Tektronix THM56x Portable Scope Hack/Teardown/Discussion - Page 1
Forum section: electronics / testgear

author: hardcoreman
author_rank: Contributor
timestamp: December 31, 2017, 02:01:15 pm
content: hello:)i have thm560 multimeter/scope... and i want hack it to 565.when you pull out bat. then you see pin header P300.here is pinout which i found1 + batt2 power on (h pulse)3 gnd4 RTS5 CTS6 TXD7 RXD8 /display off signal9 txs10 rxs (via mux u312)11 cks12 ?13 +5V14 gnd15 /int2 cpu ?16 flash VPP 12Vserial lines are directly connected to cpu (there is no MAX232!!!) i connect bt4.0 module here.now i looking for photo of boards from thm565 and flash chip dump560 have 256k ram and 565 i think have 1Mbit ram + rtc chipwhen i make dump and photos i post it here.

author: hardcoreman
author_rank: Contributor
timestamp: December 31, 2017, 02:56:07 pm
content: FLASH DUMP ftom 560there is 565menu inside like SET TIME BACKLIGHT etc.

author: hardcoreman
author_rank: Contributor
timestamp: January 07, 2018, 09:01:04 pm
content: internal photos from thm560

author: jal1234
author_rank: Contributor
timestamp: January 27, 2018, 03:33:11 am
content: Quote from: hardcoreman on January 07, 2018, 09:01:04 pmI have a working 565 and a dead 572 (aka Mac ET2020). The 572 appears to be identical to the 565, except for the firmware which is for automotive applications. What pictures do you want? I have no ability to dump firmware.Max 232 is in the external serial adapter/power supply module. My 565 has one. It replaces the battery pack, and engages the pin header normally covered by the battery pack.Have you found any schematics? The 572 power supply is dead, and a schematic would be helpful.Sent from my Nexus 5 using Tapatalk

author: hardcoreman
author_rank: Contributor
timestamp: January 30, 2018, 04:33:30 pm
content: i dont know what rtc chip is inside 565... 560 dont have it. so photos will help a lot.do you have any pc software for it?please find someone who can read flash... then i can make 2in1 instrument... 565 and 572 in one

author: jal1234
author_rank: Contributor
timestamp: January 30, 2018, 11:47:13 pm
content: I'll see what pictures and info I can get you tomorrow.What did you use to download the firmware?Sent from my Nexus 5 using Tapatalk

author: hardcoreman
author_rank: Contributor
timestamp: January 31, 2018, 06:38:00 am
content: i removed flash, use eprom programmer and plcc32 to dil32 adapter... and soldered socket to scope for easy hacking

author: jal1234
author_rank: Contributor
timestamp: February 01, 2018, 08:02:15 pm
content: Quote from: hardcoreman on January 31, 2018, 06:38:00 amI took a bunch of pictures of my THM571. I noticed that you are also missing Y302 and several components around it. Are you also missing J701?Which chip houses the flash you read out? U304? I noticed it was missing in your pictures. Did you already remove it in your photos?There is some old Tektronix DOS only software online for the serial connection. Search for THS720 software. It only handles data snapshots or screen grabs, no live data AFAIK. There is some other more modern 3rd party software for screen grabs. Check the THS 7xx threads on this site for it. But you'll need the serial/power adapter or some alternative to use it.On the THS7xx series, Tektronix deleted/add some resistors to differentiate between models. The firmware was common, just activated by the presence or absence of the resistors. Only on the top of the line THS730 do the schematics show other hardware differences. I don't know if the THM5xx series is similar. I know the 565 had the backlite and more memory. I suspect that the 57x series we're different firmware. The 572 was the ET2020 for Mac Tools. There was also a 575 and maybe another one for automotive use.Where do you live? US?Sent from my Nexus 5 using Tapatalk

author: jal1234
author_rank: Contributor
timestamp: February 01, 2018, 09:21:51 pm
content: Docuwave 1.2 software is here:http://www.hakanh.com/dl/index.htmSent from my Nexus 5 using Tapatalk

author: hardcoreman
author_rank: Contributor
timestamp: February 02, 2018, 10:41:52 pm
content: u304 is flash with FW. on my photo flash is removed.from photos: difference 560 and 565 is bigger sram, rtc for clock, backlight display and firmware...

