Hacking/Upgrading old scope (TDS754D)

[AwArD_RzD]

Just got a nice TDS754D for 700$ on Ebay, 500Mhz 2gs/s 4 channel, very bright screen and the front panel is very clean, this will be a nice high bandwidth addition for my lab, the only downside, the scope have only the STD option so a floppy, rs-232 and the FFT advanced math function.

I found the user and the service manual and i didn't find anything about the memory upgrade in it and it seem this generation of scope is buried in the late 90 internet because i only found this PDF http://globaltestsupply.com/datasheets/tdsxf2c.pdf explaining the instruction how to upgrade it with the Option Key disk, so it seem to be only a software upgrade.

Is there any other method to modify the firmware to unlock the memory or other option inside the scope  , i didn't found the Option key disk for now, so if someone know how to unlock the option without it or have a copy of this disk i will be interested to try it.

Thanks !!

[dxl]

There are two ways:

a) You need a console Adapter like this:
     http://www1.tek.com/forum/viewtopic.php?f=5&t=5526&p=10588&hilit=pitbull#p10588
     
     Interesting commands on my TDS7xx scopes:

     libManagerWordAtPut(0x50006, 1) <- Enable option 1M
     libManagerWordAtPut(0x50007, 1) <- Enable option 05
     libManagerWordAtPut(0x50008, 1) <- Enable option 13
     libManagerWordAtPut(0x50009, 1) <- Enable option 2F
     libManagerWordAtPut(0x5000a, 1) <- Enable option 1F
     libManagerWordAtPut(0x5000c, 1) <- Enable option 2C
     libManagerWordAtPut(0x5000d, 1) <- Enable option 3C
     libManagerWordAtPut(0x5000e, 1) <- Enable option 4C
     libManagerWordAtPut(0x5000f, 1) <- Enable option 2M

b) Use a GPIB Adapter

I don't remember the exact syntax, but it should be:

PASSWORD "PITBULL"
WORDCONSTANT:ATPUT 327686,1

Where the decimal number (327686 in that case) is the same number as in the console-port-example above, just in decimal.

Note that you have to set the flash write protection switch to unlock to write those settings.

[AwArD_RzD]

Thanks you very much,

since i start to have many GPIB stuff in the lab i think to buy an adapter and doing that over the GPIB but i found that little thing cost an arm and leg. There some homemade/clone on Ebay like this one http://www.ebay.ca/itm/USB-to-GPIB-Adapter-rev4-/281376900064?pt=LH_DefaultDomain_2&hash=item41835ec3e0 .

he sold some and never had complain and for this price if it do the job this will be great. Anyone know the limitation for these thing ?

[Wuerstchenhund]

since i start to have many GPIB stuff in the lab i think to buy an adapter and doing that over the GPIB but i found that little thing cost an arm and leg. There some homemade/clone on Ebay like this one http://www.ebay.ca/itm/USB-to-GPIB-Adapter-rev4-/281376900064?pt=LH_DefaultDomain_2&hash=item41835ec3e0 .

he sold some and never had complain and for this price if it do the job this will be great. Anyone know the limitation for these thing ?

Why pay that much for a very basic GPIB interface when a few bucks more give you a fully Agilent compatible clone with certain driver support?
www.ebay.ca/itm/S82357-GPIB-USB-interface-Agilent-82357B-compatible-/171387561919

[AwArD_RzD]

since i start to have many GPIB stuff in the lab i think to buy an adapter and doing that over the GPIB but i found that little thing cost an arm and leg. There some homemade/clone on Ebay like this one http://www.ebay.ca/itm/USB-to-GPIB-Adapter-rev4-/281376900064?pt=LH_DefaultDomain_2&hash=item41835ec3e0 .

he sold some and never had complain and for this price if it do the job this will be great. Anyone know the limitation for these thing ?

Why pay that much for a very basic GPIB interface when a few bucks more give you a fully Agilent compatible clone with certain driver support?
www.ebay.ca/itm/S82357-GPIB-USB-interface-Agilent-82357B-compatible-/171387561919

Because i don't know anything about the GPIB stuff and this unit caught my attention, but i will probably buy the one you linked, the more i read the more i see that even if they use the same standard, speaking with the GPIB device seem to need some understanding of the driver/software to be sure everything work perfectly. I have a HP8594e in the lab and the TDS754D is in the mail, as old device i don't think to have difficulty with a know driver/clone.

