Reverse Engineering TDS2CM/TDS2MM - Page 1
Forum section: electronics / testgear

author: sd_tony
author_rank: Contributor
timestamp: March 02, 2022, 02:06:00 am
content: Inspired by the genius guys who reverse engineered TDS3GV/TDS3EM and created a module to bring out RS232 and other interfaces on other thread, I'm trying to start a new thread for reverse engineering TDS2CM/TDS2MM for TDS200 series scopes.TDS200 series could be one of the most popular scopes for beginners and hobbyists, there are still lots of used one available and are affordable for beginners, however, the monochrome display with 320x240 display is kind of outdated, an extension module (TDS2CM or TDS2MM) is needed to have RS232/Centronics/GPIB interfaces to send data to PC for better vision/processing, however, these extension modules are still very expensive these days. TDS2CM can be hacked to TDS2MM to have some additional features like FFT, rising time measurement etc., but that still doesn't justify the high price.The goal here is to create a low cost and easy to make module by reverse engineering existing TDS2CM/TDS2MM module, more modern and cheaper parts can be used to create the module without having to find the vintage parts created in 90s.By looking at the pictures of TDS2CM/TDS2MM, it's not difficult to create a block diagram to understand how it works. Basically it has a UART transceiver + MAX238 for RS232; a NI 488.2 controller for GPIB, a 8-channel D flip-clop (and two PALs?) for Centronics, as well as PROM, SRAM, and a HTC245 chip. The TH245 chip might be the one-byte ROM as module ID as descripted on the other thread.Two things I'm still not very clear here:1. why does this module has PROM and SRAM? there is no processor on this module, so the PROM and SRAM can only be used by the processor on scope controller board, does that mean the processor in scope will run the code stored in this module and utilize the SRAM as well? that looks strange though.2. I'm not sure about the purpose of the two PAL chips, I guess they are some logic chips to convert CPU 8-bit data to printer acceptable data, but if that is not the case, and they involved in interface communication that will be a nightmare because we will need to reverse engineer them.Anybody has done similar thing before? any ideas/clues/hints/comments are welcome.

author: oPossum
author_rank: Super Contributor
timestamp: March 02, 2022, 03:01:29 am
content: I did some poking around with a multimeter...U103 74HCT245 is the data bus bufferU202 74ALS374 is the parallel port data latchU203 PALCE16V8H is used for the parallel port control signalsU104 PALCE16V8H is probably address decoding for ROM, RAM, and I/O chips (didn't trace all of the pins)Everything is on the bus of the 68k CPU. The firmware in the module extends the firmware in the 'scope. The additional RAM is probably needed for various buffers.Making an exact or functional equivalent is certainly possible but it will cost far more than just buying one.

author: sd_tony
author_rank: Contributor
timestamp: March 02, 2022, 04:42:03 am
content: Thanks your quick response, glad to know that one PAL is for parallel port, and the other might be for address decoding. Do you happen to still have the poking results, for example, the signal name on the 50-pin connector? That will be very helpful for me to start with.To save cost, I'm not going to make a exact same module, parallel port and GPIB will be removed, only serial port + PROM (can be replaced by flash) and SRAM should be enough. Hopefully the firmware in scope will not check if GPIB controller exists or not.Block diagram has been updated based on your information, thanks again.

author: coromonadalix
author_rank: Super Contributor
timestamp: March 02, 2022, 06:20:53 pm
content: I have a TDS2MM in one scope at my jobfor a start, but i have tons of work at my job cant play to long in it in a day ...db9 to u201 MAX238db9-7 to pin 1db9-3 to pin 2db9-2 to pin 3db9-8 to pin 7db9-4 to pin 24db9-6 to pin 23db9-9 Ring doesn't seem connected ??db9-1 DCD doesn't seem connected ??u201 (MAX238) pins going into u200 (scn68681c1)u201-4 to u200-35

author: sd_tony
author_rank: Contributor
timestamp: March 02, 2022, 10:12:46 pm
content: Thank you coromonadalix! can you help probe the signals between 50-pin extension connector and ICs like U200, U202, U203 and U104? we will be more interested in the connections between this connector and the controller ICs/ROM/RAM on board. oPossum mentioned that U103 is data buffer, so probably the data port of seral controller, parallel buffer, and GPIO controller will be connected to U103.

author: oPossum
author_rank: Super Contributor
timestamp: March 02, 2022, 10:32:04 pm
content: I just traced the PALs to the chip selects and parallel port. I didn't trace anything to the 50 pin connector because I don't have a pinout for that.

author: coromonadalix
author_rank: Super Contributor
timestamp: March 02, 2022, 11:56:19 pm
content: ooooooh i can work faster with that schematic i'll try to complete it to the 50 pin header pls be patient a littlethksi'll check to make a dump of the eeprom since its socketed ..... but for the pal's its another story, i can not damage the card ....