author: JWag
author_rank: Contributor
timestamp: September 17, 2018, 08:03:05 pm
content: I have recently acquired a THM565. I've been comparing it to other equipment I have and it's not producing the same measurements, except perhaps for DC voltage.The AC RMS problems look like they were caused by leaky electrolytic caps. There was a little corrosion and electrolyte leakage around the two SMT electrolytics on the left of the attached image. They're part of the AD736 True RMS-to-DC Converter (SO-8 package U906), so that makes sense. However, even after replacement, AC RMS measurements are quite different from a couple of DMMs at most ranges.DC measurements seem OK. I measured the output of the MC1403 voltage reference (U904), and it's bang on at 2.5V. Presumably this is the voltage reference for the MAX134?The 'scope frequency measurements are also off. It generally reads high by 4% or so. Near as I can tell, the 25MHz oscillator on the digital board also functions as the 'scope timebase, so maybe that has drifted?The other potential issue is that the +5 and -5 rails are measuring a little low (4.85, -4.85). Still looking into whether this can cause the problems I'm seeing.Hints/comments welcome!

author: hardcoreman
author_rank: Contributor
timestamp: October 03, 2018, 04:43:08 am
content: hello, maybe calibration can help. i think calbration data are at end of flash.can you make dump?btw you can try my flash for test

author: JWag
author_rank: Contributor
timestamp: October 03, 2018, 02:34:41 pm
content: I think I can get the flash IC off the board (and I think I have a socket to re-mount it), but I don't have a way of dumping its contents.

author: hardcoreman
author_rank: Contributor
timestamp: October 05, 2018, 06:28:11 am
content: hi, buy this onehttp://autoelectric.cn/EN/TL866_main.htmlworks well

author: JWag
author_rank: Contributor
timestamp: October 06, 2018, 09:06:15 pm
content: I'm glad you said that, because I went looking for a cheap one and nearly went insane reading about the various versions of this thing.So far it's worked well.I've attached my flash dump, and a photo of the version sticker. Interestingly, mine's an Intel 28F010. The build date written on mine is March 14, 1994, so it looks like my firmware might be a bit newer.

author: hardcoreman
author_rank: Contributor
timestamp: October 08, 2018, 06:46:35 pm
content: in my unit there is sw1.0 and you have 2.0i try update my unit

author: JWag
author_rank: Contributor
timestamp: October 08, 2018, 07:04:13 pm
content: Enjoy your upgrade.The only other PLCC-32 Flash devices I have are some AMD 29F040. I flashed my dumped firmware to one, and the meter seemed to work fine, so I think that dump is OK.I spent a little time withZEMUanddZ80disassembling the firmware. Both versions seem to skip over almost everything and start executing code at 0x00800. The data between 0x00000 and 0x00800 doesn't look like code, so maybe the calibration data lives there?I inquired about having my THM565 calibrated. Maybe I could compare the firmware before and after, and find out for sure where the calibration data is stored. Unfortunately, calibration by Tek costs US$200+.

author: hardcoreman
author_rank: Contributor
timestamp: October 08, 2018, 07:53:45 pm
content: z80 uses banksso dissasemby is complicated...mmu cbr=78, bbr=00 and cbar=83common area is 0000-2fff and banks are mapped from 3000 to 7fff8000-ffff is common area 2++++++++i test your dump:diode test is offdc voltage look ok 5v,12v and 3v3ac rms is offscopeoffset cca -1.37vp-p reading 230v ac = 800v1Mhz square - freq meauserement 1Mhz okwe must find way how to calibrate this unit

author: hardcoreman
author_rank: Contributor
timestamp: October 08, 2018, 07:57:08 pm
content: enable calibration is definetly made by connector in bat. comp.serial commands ? ? ? burn config and burn cal found in flashthere is pin to feed vpp to flash, serial data and some other pins not identified yet.