Does i need the GPIB cable to speak with 1 unit, i assume the cable is to link many unit but does it work if i plug the GPIB interface direct in the port ?

[Wuerstchenhund]

Does i need the GPIB cable to speak with 1 unit, i assume the cable is to link many unit but does it work if i plug the GPIB interface direct in the port ?

Yes, you can plug in the GPIB adapter directly into the instrument.

[AwArD_RzD]

Thanks Wuerstchenhund

Is there any option to backup the NVRAM over the GPIB before i attempt something ? Since i have no idea if the nvram/battery was ever replaced i will need to put that on my to do list.

I saw many post where people de-solder the Dallas nvram but it seem there a chance where i kill the battery with the heat and loose the data inside, i see many tds500 post where this happened but no one seem to ever did that with the tds754d. Since i don't have the unit for now i really don't know how it look inside or what's the chip inside and the service manual don't tell anything about the nvram model only the 5 year shelf life.

[dxl]

I wrote a tool for reading/writing memory from TDS700 series scope a while ago:

http://stackframe.org/tektool.shtml

[nctnico]

I have unsoldered several NVRAMs from TDS5xx/6xx/7xx scopes and never had a problem. One thing you must do is solder the NVRAM in a socket and then use an EPROM programmer to read the contents. Unsoldered pins make very poor contact in a ZIF socket.

[AwArD_RzD]

I wrote a tool for reading/writing memory from TDS700 series scope a while ago:

http://stackframe.org/tektool.shtml

Thanks i will take a look.

I have unsoldered several NVRAMs from TDS5xx/6xx/7xx scopes and never had a problem. One thing you must do is solder the NVRAM in a socket and then use an EPROM programmer to read the contents. Unsoldered pins make very poor contact in a ZIF socket.

Do you know the nvram model for the tds754d ? I found no picture of the inside or mention in the documentation, i talked with the vendor and it seem this unit was a backup and was on a shelf for a long time so i will probably backup and change  the chip asap. I have a order pending at Digikey if it's still available there i will put it in the order.

[nctnico]

I wouldn't bother replacing the NVRAM. Just make a backup and use when necesary. My TDS scopes still have their original NVRAM and they are a lot older than yours.

[AwArD_RzD]

I wouldn't bother replacing the NVRAM. Just make a backup and use when necesary. My TDS scopes still have their original NVRAM and they are a lot older than yours.

Only want to be on the safe side and well if i need to desolder the thing to do the backup, why not replacing it. Everything is always fine till you need really need to use the scope.

I'm a electro-mechanical technician, when we do repair/maintenance we always check everything because if the assembly chain / process stop, this can sometime cost 1K$/minute (and more) to the owner and well this can cost your job at this rate, it's just a crazy job side effect applied to my hobby environment  

[nctnico]

I make a living using my oscilloscopes so I make sure I have two. If one fails I just use the other.

[romantao]

I'm also a recent proud owner of a tek754A which i scored for 500$ in very good cosmetic state and fixed by changing the hybrid board relays

I'm not sure if i misread some forum post but I have the idea that, at least in the tds7xx series, the nvram only keeps the scope settings and activated options (which can be reactivated using gpib interface). The calibration values are not stored there but in some eeprom in the acquisition board. Therefore it's not so critical to replace the nvram as in the 5xx and 6xx series.

Someone correct me if i'm wrong!

[AwArD_RzD]

I'm not sure if i misread some forum post but I have the idea that, at least in the tds7xx series, the nvram only keeps the scope settings and activated options (which can be reactivated using gpib interface). The calibration values are not stored there but in some eeprom in the acquisition board. Therefore it's not so critical to replace the nvram as in the 5xx and 6xx series.

Someone correct me if i'm wrong!

Well if it's the case this explain why no one talk about the nvram in the tds700 series, i only see a bunch of post about 500 series. I saw someone talking about the calibration in the ACQ board but no documentation confirmed that either.

