS3BTA, and TDS3SDI which do not correspond to any commercially available EEPROM module ever sold. As far as I can tell, these are debugging/repair aids used internally by Tek.

The TDS3BTA stands for "Beta functions", and nobody seems to know what these are, if any. If anyone knows more, please share!

As for the TDS3SDI, there was a module sold by Tek. with this name, but it is not an EEPROM you plug into the slots at the front right of the instrument. Rather, it is a big hardware module one plugs in the back (like the Ethernet/GPIB/RS-232/VGA communication modules --- see attached image). According to its manual it: "...converts serial digital video to analog video composite and component (RGB or YPbPr) signals connected to the oscilloscope inputs". Like most modules that plug in the back of the scope, this module also adds items to the instrument's menus. The TDS3ENG EEPROM adds the same items to the menus (e.g., QuickMenu->Video->SUBMENU: ITU-R 601), however, without the hardware of the real TDS3SDI module, this seems of very little use.

In short, if you have the latest firmware, I see no advantage of the TDS3ENG module over the TDS3UAM module. In fact, the TDS3ENG has the disadvantage of showing me an annoying warning on every startup, which the TDS3UAM does not.

Thus, my recommendation at this point (unless new information comes in) is to forget about the TDS3ENG EEPROM, and stick to the TDS3AUM.

MarkL · « **Reply #47 on:** March 22, 2020, 05:11:15 pm »

Quote from: benj38 on March 22, 2020, 01:01:49 pm

...
Programming the EEPROM as a TDS3ENG, I get a warning on startup saying: "Incompatible Firmware... An application module has been detected which requires an instrument firmware upgrade....Push MENU OFF to continue using the instrument without the application module enabled."
However, contrary to the warning, pushing "MENU OFF" does not seem to disable the application module and all the new functions are available.

I see no mention of this warning in previous messages. I have tried it on both a TDS3052 and a TDS3034B, and both with the 3.39 and the 3.41 firmware (which is the latest firmware), with the same result in all cases. I thus suspect that this warning is something everybody using the TDS3ENG gets on every startup, which is a bit annoying. If anybody has a different experience, please let me know.

I am running 3.41 on a TDS3054 with a module reprogrammed as TDS3ENG, and I am not getting any warnings. On power-up it does a pop-up of all the options enabled, and then proceeds back to where it was when powered off after 10 seconds (or sooner if MENU OFF pressed).

Quote from: benj38 on March 22, 2020, 02:03:25 pm

...
Thus, my recommendation at this point (unless new information comes in) is to forget about the TDS3ENG EEPROM, and stick to the TDS3AUM.

The only difference I've noticed is that the WaveAlert feature becomes visible on the plain (non B or C) model with TDS3ENG. WaveAlert was officially introduced starting with the B version. It seems to work ok on the plain version. It's been several years since I experimented with these modules, but I think when I tried TDS3AUM it was not there. Since you have a TDS3AUM, you could say for sure.

analogRF · « **Reply #48 on:** March 22, 2020, 05:17:24 pm »

Quote from: benj38 on March 22, 2020, 02:03:25 pm

One more note regarding the different application modules for the TDS3000x series.

As far as I know, Tektronix only ever sold the following EEPROM application modules:
TDS3TRG, TDS3FFT, TDS3VID, TDS3TMT, TDS3AAM, TDS3LIM.

As mentioned earlier in this thread, TDS3TRG and TDS3FFT are enabled by default with the later firmwares. Thus, together with a home-made TDS3AUM EEPROM module (described in the OP), one gets all the modules ever sold by Tektronix.

The TDS3ENG engineering DIY module mentioned in this thread includes in addition TDS3BTA, and TDS3SDI which do not correspond to any commercially available EEPROM module ever sold. As far as I can tell, these are debugging/repair aids used internally by Tek.

The TDS3BTA stands for "Beta functions", and nobody seems to know what these are, if any. If anyone knows more, please share!