author: JWag
author_rank: Contributor
timestamp: October 08, 2018, 08:18:37 pm
content: That reminds me; I have a few pins you don't have in your table, though they need to be double checked:Battery +? RP601.12Battery - (GND)RTS0_bar (Z80.45)CTS0_bar (Z80.46)TXA0 (Z80.48)RXA0 (Z80.49)?SPI MOSI (U310.5, Z80.55)?SPI SCK (U310.4, Z80.57)?VCC (switched)Battery - (GND)??

author: hardcoreman
author_rank: Contributor
timestamp: October 08, 2018, 08:55:00 pm
content: i make pinout update ...9-11 spi4-7 rs232

author: hardcoreman
author_rank: Contributor
timestamp: October 09, 2018, 07:32:27 am
content: config and cal. data extracted from flash0x0-0x2f config - instrument type0x30-0x9e cal 10x478-53a cal 2i think one cal block is for dmm and one is for scope...btw i have bad caps in rms converter tooshitpower supplyinput batt voltageoutput +5v -5v -18V smps and one small 5v ldobackup for sram and rtc 5v

author: JWag
author_rank: Contributor
timestamp: October 09, 2018, 02:04:37 pm
content: Nice work!The first time I worked on one of these meters, it had a bad power supply I couldn't fix. When I got this one a couple of months ago, I took some measurements in case I killed one of the regulators (all with respect to battery negative):C610 positive side: 9V (battery?)C611 positive side: 8.2C602 positive side: 4.8C616 positive side: 4.9C600 positive side: 4.8C603 neg side: -4.8C618 neg side: -4.8C601 neg side: -13U606.1 4.9VC606 pos side: 4.8Those LTC1174 devices are crazy expensive, especially for 20+ year old tech.

author: jal1234
author_rank: Contributor
timestamp: October 09, 2018, 02:25:13 pm
content: I've got a 565, and a Mac Tools ET2020 which is a 565 with different firmware for automotive use. The ET2020 has a bad power supply. For whatever reason, sitting around with dead batteries kills the supplies. I'd bought one off eBay, and it worked before I got it (confirmed it was the same unit). When I got it, you could hear a faint click, but no display. Both seller and I were baffled. There is a 565 that's been listed on eBay for sometime as new, but clicks, with no display.Does anyone have schematics of the PS, or understand what fails? We seem to be able to get schematics of every other Tekyronix scope, just not these. Barring that, would anyone in the states be willing to pull the glass from the ET2020 and transplant it to my working 565? I really want the automotive features of the 2020. Obviously , you could copy the firmware for others to use.

author: jal1234
author_rank: Contributor
timestamp: October 09, 2018, 02:43:48 pm
content: Damn spell correct. Meant "pull the flash", not glass...

author: JWag
author_rank: Contributor
timestamp: October 09, 2018, 03:05:55 pm
content: I've been watching that dodgy eBay 565 for a while, hoping the seller does a Best Offer or something.Quote from: jal1234 on October 09, 2018, 02:25:13 pmThere aren't any PS schematics I'm aware of, but it's not tremendously complex, especially if you have a working one to compare against. It is mostly two LTC1174s generating the positive and negative rail voltages for the whole device, plus a small LDO generating 5V for the Real Time Clock and SRAM.I'd be up for doing a transplant (or maybe repair). The SMT on this is pretty easy to work with, and I didn't have any trouble removing the flash IC from mine. Plus, I have replacement caps for your RMS converter circuit, which (if hardcoreman and I are any indication) are probably leaking electrolyte.I'd love to have another 565 firmware to compare against.Edit: I tore one down further and reverse-engineered a lot of the PSU section:https://www.eevblog.com/forum/repair/tektronix-tekmeter-(thm560-thm565-thm571)-wont-power-up/msg6046013/#msg6046013

author: jal1234
author_rank: Contributor
timestamp: October 09, 2018, 06:23:55 pm
content: Quote from: JWag on October 09, 2018, 03:05:55 pmI'll send you a PM.Thanks!Jon

author: hardcoreman
author_rank: Contributor
timestamp: October 09, 2018, 07:33:28 pm
content: 565 flash is normaly working in 560big sram and rtc installedand in my 560 v1.0, i unlocked 565 features. just made copy of config area from 565 image to 560...