I think i will backup the NVRAM and solder a socket to reconnect it, if it fail and this cause the unit stop functioning/loose option this will be easier to replace it, and i'm very curious about some post telling that if the master switch is on the NVRAM is power by the power supply, so if i never unplug the scope i think the nvram battery will die with the scope in many year of useful use! 

[AwArD_RzD]

Is there a problem to read the nvram with the TL866CS ?

I updated the minipro software in preparation for the backup but it seem the software only test the DS1250, when selected, a windows open to test the device, but you can't read or write on it, if i select the other dallas ic now all the option to read write test are enabled.

There some ic with RW and test in the name but the ds1250 is the only option i can choose. I don't have the chip so i can't know if it's just a test and after the option are enabled.

Anyone have a clue about that, the device is listed to be compatible with the minipro but compatible to what extend.

Thanks !!

[AwArD_RzD]

I'm also a recent proud owner of a tek754A which i scored for 500$ in very good cosmetic state and fixed by changing the hybrid board relays

I'm not sure if i misread some forum post but I have the idea that, at least in the tds7xx series, the nvram only keeps the scope settings and activated options (which can be reactivated using gpib interface). The calibration values are not stored there but in some eeprom in the acquisition board. Therefore it's not so critical to replace the nvram as in the 5xx and 6xx series.

Someone correct me if i'm wrong!

There many post saying that too, but i just spoke with a tek support specialist, he had very short answer (and not answering everything i asked), he never mentioned the eeprom on the acquisition board, for him everything is in the nvram and if i want to replace it i will need to pay a tek service center to replace the nvram and i need a complete re-calibration..... This smell like TEK don't care and want my $$$ to replace a simple battery... the only good side of the conversation, he was blazing fast replying.

i have two ds1250y-100 in the mail, i will do some test with my tlc866 to see if i can do something with before messing with the real stuff, it seem the software only test the module but maybe the test is to read the entire content of the nvram and after i can save the bin file but this not explain why there some ic like the ds1225 with the RW and Test after the name....  .

well if someone can confirm this (quoted from tektronix forum) this will help me and probably many more people with TDS500/600/700 model tek scope.

Re: TDS 500 600 700 calibration/options affected by new NVRAM?

Postby tech8 on Mon Oct 15, 2012 10:55 pm
The "factory adjustment" (cal) constants are stored in a flash part on the acquisition board in "B/C/D" model TDS500/600/700's. I remember that for sure. Some of the later "A" models (like the 684A, 744A, 784A) probably do also. Option and SPC constants are stored on the processor board NVRAM on all TDS models.

[AwArD_RzD]

There are two ways:

a) You need a console Adapter like this:
     http://www1.tek.com/forum/viewtopic.php?f=5&t=5526&p=10588&hilit=pitbull#p10588
     
     Interesting commands on my TDS7xx scopes:

     libManagerWordAtPut(0x50006, 1) <- Enable option 1M
     libManagerWordAtPut(0x50007, 1) <- Enable option 05
     libManagerWordAtPut(0x50008, 1) <- Enable option 13
     libManagerWordAtPut(0x50009, 1) <- Enable option 2F
     libManagerWordAtPut(0x5000a, 1) <- Enable option 1F
     libManagerWordAtPut(0x5000c, 1) <- Enable option 2C
     libManagerWordAtPut(0x5000d, 1) <- Enable option 3C
     libManagerWordAtPut(0x5000e, 1) <- Enable option 4C
     libManagerWordAtPut(0x5000f, 1) <- Enable option 2M

b) Use a GPIB Adapter

I don't remember the exact syntax, but it should be:

PASSWORD "PITBULL"
WORDCONSTANT:ATPUT 327686,1

Where the decimal number (327686 in that case) is the same number as in the console-port-example above, just in decimal.

Note that you have to set the flash write protection switch to unlock to write those settings.