As for the TDS3SDI, there was a module sold by Tek. with this name, but it is not an EEPROM you plug into the slots at the front right of the instrument. Rather, it is a big hardware module one plugs in the back (like the Ethernet/GPIB/RS-232/VGA communication modules --- see attached image). According to its manual it: "...converts serial digital video to analog video composite and component (RGB or YPbPr) signals connected to the oscilloscope inputs". Like most modules that plug in the back of the scope, this module also adds items to the instrument's menus. The TDS3ENG EEPROM adds the same items to the menus (e.g., QuickMenu->Video->SUBMENU: ITU-R 601), however, without the hardware of the real TDS3SDI module, this seems of very little use.

In short, if you have the latest firmware, I see no advantage of the TDS3ENG module over the TDS3UAM module. In fact, the TDS3ENG has the disadvantage of showing me an annoying warning on every startup, which the TDS3UAM does not.

Thus, my recommendation at this point (unless new information comes in) is to forget about the TDS3ENG EEPROM, and stick to the TDS3AUM.

I am on 3.41 and with TDS3ENG and I am not getting any warning either.
However, I agree with you about the totally useless options that come with TDS3ENG and TDS3AUM is probably a better choice. Not sure about that Wavealert that MarkL is talking about. I do have it but does it also appear with TDS3AUM?

EDIT: disregard my comment about Wavealert thing. My scope is 3054B and I think they do have Wavealert by default anyway.

benj38 · « **Reply #49 on:** March 23, 2020, 01:40:37 pm »

Quote from: MarkL on March 22, 2020, 05:11:15 pm

The only difference I've noticed is that the WaveAlert feature becomes visible on the plain (non B or C) model with TDS3ENG. WaveAlert was officially introduced starting with the B version. It seems to work ok on the plain version. It's been several years since I experimented with these modules, but I think when I tried TDS3AUM it was not there. Since you have a TDS3AUM, you could say for sure.

The TDS3052 with TDS3AUM has no WaveAlert. I will find some time later this week to program it with the TDS3ENG to see if it gains the WaveAlert, and report back.

benj38 · « **Reply #50 on:** March 23, 2020, 01:49:18 pm »

@MarkL, @analogRF, thanks for the info. It is indeed quite interesting that you guys do not get the warning message I get with TDS3ENG, especially since I see this on two totally different scopes (TDS3052, TDS3034B), and two different firmware versions.
I have no explanation why we have such different results.

Perhaps a reset of the scope after installing the TDS3ENG module will remove this warning? I will try it later this week when I have time to program a module for TDS3ENG.

BTW, attached is an image of the warning I get.

MarkL · « **Reply #51 on:** March 23, 2020, 06:32:16 pm »

My guess is that the contents of your TDS3ENG module is not quite right. You might want to go back and double-check against the TDS3UAM-TDS3HEX.pdf document that was posted to this thread.

benj38 · « **Reply #52 on:** March 27, 2020, 05:18:25 pm »

@MarkL, @analogRF thanks for letting me know that the warning I get is not the expected behavior.

Quote from: MarkL on March 23, 2020, 06:32:16 pm

My guess is that the contents of your TDS3ENG module is not quite right. You might want to go back and double-check against the TDS3UAM-TDS3HEX.pdf document that was posted to this thread.

My module was indeed not quite right. The problem was that the PDF (as well as the tds3eng.hex file posted to this thread) only specifies the values of the first 256 Bytes, and I filled the remaining bytes above them with FF instead of 00.
I was lead to do that by extrapolating from the following sentence in the PDF:"...the second writes the entire 256 byte filling in FF in all unused locations, just in case you made an Oops and forgot the erase".

It is interesting that this makes no difference for the TDS3UAM, but causes the warning message with the TDS3ENG.

Thus, to prevent anybody else from making the same mistake, I suggest to further clarify the instructions in the TDS3UAM-TDS3HEX.pdf as follows:
1. Wherever it says erase it means fill with 00.
2. The sentence "Only difference is that the first block relies on you having erased the EEPROM, the second writes the entire
256 byte filling in FF in all unused locations, just in case you made an Oops and forgot the erase." should be ignored.
Indeed, even when using the second block, one has to also fill all bytes above the first 256 with 00. For example, by first erasing to all 00.

My thanks to the author of TDS3UAM-TDS3HEX.pdf for this amazing document!

benj38 · « **Reply #53 on:** March 27, 2020, 05:26:03 pm »

Quote from: MarkL on March 22, 2020, 05:11:15 pm

The only difference I've noticed is that the WaveAlert feature becomes visible on the plain (non B or C) model with TDS3ENG. WaveAlert was officially introduced starting with the B version. It seems to work ok on the plain version. It's been several years since I experimented with these modules, but I think when I tried TDS3AUM it was not there. Since you have a TDS3AUM, you could say for sure.

