Hacking my TDS460A to have options 1M/2F? - Page 1
Forum section: electronics / testgear

author: TriodeTiger
author_rank: Regular Contributor
timestamp: August 02, 2014, 09:31:51 am
content: I was extremely excited when I scored a Tek TDS460A on eBay for <$300 (to be reviewed and internals exposed some day soon) but learned it didn't have the memory option (and 2F, for DSP and math) so I couldn't do FFT I looked forward to for basic stuff (granted, I could record it on a spreadsheet and plot an FFT in matlab, rinse and repeat, but...)I then learned that at least on the 540A/7xx, it is a software option:http://www1.tek.com/forum/viewtopic.php?f=5&t=5526&p=10588&hilit=pitbull#p10591I realised then that I haven't ever seen "hardware option" having anything to do with options 1M (memory) or 2F!Do you think it's possible to upgrade it? The 540 looks purely like the next in the family, not some significantly different scope. unless i'm wrong, i guess i'll need to find a GPIB card and an ancient computer with an ISA bus to run the console program (yuck) , so if anyone has pointers on anything, shoot.

author: AwArD_RzD
author_rank: Regular Contributor
timestamp: August 03, 2014, 09:24:08 pm
content: I'm in the same boat as you but i still don't have my TDS754d and my GPIB adapter yet.There many information on the Tek forum about these series of scope, it seem you can check your board to see if you have some un-populated pad where you can define if you have the memory in hardware to do the software hack. I don't have the link unfortunately. (checked too much page in the last 2 day to remember where).Check this image, this will give you an hint where to find the memoryhttp://green-magic.nl/Download/TDS460A/TDS460A-3.jpgit's at the right of the 2 big QFP, check the data sheet and calculate how much memory you have. (the original pagehttp://www.circuitsonline.net/forum/view/94488/1/condensatoren+waarvoor?query=condensatoren+waarvoor&mode=or, i don't know what language it is but you can always translate it maybe he tell the option he have).On my part i will un-solder the NVram do a backup and try to change the memory where the option should be, well Trial and error is the key when you don't have any useful info.

author: TriodeTiger
author_rank: Regular Contributor
timestamp: August 05, 2014, 09:38:03 am
content: Your reply means a lot to me, it got me interested in getting my hands dirtyHere's a comparable shot:(note: mine is from early '95, theirs late '97 going by the dates on the memory. I guess theirs is revision 3 judging by the URL name.)QuoteThere's 16 32Kx8 SRAM = 4MI learned from the service manual, that the CPU assembly is within the unused option slot. It makes sense, as there's a battery attached to it for backup and all.I'm guessing the upgrade is purely those unpopulated SRAMs (+6MB), as the machine itself uses up a significant portion of the 8M on there. As a bonus at least, the RAM appears quite cheap onfleabayThink I should splurge and try installing those, or do they look like for something else maybe? at least it looks like the pads, from the reflow, have a hefty amount of solder to sink the ICs in to once I get them. I guess then I'd have to either educate myself on how to read NVRAM (I'd hope an Arduino could help, heh.) and hack away at it, as it seems to be the cheaper option than making some sorta GPIB rig.

author: TriodeTiger
author_rank: Regular Contributor
timestamp: August 06, 2014, 08:31:12 am
content: From all I've read with similar stories to mine, it was a firmware switch, and the specific offset appears to be the same among many 4/5/6xx scopes so I have hope for that. 0x50006 for 1M, -09 for 2F.So... a little help is required!1. Hackery:On the CPU board, there is a battery attached to a DS1211 (a non-volatile SRAM controller) and 4 1MB SRAMs, under a load of gel-like conformal coating nonetheless (yuck.)So..To muck around with the NVRAM, with a programmer/'duino, what is my course of action? Can I fly some leads in to one of the SRAM and is it simply cascaded with the others? Do other scopes have a configuration like this, and how to do they back theirs up? (can't find any actual specifics on the process..)2. GPIB:I just looked at GPIB-to-USB adapters and they all look *pricey*and I'm assuming RS232 ain't gonna touch the firmware.I no longer have a computer with an ISA/PCI slot, for a GPIB card, but that might come out to the same as the USB option. Are the people doing GPIB using one or the other or something more clever?3. Be happy with what I've got.nah.

author: AwArD_RzD
author_rank: Regular Contributor
timestamp: August 06, 2014, 11:56:06 am
content: Well you don't have many choice, since everything is soldered on the board you will need to find a way to extract the content before messing the memory content, DXL posted a link on my topic for my tds754dhttp://stackframe.org/tektool.shtml,to read the content via the GPIB.Maybe you can use the source code modify it to fit your need. Since i can de solder my nvram (i have one like thishttp://www.ebay.ca/itm/251245225991?ssPageName=STRK:MEWNX:IT&_trksid=p3984.m1497.l2649), i will not mess with software and code so i can't help you with this method.You can always buy a FPGA dev kit (like the de0 nano) and find the schematic of your scope write vhdl/verilog to extract and re upload the data, tap the signal on the bus and extract the content of the nvram to the FPGA SDRAM (be aware of the logic level!! the de0 nano is 3.3v so a level shifter will probably needed) . So if the offset is wrong and your scope brick or do weird thing you will have a some kind of "backup". This is a realy good project if you want to have fun.But i'm sure there a better way somewhere, maybe tektronix had a tool to read/write the content??If you look for a GPIB adapter Wuerstchenhund posted a fully Agilent compatible clone in my posthttp://www.ebay.ca/itm/S82357-GPIB-USB-interface-Agilent-82357B-compatible-/171387561919, for my part i bought the F version it's 10$ more and they say it's faster, but it still in the mail so no review for now.

