Hacking/Upgrading old scope (TDS754D) - Page 1
Forum section: electronics / testgear

author: AwArD_RzD
author_rank: Regular Contributor
timestamp: August 01, 2014, 02:39:29 am
content: Just got a nice TDS754D for 700$ on Ebay, 500Mhz 2gs/s 4 channel, very bright screen and the front panel is very clean, this will be a nice high bandwidth addition for my lab, the only downside, the scope have only the STD option so a floppy, rs-232 and the FFT advanced math function.I found the user and the service manual and i didn't find anything about the memory upgrade in it and it seem this generation of scope is buried in the late 90 internet because i only found this PDFhttp://globaltestsupply.com/datasheets/tdsxf2c.pdfexplaining the instruction how to upgrade it with the Option Key disk, so it seem to be only a software upgrade.Is there any other method to modify the firmware to unlock the memory or other option inside the scope, i didn't found the Option key disk for now, so if someone know how to unlock the option without it or have a copy of this disk i will be interested to try it.Thanks !!

author: dxl
author_rank: Regular Contributor
timestamp: August 01, 2014, 06:45:36 am
content: There are two ways:a) You need a console Adapter like this:http://www1.tek.com/forum/viewtopic.php?f=5&t=5526&p=10588&hilit=pitbull#p10588Interesting commands on my TDS7xx scopes:libManagerWordAtPut(0x50006, 1) <- Enable option 1MlibManagerWordAtPut(0x50007, 1) <- Enable option 05libManagerWordAtPut(0x50008, 1) <- Enable option 13libManagerWordAtPut(0x50009, 1) <- Enable option 2FlibManagerWordAtPut(0x5000a, 1) <- Enable option 1FlibManagerWordAtPut(0x5000c, 1) <- Enable option 2ClibManagerWordAtPut(0x5000d, 1) <- Enable option 3ClibManagerWordAtPut(0x5000e, 1) <- Enable option 4ClibManagerWordAtPut(0x5000f, 1) <- Enable option 2Mb) Use a GPIB AdapterI don't remember the exact syntax, but it should be:PASSWORD "PITBULL"WORDCONSTANT:ATPUT 327686,1Where the decimal number (327686 in that case) is the same number as in the console-port-example above, just in decimal.Note that you have to set the flash write protection switch to unlock to write those settings.

author: AwArD_RzD
author_rank: Regular Contributor
timestamp: August 01, 2014, 01:41:43 pm
content: Thanks you very much,since i start to have many GPIB stuff in the lab i think to buy an adapter and doing that over the GPIB but i found that little thing cost an arm and leg. There some homemade/clone on Ebay like this onehttp://www.ebay.ca/itm/USB-to-GPIB-Adapter-rev4-/281376900064?pt=LH_DefaultDomain_2&hash=item41835ec3e0.he sold some and never had complain and for this price if it do the job this will be great. Anyone know the limitation for these thing ?

author: Wuerstchenhund
author_rank: Super Contributor
timestamp: August 01, 2014, 05:16:39 pm
content: Quote from: AwArD_RzD on August 01, 2014, 01:41:43 pmWhy pay that much for a very basic GPIB interface when a few bucks more give you a fully Agilent compatible clone with certain driver support?www.ebay.ca/itm/S82357-GPIB-USB-interface-Agilent-82357B-compatible-/171387561919

author: AwArD_RzD
author_rank: Regular Contributor
timestamp: August 01, 2014, 05:59:35 pm
content: Quote from: Wuerstchenhund on August 01, 2014, 05:16:39 pmBecause i don't know anything about the GPIB stuff and this unit caught my attention, but i will probably buy the one you linked, the more i read the more i see that even if they use the same standard, speaking with the GPIB device seem to need some understanding of the driver/software to be sure everything work perfectly. I have a HP8594e in the lab and the TDS754D is in the mail, as old device i don't think to have difficulty with a know driver/clone.Does i need the GPIB cable to speak with 1 unit, i assume the cable is to link many unit but does it work if i plug the GPIB interface direct in the port ?

author: Wuerstchenhund
author_rank: Super Contributor
timestamp: August 01, 2014, 06:33:18 pm
content: Quote from: AwArD_RzD on August 01, 2014, 05:59:35 pmYes, you can plug in the GPIB adapter directly into the instrument.