author: JWag
author_rank: Contributor
timestamp: October 20, 2018, 05:42:21 pm
content: jal1234's meters have arrived. Here's the first dump, from the MAC ET-2020 (also known as the THM571). Note that this one is 256kB.I have some ideas about its power supply failure. I think I'll make a repair thread about it.

author: JWag
author_rank: Contributor
timestamp: October 20, 2018, 06:56:00 pm
content: jal1234's THM565 firmware is attached.Despite having the same text on the sticker as my unit, they are significantly different. The firmware I posted earlier from my 565 has "VERSION 2.00" inside. The firmware attached here from jal1234's 565 is "VERSION 1.03". Obviously they were both updated at some point in their history?

author: jal1234
author_rank: Contributor
timestamp: October 20, 2018, 06:57:09 pm
content: Interesting that the 2020 flash is larger than the 565. Probably all of the pre-set guided tests and templates for automotive use vs. general use. At least that's my theory!

author: jal1234
author_rank: Contributor
timestamp: October 20, 2018, 07:00:29 pm
content: Quote from: JWag on October 20, 2018, 06:56:00 pmWhat's the build date on your hardware vs. mine? I think it's on the sticker on the back of the units.

author: JWag
author_rank: Contributor
timestamp: October 20, 2018, 09:28:59 pm
content: Quote from: jal1234 on October 20, 2018, 07:00:29 pmMy 565 is dated April 1995, yours is April 1994. Your ET-2020 is dated May 1994.

author: jal1234
author_rank: Contributor
timestamp: October 20, 2018, 09:50:16 pm
content: Quote from: JWag on October 20, 2018, 09:28:59 pmThanks. Is there someway to upgrade my firmware to your newer version, but keep my calibration info? Tektronix is lousy at letting people know what is included in newer versions of firmware, but I assume it's bug fixes. Interesting that the flash labels stayed the same. They must have updated them as they went out the door.

author: hardcoreman
author_rank: Contributor
timestamp: October 21, 2018, 01:31:38 pm
content: newest fw in this topic is v2.0in v2.0 calibration is 0x19A00in v1.x calibratioin is 0x1F000simple copy is working.in 571 , hm i think there is way to switch it to 565 (560,550) mode...

author: hardcoreman
author_rank: Contributor
timestamp: October 23, 2018, 05:54:50 am
content: https://www.tek.com/oscilloscope/thm5u02firmware update module, to version 2.0so it looks 2.0 is last version

author: jal1234
author_rank: Contributor
timestamp: October 23, 2018, 02:09:14 pm
content: Quote from: hardcoreman on October 23, 2018, 05:54:50 amI wonder what the significance of thm5u02 is? How did you find this under that designation? Never heard of it before.

author: hardcoreman
author_rank: Contributor
timestamp: October 24, 2018, 05:21:18 am
content: i found it when i looking for info about calibration. i think it was a module which plug in expansion connector and then make flash update... flash update is only possible with ext. vpp source applied.

author: JWag
author_rank: Contributor
timestamp: February 16, 2019, 08:44:50 pm
content: Thanks to jal1234, I have a second ET-2020 to tinker with. This time, it has version 1.03 firmware on an AMD AM28F020 flash.The bare PCB is newer than my original '565, but it's had a harder life. That's a bonus, since I don't feel any anxiety about stripping it down further. I hope to publish a reverse-engineered schematic of the PSU section eventually.

author: jal1234
author_rank: Contributor
timestamp: September 03, 2019, 12:21:52 pm
content: There is a brand new YouTube video on repairing the power supply on these, published Sept 2, 2019. Basically, the 4 electrolytic caps leak electrolyte, which flows under various parts, shorting the regulators, taking one or both out. Enjoy!https://youtu.be/NGWSTz83dHwJon

author: mrprecision
author_rank: Regular Contributor
timestamp: May 10, 2021, 03:16:04 pm
content: Two years ago, I wrote a software for my THS720P for grabbing the image from the scope and copy it to the clipboard, save it to a BMP file or print it. It should work with all devices out of this family. The interface allows all the functions of the device. I have only used the interface to setup the hard copy function and to trigger the hard copy function from remote.Have a try:https://www.schaeck.eu/download/?dir=THS7XX%20HardCopy

author: reheld
author_rank: Newbie
timestamp: May 02, 2022, 11:00:55 pm
content: THM565 and THM571 are lame. They will never reach the THM575This unit also has an bad LTC regulator. It is AVL branded. AVL is an big austrian company at the automotive sector, they do nearly everything including engine development.