Any one know the exact location in the nvram of these option? I made a programmer/reader in VHDL with my Cyclone V GX starter kit and a custom adapter pcb and i did a backup of the DS1250Y in a M25P40 Serial Flash, now i want to try to "hack" these option to see if i can enable the 1M and the 2C option. Since the NVRAM is a 4Mb device, the address range is 0x0000 to 0x7FFFF very different range than the console example from Dxl. I tried last winter to use the gpib with no success, maybe i don't have the right syntax. I tried to find in the backup a string of data looking like my current option based on the quote from Dxl with no success. Now as a new dad i have some other priority but I will have some time to try thing in 2-3 week so if someone have some clue of where in the NVRAM i can find these option or how i can do that on the GPIB so i can start to prepare for this modification any help will be greatly appreciated.

[dxl]

Hi,

on the TDS784D i looked at, the addresses where:


NVRAM:0400081C 0000                                dc.w 0                  ; 5 - TV Trig
NVRAM:0400081E 0000                                dc.w 0                  ; 6 - Option 1M
NVRAM:04000820 0000                                dc.w 0                  ; 7
NVRAM:04000822 0001                                dc.w 1                  ; 8 - Option 13
NVRAM:04000824 0001                                dc.w 1                  ; 9 - Option 1F
NVRAM:04000826 0001                                dc.w 1                  ; A - Option 2F
NVRAM:04000828 0000                                dc.w 0                  ; B
NVRAM:0400082A 0001                                dc.w 1                  ; C - Option 2C
NVRAM:0400082C 0000                                dc.w 0                  ; D - Option 3C
NVRAM:0400082E 0000                                dc.w 0                  ; E - Option 4C
NVRAM:04000830 0001                                dc.w 1                  ; F - Option 2M

Those adresses could be completely different on your scopes firmware, and i think the data has a checksum associated.

Regards
dxl

[AwArD_RzD]

Thanks !!


I retried to send command over the gpib and this time this worked, the option 2C and the 2M are enabled, the only thing i don't understand it's how i know i have a 1M or 2M board, tried both and the it's the same menu, or maybe i don't understand the added memory or limitation.

i'm waiting for an another nvram to replace this old one, found out at the last minute that the Nvram replacement i bought a year ago corrupt the content i wrote on it... and the good one i used to test my setup is now in piece because i wanted to see inside .... big mistake  next time i will test them all before doing something   

I will take a snapshot of the new memory and compare it with the original one, i will be good to see the byte used to store the new value, i will post my result to compare to your TDS784D.

[andy2000]

I have a TDS784D, and the only thing stored in the DS1286, and DS1250 are the options, error log, and various user data like probe cal and SPC.  I think the options are actually in the DS1286, but I could be wrong since it's been a few of years since I worked on my 784D.  If you have a way to reset the options, then you don't need to worry about losing the NVRAM.  Calibration is stored in a a pair of EEPROMs on the acquisition board. 

You can tell which acquisition board you have by looking at the size of the SRAM chips.  I forget the sizes off the top of my head, but the smaller size has fewer pins than the larger size.  If there are unused PCB pads on the SRAM chips, then you definitely have the smaller memory. 

You can turn a TDS754D into a TDS784D by removing four caps on the acquisition board and rearranging some jumper resistors to change the ID.

[dxl]

The Option 1M boards have 32 pins AS7C1024 Memory chips if i recall correctly, while the option 2M boards have physically much larger rams in a TQFP-100 or TQFP-128 housing.

Regards
dxl

[klaus11]

Some trick to Hack/upgrade a TDS5052B 

[AwArD_RzD]

The Option 1M boards have 32 pins AS7C1024 Memory chips if i recall correctly, while the option 2M boards have physically much larger rams in a TQFP-100 or TQFP-128 housing.

Regards
dxl

I have 16x MT58L64L32F-7.5A, 64K x 32 , pcb fully populated so i have a 2M board, at first i didn't find any option for the extended memory but it's in another menu, ext acquisition, now i can enable the full 8M sample !! Tek menu are weird sometime, i used this scope for a year now and i still find some new menu now and then.

Thank you dxl, next step, programming the new nvram and i will compare the memory content before and after the hack, and i will post my result, at least for my version of the firmware this maybe can help someone who have a programmer but don't have a gpib adapter.

[Andy Watson]

For the record:
I can confirm that pushing "PASSWORD PITBULL",  followed by "WORDCONSTANT:ATPUT 327689,1", up the GPIB connector, with the cal-switch enabled, will enable the 2F maths option on a TDS510A.