author: AwArD_RzD
author_rank: Regular Contributor
timestamp: August 02, 2014, 12:00:05 am
content: Thanks WuerstchenhundIs there any option to backup the NVRAM over the GPIB before i attempt something ? Since i have no idea if the nvram/battery was ever replaced i will need to put that on my to do list.I saw many post where people de-solder the Dallas nvram but it seem there a chance where i kill the battery with the heat and loose the data inside, i see many tds500 post where this happened but no one seem to ever did that with the tds754d. Since i don't have the unit for now i really don't know how it look inside or what's the chip inside and the service manual don't tell anything about the nvram model only the 5 year shelf life.

author: dxl
author_rank: Regular Contributor
timestamp: August 02, 2014, 06:35:13 pm
content: I wrote a tool for reading/writing memory from TDS700 series scope a while ago:http://stackframe.org/tektool.shtml

author: nctnico
author_rank: Super Contributor
timestamp: August 02, 2014, 06:38:36 pm
content: I have unsoldered several NVRAMs from TDS5xx/6xx/7xx scopes and never had a problem. One thing you must do is solder the NVRAM in a socket and then use an EPROM programmer to read the contents. Unsoldered pins make very poor contact in a ZIF socket.

author: AwArD_RzD
author_rank: Regular Contributor
timestamp: August 02, 2014, 06:56:47 pm
content: Quote from: dxl on August 02, 2014, 06:35:13 pmThanks i will take a look.Quote from: nctnico on August 02, 2014, 06:38:36 pmDo you know the nvram model for the tds754d ? I found no picture of the inside or mention in the documentation, i talked with the vendor and it seem this unit was a backup and was on a shelf for a long time so i will probably backup and change the chip asap. I have a order pending at Digikey if it's still available there i will put it in the order.

author: nctnico
author_rank: Super Contributor
timestamp: August 02, 2014, 07:06:30 pm
content: I wouldn't bother replacing the NVRAM. Just make a backup and use when necesary. My TDS scopes still have their original NVRAM and they are a lot older than yours.

author: AwArD_RzD
author_rank: Regular Contributor
timestamp: August 02, 2014, 10:59:10 pm
content: Quote from: nctnico on August 02, 2014, 07:06:30 pmOnly want to be on the safe side and well if i need to desolder the thing to do the backup, why not replacing it. Everything is always fine till you need really need to use the scope.I'm a electro-mechanical technician, when we do repair/maintenance we always check everything because if the assembly chain / process stop, this can sometime cost 1K$/minute (and more) to the owner and well this can cost your job at this rate, it's just a crazy job side effect applied to my hobby environment

author: nctnico
author_rank: Super Contributor
timestamp: August 03, 2014, 12:02:00 am
content: I make a living using my oscilloscopes so I make sure I have two. If one fails I just use the other.

author: romantao
author_rank: Contributor
timestamp: August 03, 2014, 12:09:09 am
content: I'm also a recent proud owner of a tek754A which i scored for 500$ in very good cosmetic state and fixed by changing the hybrid board relaysI'm not sure if i misread some forum post but I have the idea that, at least in the tds7xx series, the nvram only keeps the scope settings and activated options (which can be reactivated using gpib interface). The calibration values are not stored there but in some eeprom in the acquisition board. Therefore it's not so critical to replace the nvram as in the 5xx and 6xx series.Someone correct me if i'm wrong!

author: AwArD_RzD
author_rank: Regular Contributor
timestamp: August 03, 2014, 12:54:44 am
content: Quote from: romantao on August 03, 2014, 12:09:09 amWell if it's the case this explain why no one talk about the nvram in the tds700 series, i only see a bunch of post about 500 series. I saw someone talking about the calibration in the ACQ board but no documentation confirmed that either.I think i will backup the NVRAM and solder a socket to reconnect it, if it fail and this cause the unit stop functioning/loose option this will be easier to replace it, and i'm very curious about some post telling that if the master switch is on the NVRAM is power by the power supply, so if i never unplug the scope i think the nvram battery will die with the scope in many year of useful use!

author: AwArD_RzD
author_rank: Regular Contributor
timestamp: August 03, 2014, 03:57:18 pm
content: Is there a problem to read the nvram with the TL866CS ?I updated the minipro software in preparation for the backup but it seem the software only test the DS1250, when selected, a windows open to test the device, but you can't read or write on it, if i select the other dallas ic now all the option to read write test are enabled.There some ic with RW and test in the name but the ds1250 is the only option i can choose. I don't have the chip so i can't know if it's just a test and after the option are enabled.Anyone have a clue about that, the device is listed to be compatible with the minipro but compatible to what extend.Thanks !!