author: reheld
author_rank: Newbie
timestamp: May 06, 2022, 08:02:04 pm
content: Was able to fix my unit, at the search for a new battery i‘ve found another branded Tekmeter, it was sold in black and silver as Textron Tempo Greenlee TS90 with custom firmware for telephone cable testing.http://tedevco.com/wp-content/uploads/2016/10/MA5770-TS90-Data-Sheet.pdf

author: TERRA Operative
author_rank: Super Contributor
timestamp: March 14, 2025, 04:56:36 pm
content: So I recently got my hands on a THM565 and have been doing some digging for info on the calibration/adjustment method etc.And as luck would have it, I got my hands on the info required to do a full adjustment and firmware update, including full info for the Firmware Loading Fixture (part number 063-1446-99)!The adjustment is a pretty standard process, similar to the THS7xx series scopes. You just need AC and DC voltage standards good from 20mV up to 1000V, and a bunch of decade resistances.To send the required commands, you need Firmware Loading Fixture to connect between the port on the instrument and serial port on your PC so you can send commands, and put the instrument into a programming mode to save the cal data to the memory.This adapter will also allow for the updating of firmware using a bit of DOS software too, included below.A weird quirk is that the calibration can be done 10 times max, then the firmware needs to be flashed again to reset the counter back to zero, in which you can calibrate another 10 times, repeatable over and over.So, attached below is the schematic of the adapter that I just drew up now, with a few little modernisations. I will be working on a board layout too. I'll make it all through-hole and within 100x100mm board size so it'll be cheap to get PCB's from the Chinese fab houses. I'll also look at optimising the serial comms parts for cheaper pricing, maybe convert it to USB even, just for fun.I have also attached the floppy disk 063-1815-01 contents that contains the firmware flash utility, firmware images (including v2.0 and v1.04 for THM550, 560, and 565, and also version AQ1.03 for the THM571 range), and full instructions on the adjustment procedure (I've edited the file for readability and correctness).There's also a v2.0 firmware changelog, and some pictures of a real fixture and original schematics etc.I plan to write a python script to aid in performing the adjustment process (It'll send commands as needed and prompt each step), but if anyone can help figure out the firmware flash part, it would be great to port that to the Python script too. (Software isn't my strong suite...)Enjoy!

author: TERRA Operative
author_rank: Super Contributor
timestamp: April 26, 2025, 10:38:05 am
content: Alrighty. I got a working USB version of the Firmware Loading Fixture built.I designed it to use as much through-hole parts as possible so it's easier to build by hand.The PCB fits inside the 100x100 limit for cheap PCB's fro the usual Chinese fab houses, and it is designed to fit inside a Takachi enclosure, part number MX3-11-8, but I added mounting holes at the corners so you can mount it in whatever way you want using M3 etc screws.Just be aware of the isolation between the USB side and THS/PSU side, when calibrating the meter you will apply up to 1000V, so if you put this in an enclosure, don't allow a path for the 1000V to blow up your PC if something goes wrong (it's why there are optoisolators in there...)The vregs are designed to mount either under the board and are screwed to the base of the case for heatsinking, or they can be installed on top as usual with a heatsink attached.It works fine for calibration and standard serial communications (at 1200baud, 8 bits, no parity, 1 stop (8N1), Flow Control - None), but not for loading firmware yet. The original firmware loader software seems to expect a real serial port and probably low-level access to it.I'll be getting some more parts next week to bodge a serial connection to my MS-DOS PC and then sniff the comms to see what happens when firmware is updated and then hopefully a python script can be written to work via my USB board.As it stands now, if you make this circuit you can calibrate your meter up to 10 times (minus how ever many cals it's already had since last firmware update).Once that Python script is done, reloading the firmware resets the 10 calibration counter so you will be able to calibrate to your hearts content.