I can confirm that the TDS3ENG adds WaveAlert to plain TDS3000 scopes (non B or C), whereas TDS3AUM does not.
I would thus conclude, in agreement with @MarkL, that the TDS3ENG has an advantage over TDS3AUM for plain TDS3000 series scopes, but adds nothing of real value to TDS3000B series scopes.

LogicalDave · « **Reply #54 on:** December 15, 2021, 01:27:31 am »

First, a big thank you to the folks who figured this out and shared the information with the rest of us!
I can confirm that the TDSENG hex file worked perfectly on my TDS3032.

For those looking to do this, I did the following:

Buy an obsolete/useless module (TDS3FFT or TDS3TRG) cheap on eBay
Open with an Xacto knife, gently lifting the press-fit plastic pins at each corner
Remove the SOIC8 Xicor X24C02 EEPROM from the board with hot air
Reprogram the chip using the common/inexpensive TL866 (MiniPRO)programmer
Solder the re-programmed chip back on (make sure pin 1 matches the marking on the board)
Press the module back together and give it a try

As has been mentioned in this thread, the TDS3FFT and TDS3TRG modules are useless now since their functionality was included with the 3.41 firmware release, so they are often available on eBay fairly inexpensively and using them results in a nice, finished module that fits perfectly and be reliable.

Thanks again!

MarkL · « **Reply #55 on:** December 15, 2021, 01:57:15 am »

I'll repeat what I said a few posts ago, that there's no reason to go through the trouble of opening and doing soldering operations on an old TDS3FFT or TDS3TRG module.

You just need to use a few jumpers to connect the module's power, GND, SDA and SCL to your programmer. The EEPROM inside the module is already write enabled. Connect it and write the TDS3ENG image. Done.

LogicalDave · « **Reply #56 on:** December 15, 2021, 06:30:48 pm »

@MarkL

I appreciated your posts and I actually have a bunch of Tektronix 206-0364-01, but could only find two of them (I need a way to organize all of my probes/cables/adapters/etc.) and none of my other micro-grabbers would grab the module's contacts. I certainly would have liked that approach since opening the modules (I modified 4) is annoying and I damaged two of the plastic alignment pins each time.

OTOH, the modules are fairly easy to pry open and snap securely shut even after two of the pins have broken. Removing and replacing the SOIC8 with hot air only takes about 15s total, so that was trivial, and with the part removed, I could just drop it into the SOIC8 ZIF socket that came with my TL866 programmer. (i.e. the whole process wasn't much trouble).

I posted my prior message mainly to thank the folks (including you) who figured all of this out and because I expect many of the folks who are likely to have a TDS3K will also have a hot air workstation and might not have suitable micro-grabbers.

Thanks again!

Bansci · « **Reply #57 on:** January 11, 2022, 12:46:54 pm »

I wanted to say thanks for this thread, I repaired a TDS3052, upgraded the firmware, then unlocked all options thanks to your hard work!

I made a video about it and link it here in case someone finds it useful, or it encourages them to do the same!

lern01 · « **Reply #58 on:** November 03, 2023, 01:45:44 am »

Quote from: volvo_nut_v70 on August 08, 2019, 02:29:03 pm

An refresh to the original document/instructions in post 1 and inclusion of Gray's TDS3ENG post. Many thanks to gamalot and haertig for your kind assistance!!

Hi volvo_nut_v70, thank you very much, it worked, but after booting it appears: "Incompatlble firmware...." , as shown below. What's the reason? Thank you again for your help! When upgrading to 3.41, the same prompts appear.

volvo_nut_v70 · « **Reply #59 on:** November 03, 2023, 01:51:47 pm »

I have never seen that, have you tried installing 3.41? The BW upgrade will stay.


EEVblog Main Site	EEVblog on Youtube	EEVblog on Twitter	EEVblog on Facebook	EEVblog on Odysee

Author Topic: Tektronix TDS3000 Oscilloscope Modules TDS3UAM (Read 38031 times)

alm

alm

Share me