author: AwArD_RzD
author_rank: Regular Contributor
timestamp: August 07, 2014, 01:09:55 am
content: Quote from: romantao on August 03, 2014, 12:09:09 amThere many post saying that too, but i just spoke with a tek support specialist, he had very short answer (and not answering everything i asked), he never mentioned the eeprom on the acquisition board, for him everything is in the nvram and if i want to replace it i will need to pay a tek service center to replace the nvram and i need a complete re-calibration..... This smell like TEK don't care and want my $$$ to replace a simple battery... the only good side of the conversation, he was blazing fast replying.i have two ds1250y-100 in the mail, i will do some test with my tlc866 to see if i can do something with before messing with the real stuff, it seem the software only test the module but maybe the test is to read the entire content of the nvram and after i can save the bin file but this not explain why there some ic like the ds1225 with the RW and Test after the name.....well if someone can confirm this (quoted from tektronix forum) this will help me and probably many more people with TDS500/600/700 model tek scope.Re: TDS 500 600 700 calibration/options affected by new NVRAM?Postby tech8 on Mon Oct 15, 2012 10:55 pmThe "factory adjustment" (cal) constants are stored in a flash part on the acquisition board in "B/C/D" model TDS500/600/700's. I remember that for sure. Some of the later "A" models (like the 684A, 744A, 784A) probably do also. Option and SPC constants are stored on the processor board NVRAM on all TDS models.

author: AwArD_RzD
author_rank: Regular Contributor
timestamp: September 12, 2015, 09:15:27 am
content: Quote from: dxl on August 01, 2014, 06:45:36 amAny one know the exact location in the nvram of these option? I made a programmer/reader in VHDL with my Cyclone V GX starter kit and a custom adapter pcb and i did a backup of the DS1250Y in a M25P40 Serial Flash, now i want to try to "hack" these option to see if i can enable the 1M and the 2C option. Since the NVRAM is a 4Mb device, the address range is 0x0000 to 0x7FFFF very different range than the console example from Dxl. I tried last winter to use the gpib with no success, maybe i don't have the right syntax. I tried to find in the backup a string of data looking like my current option based on the quote from Dxl with no success. Now as a new dad i have some other priority but I will have some time to try thing in 2-3 week so if someone have some clue of where in the NVRAM i can find these option or how i can do that on the GPIB so i can start to prepare for this modification any help will be greatly appreciated.

author: dxl
author_rank: Regular Contributor
timestamp: September 12, 2015, 09:23:05 pm
content: Hi,on the TDS784D i looked at, the addresses where:NVRAM:0400081C 0000 dc.w 0 ; 5 - TV TrigNVRAM:0400081E 0000 dc.w 0 ; 6 - Option 1MNVRAM:04000820 0000 dc.w 0 ; 7NVRAM:04000822 0001 dc.w 1 ; 8 - Option 13NVRAM:04000824 0001 dc.w 1 ; 9 - Option 1FNVRAM:04000826 0001 dc.w 1 ; A - Option 2FNVRAM:04000828 0000 dc.w 0 ; BNVRAM:0400082A 0001 dc.w 1 ; C - Option 2CNVRAM:0400082C 0000 dc.w 0 ; D - Option 3CNVRAM:0400082E 0000 dc.w 0 ; E - Option 4CNVRAM:04000830 0001 dc.w 1 ; F - Option 2MThose adresses could be completely different on your scopes firmware, and i think the data has a checksum associated.Regardsdxl

author: AwArD_RzD
author_rank: Regular Contributor
timestamp: September 13, 2015, 01:33:36 am
content: Thanks !!I retried to send command over the gpib and this time this worked, the option 2C and the 2M are enabled, the only thing i don't understand it's how i know i have a 1M or 2M board, tried both and the it's the same menu, or maybe i don't understand the added memory or limitation.i'm waiting for an another nvram to replace this old one, found out at the last minute that the Nvram replacement i bought a year ago corrupt the content i wrote on it... and the good one i used to test my setup is now in piece because i wanted to see inside.... big mistakenext time i will test them all before doing somethingI will take a snapshot of the new memory and compare it with the original one, i will be good to see the byte used to store the new value, i will post my result to compare to your TDS784D.