author: David Hess
author_rank: Super Contributor
timestamp: August 06, 2014, 12:42:59 pm
content: Since the oscilloscope is working, I would be leery of physically damaging it and restrict myself to non-invasive procedures while attempting to activate the options.

author: vaualbus
author_rank: Frequent Contributor
timestamp: August 06, 2014, 04:11:22 pm
content: I will nor try to do this.On The TDS scope the think you read for the option 1M is only workinf on some scope not all, for example my no revision TDS540 scope the trich didn't work. At the I found a sram image for the TDS540 which have option 1M and 2F enable and use that.Also is impossible that the scope have 4M of memory is too high.And the trick is done by using the console port that I don't know if in your scope is presenteand the command would be different.You coould lost all the calibration data If the procedure fail.On the TDS500, 600, and 700 If you lose the cal data there is a way to restore the original factory data but I don't know If also work on the previous scope.Also I think you overpaid a little bit the scope I would have buy a TDS500 (I buy mine at 250$ but broken, follow my posts on it If want to see how I repair it) instead.Also check and change all the caps they leak a lot.

author: nctnico
author_rank: Super Contributor
timestamp: August 06, 2014, 05:27:16 pm
content: I agree. The locations (addresses) for the options are different for different series of scopes. People tend to track them by analysing what the firmware reads from the NVRAM during startup using a logic analyser. That is a lot of work.

author: vaualbus
author_rank: Frequent Contributor
timestamp: August 06, 2014, 10:54:32 pm
content: Ya a lot of work and we even not know If the scope run like the TDS540 vxWorks.So you have to connect a logic analyzer on the bus and try reverse enginiring the os call.Very hard work I don't know If it the best think.Sell the scope and buy a TDS540 whith the option installed and you havte the FFT less work to do!

author: Watermelon
author_rank: Contributor
timestamp: August 06, 2014, 11:08:53 pm
content: Try to read out the NVRAM contents and drop it here. I upgraded my TDS520A with the options 1M/2F, it shouldn't be too hard finding the right adresses to edit.

author: TriodeTiger
author_rank: Regular Contributor
timestamp: August 07, 2014, 08:23:17 am
content: Quote from: vaualbus on August 06, 2014, 04:11:22 pmFor $300 I got the scope in great condition, the original operating manual and 4x 400MHz Tek branded probes - I think I struck eBay gold, actually! I can sell the scope for double that (just guessing, most of them appear to sell for that) and keep the probes if anything.Quote from: AwArD_RzD on August 06, 2014, 11:56:06 amThe code appears to be using a C GPIB library, so I guess they wouldn't read the $65 GPIB-USB adapter, maybe, since they just make a serial port. I guess maybe in the end, it's the decision to spend $100 on an adapter (yuck) to get a low bandwidth spectrum analyser w/o a tracking gen, pretty much, when I might consider getting a real one. Hmmmmm...

author: abyrvalg
author_rank: Frequent Contributor
timestamp: August 07, 2014, 05:39:56 pm
content: Is there any menu to enter something like an "option key"? We can try MDO3k/TDS7k "trick"

author: drforbin
author_rank: Regular Contributor
timestamp: October 18, 2014, 05:15:21 am
content: Hi...I just bought and fixed a tds520...I'd like to enable option 2f fft calculus. Can anyone give me the procedure?

author: TriodeTiger
author_rank: Regular Contributor
timestamp: October 21, 2014, 11:10:28 am
content: Quote from: drforbin on October 18, 2014, 05:15:21 amLooks like either: expensive cable, or expensive mistake (if yours has conformal coating like mine, as in removing it to access the NVRAM) - although it'd be fun to see somewhat-realtime somewhat-accurate FFTs, I still have the option to just transfer the data (ugh) by floppy () and calculate in MATLAB. I guess if I did get the cable, I could both do remote transfer of the data and modify the flash. Hm. Maybe one day. Spent too much on this hobby for the year though, moving on to guitarOh wait, now I must build many'a amplifier..

author: icezebra
author_rank: Contributor
timestamp: April 12, 2025, 04:53:09 am
content: Hi I realize this was a long time ago, but were you successful?Thanks to the work done by Tom Verbeure I was able to successfully upgrade a TDS460A to add options 05, 2F and 1MFor reference here are the definitions of TDS4xx Series scopes option upgrades:Option 05:Video TriggerOption 13:RS-232/Centronics Hardcopy InterfaceOption 1F:File System/FloppyOption 2F:Advanced DSP MathOption 1M:120k waveform sample pointsIn order to complete the upgrades 05, 2F, and 1M I followed these instructions (which I notice also link to the OP here!):https://tomverbeure.github.io/2020/07/11/Option-Hacking-the-Tektronix-TDS-420A.htmlAlso here is a video of someone else who did the same thing!https://www.youtube.com/watch?app=desktop&v=ttm8kcWTSJ8I bought the memory chips at Ali-Express. Make sure you get '-70LL"The store I bought the chips from is no longer in business, but here is one possible source:https://www.aliexpress.com/item/1005008367658429.htmlAlso, if you order only two per order, the shipping cost is often much less.I enclose photos of the circuit boards, options and self test outcomes in case that is helpful to anyone wishing to attempt this repair.IMPORTANT: Notice that that battery remained connected for the duration of this procedure.

author: icezebra
author_rank: Contributor
timestamp: April 12, 2025, 05:01:32 am
content: Photo of options after memory upgrade