author: andy2000
author_rank: Frequent Contributor
timestamp: September 13, 2015, 02:20:37 am
content: I have a TDS784D, and the only thing stored in the DS1286, and DS1250 are the options, error log, and various user data like probe cal and SPC. I think the options are actually in the DS1286, but I could be wrong since it's been a few of years since I worked on my 784D. If you have a way to reset the options, then you don't need to worry about losing the NVRAM. Calibration is stored in a a pair of EEPROMs on the acquisition board.You can tell which acquisition board you have by looking at the size of the SRAM chips. I forget the sizes off the top of my head, but the smaller size has fewer pins than the larger size. If there are unused PCB pads on the SRAM chips, then you definitely have the smaller memory.You can turn a TDS754D into a TDS784D by removing four caps on the acquisition board and rearranging some jumper resistors to change the ID.

author: dxl
author_rank: Regular Contributor
timestamp: September 13, 2015, 06:31:11 am
content: The Option 1M boards have 32 pins AS7C1024 Memory chips if i recall correctly, while the option 2M boards have physically much larger rams in a TQFP-100 or TQFP-128 housing.Regardsdxl

author: klaus11
author_rank: Unknown
timestamp: September 13, 2015, 06:56:09 am
content: Some trick to Hack/upgrade a TDS5052B

author: AwArD_RzD
author_rank: Regular Contributor
timestamp: September 13, 2015, 09:15:42 am
content: Quote from: dxl on September 13, 2015, 06:31:11 amI have 16x MT58L64L32F-7.5A, 64K x 32 , pcb fully populated so i have a 2M board, at first i didn't find any option for the extended memory but it's in another menu, ext acquisition, now i can enable the full 8M sample !! Tek menu are weird sometime, i used this scope for a year now and i still find some new menu now and then.Thank you dxl, next step, programming the new nvram and i will compare the memory content before and after the hack, and i will post my result, at least for my version of the firmware this maybe can help someone who have a programmer but don't have a gpib adapter.

author: Andy Watson
author_rank: Super Contributor
timestamp: September 20, 2015, 03:24:13 pm
content: For the record:I can confirm that pushing "PASSWORD PITBULL", followed by "WORDCONSTANT:ATPUT 327689,1", up the GPIB connector, with the cal-switch enabled, will enable the 2F maths option on a TDS510A.

author: nctnico
author_rank: Super Contributor
timestamp: September 20, 2015, 03:29:57 pm
content: Dammit! I just sold my TDS510A a couple of weeks ago. Having the 2F option enabled might have increased it's value

author: Andy Watson
author_rank: Super Contributor
timestamp: September 20, 2015, 03:45:07 pm
content: Quote from: nctnico on September 20, 2015, 03:29:57 pmI can tell you with 100% certainty that this upgradeworkedwould have worked on your ex 510A.

author: AwArD_RzD
author_rank: Regular Contributor
timestamp: October 16, 2015, 09:18:50 pm
content: Well took more than a month to receive the Nvram but i have some interesting result.Before doing the hack i did a backup of the Nvram so no 2M option or 2C. I did the hack and after everything was unlocked and working. Today i programmed the new Nvram with the original non hacked data and well the option still there after a reboot, so if i didn't by error replaced the original backup with the hacked one i can confirm the option are not stored in the Nvram. Well i don't know really what stored there because i don't have any data mismatch when i compare the two even after 1 month of use and test.Maybe it's all in the te28f160 flash IC? anyway i hope this will help anyone who want to try the hack.

author: andy2000
author_rank: Frequent Contributor
timestamp: October 16, 2015, 09:33:27 pm
content: Quote from: AwArD_RzD on October 16, 2015, 09:18:50 pmI'm pretty sure the options are stored in the Dallas clock chip. The main NVRAM is used for things like stored waveforms, SPC, and probe cal.

author: AwArD_RzD
author_rank: Regular Contributor
timestamp: October 17, 2015, 02:04:32 am
content: Repair threadhttps://www.eevblog.com/forum/repair/tds754d-not-booting-anymore/Well that didn't last long...Did some test worked great power off the scope, take a 1 hour eating break. Baby sleeping still have time to do more test, power the scope go to the bathroom 2 min come back, all the led still on, no screen, no response. Reboot same thing....Reopen the scope led display stuck to .8, if i cycle the unit fast sometime i have a .E , or a .8 .E .8 sequence showing very fast or a weird c (a,f,g segment on).what i did before (for anyone not following this post), Hacked the scope for the 2m 2c option, worked great for a month till today, replaced the ds1250 Nvram by a fresh one with the backup of the old one.Troubleshooting.2 fan blowing on the scope case open.-Tried to cycle the scope many time. Same thing-Replaced the fresh nvram with the old working one. Same thing-All the cable are tight in the right slot.-Waited 5 minute, same state, tried to talk via GPIB, got an error, the scope dosen't reply..Start to read the service PDF.-All voltage OK-All voltage look good on my other scope.-Frequency good at the pin 25 of the J2 connector.-Tried the s1001 switch with the help of some other post on the Tek forum. Same thing.-Tried many combination with other board removed. Same thing.With all the troubleshooting and following the flow chart the only thing this manual screaming is Replace the A11 DRAM Processor/Display module.Checked the thermal signature with my E4 and nothing weird show up... No cap leak and nothing out of place visually.I have the impression that the cpu is stuck on reset or briked. I tried to probe the Nvram to see if the CPU toggle the CSn pin and nothing happen.....damn.. never again ... if it ain’t broke, don’t fix itFor now i have a 16 Kg paper weight, if someone have an idea....

author: Mosaic
author_rank: Regular Contributor
timestamp: February 14, 2017, 04:10:01 pm
content: need advice on replacing nvram on a 694c. anyone has pics or a clip doc.? mine is still alive.

author: Vince
author_rank: Super Contributor
timestamp: July 29, 2017, 07:50:37 pm
content: Any news on this repair ? Been almost 2 years since the last message, but none the less I am still curious about it ! Were you able to repair it in the end ? What was the cause of problem exactly ?

author: PrecisionAnalytic
author_rank: Regular Contributor
timestamp: January 18, 2018, 07:12:09 am
content: Quote from: AwArD_RzD on October 17, 2015, 02:04:32 amEh, any progress?

author: AwArD_RzD
author_rank: Regular Contributor
timestamp: August 28, 2018, 01:12:05 am
content: Sorry for the late reply but life and stuffI still have the scope but unfortunately it still broken, I bought another TDS754 and i have keep the dead one for spare part.For what i remember i was able to talk to it via the serial interface (the hack where you use the CPU board edge connector with the serial interface) so i'm sure that the Cpu was not dead but it seem that i maybe zaped something or did some damage to a IC inside when i have put the scope back in is case.I found that someone replied to me in the TEK forumhttps://forum.tek.com/viewtopic.php?t=138426I remember to have seen that but i never completed any troubleshooting because i had my first child and it seem time fly when that happenSo it seem that the problem is or affect video memory on the cpu board from the log i posted.I'm about to buy a house, i will have more space and i will probably dust off the scope and look at it again on the side but for now i'm designing a power amplifier and this take much of my time and bench space. In the last 3 year since the problem i was able to get many stuff about the scope (PDF, Schematic) that i didn't have in 2015. The price for used part seem to have lowered too maybe i will buy the cpu board and see if it boot and start from there.I'm not very active on this forum (well on any forum) so i don't except to post any update soon but i will give update when i go for it.Thanks for the interest.

author: Vince
author_rank: Super Contributor
timestamp: August 28, 2018, 09:40:29 am
content: Thanks for the update

author: madao
author_rank: Frequent Contributor
timestamp: May 22, 2019, 07:25:03 pm
content: Quote from: AwArD_RzD on August 03, 2014, 03:57:18 pmToday have i using this tools.Dumping of NVSRAM , it run fine.But writing of NVSRAM: corrupte fileI have desoldering DS1486 and writing him with TL866A (choosing DS1245Y ) and it is a success.(Wrong time is not really a problem :-).O'scope is TDS754D with old acquisition board (C-Typ, 672-4041-00) and new CPU Board (671-4349-00) FW: 6.6eregardsMatt

author: Krisztián
author_rank: Contributor
timestamp: October 04, 2025, 06:38:56 pm
content: QuoteI know it's been seven years since your last message, but maybe you've found a solution. I am still interested in these scopes. So I would really appreciate it if you could write a few lines about what the situation is now.