author: sd_tony
author_rank: Contributor
timestamp: March 03, 2022, 12:21:06 am
content: Great! that really helps! I just opened my TDS210 and probed the signals on 50-in extension connector. Most of signals are from 68K CPU except pin-33, pin-35, pin-45 which are connected to ASIC (U201 MM9527-VCE). I guess one of these pins are card detection, and the others may be interrupt some some other control signals.OPossum or coromonadalix, can you help find out where these three pins are connected to on TDS2CM/MM module?

author: daisizhou
author_rank: Super Contributor
timestamp: March 03, 2022, 09:59:59 am
content: Sir, is TDS-2012C supported?

author: oPossum
author_rank: Super Contributor
timestamp: March 03, 2022, 10:29:24 am
content: U205 is a 28C64 EEPROMMostly complete schematic attached

author: sd_tony
author_rank: Contributor
timestamp: March 03, 2022, 04:54:03 pm
content: Awesome, oPossum! can you quickly double check that P45 is really left open or it is actually pulled to ground (or to VCC, very unlikely though) through a 5K or 10 resistor? this pin is the only one which can be used as card detection signal, or else how does scope know the extension module is connected? by reading RPOM directly? it's possible, but not a typical design.

author: sd_tony
author_rank: Contributor
timestamp: March 03, 2022, 05:00:57 pm
content: Quote from: daisizhou on March 03, 2022, 09:59:59 amNo, looks like TDS2CM/MM is for TDS210/220/224 only, TDS2012 has different extensions to support GPIB and other interface

author: oPossum
author_rank: Super Contributor
timestamp: March 05, 2022, 05:39:59 am
content: Pin 45 is open - does not go anywhere. Checking for a signature in the PROM is a much more robust way to detect the presence of firmware than just looking at a single pin. The PROM can be validated with a checksum/crc to ensure the entire contents are accessible and valid.The HP 5465X series modules for many early 90's HP DSOs have 0x5A5A in the first word. An A series DSO will see this signature and then use the firmware in the module. The later B and D series DSOs will see the signature and then enable supporting firmware within the DSO. They don't use any of the firmware in the modules. This allowed modules that where already in production to be used with the newer DSOs.Tektronix revised the TDS2CM firmware to create the TDS2CMA for the new TDS1000/TDS2000 series. The later B & C series eliminated the module slot and added USB. There isn't a TDS2MMA because the measurement capabilities became a standard feature.

author: sd_tony
author_rank: Contributor
timestamp: March 21, 2022, 07:26:20 pm
content: according to Tek programmer manual, looks like TDS2CM works for TDS200, TDS1000 and TDS2000 series, but not 1000/2000 B and C series. By the way, what are the difference exactly between TDS2CM, TDS2CMA and TDS2CMAX? only firmware different? they all look similar physically.TDS2CM already works with TDS1000/2000, why they created TDS2CMA and TDS2CMAX?

author: sicco
author_rank: Regular Contributor
timestamp: March 21, 2022, 08:28:58 pm
content: There was something similar with the tds3000 and the TDS3EM ethernet module: the -b and -c tds3000 scopes cannot accommodate a tds3em plugin because the scope resident PHY hardware was added to the -b and -c mainboard / power supply. The ttl level i/o pins for Ethernet PHY chip on the plugin module were thus already occupied in the later -b and -c scopes. A plugin module in a -b or -c scope that tries to drive those pins, will end up battling the logic output that is already wired internally to that pin. So neither driver will win and both Ethernet sockets will no longer work when plugging in that module. (actually, -b and -c. scope will refuse to boot when it sees that plugin module is inserted).

author: oPossum
author_rank: Super Contributor
timestamp: March 21, 2022, 08:42:15 pm
content: TDS2CMAX is a bundle with cable and software. Same hardware as TDS2CMA.TDS2CM and TDS2MM will only work on TDS210/220/224

author: sd_tony
author_rank: Contributor
timestamp: March 24, 2022, 03:58:29 am
content: Ok, does anybody has TDS2CMA firmware? my PCB board will be available this weekend, and I'm going to find out if TDS2CM and TDS2CMA are based on same hardware and just with different firmware.

author: sd_tony
author_rank: Contributor
timestamp: March 30, 2022, 03:03:20 am
content: Finally the PCB board arrived, after quickly put everything together, and twist the PLD firmware couple of times, it works finally. The scope identified the module as TDM2MM, it can be TDS2CM with corresponding firmware. As you can see from image, I removed parallel and GPIB port, and changed RS232 to USB port by adding a UART to USB bridge chip. With the module installed, now my TDS210 supports FFT, rising/falling time measurement as well as positive and negative pule width measurement. With the PC tool "TekScope Utility" I can get screen hardcopy, waveform, and measurements on PC, basically this module functions just like a real TDS2MM.I have couple of spare PCBs, I'm going to list them on eBay, not to make money, but to let those who sell TDS2CM with crazy price know that this module can be made with only 1/3 to 1/5 of their listing price, and hopefully they can lower their price to a reasonable range.

author: sd_tony
author_rank: Contributor
timestamp: April 20, 2022, 10:21:51 pm
content: Does anybody has a spared blank module cover? like the picture below? somehow my scope doesn't come with this cover, looks like this cover can hold a PCB, so if I can change the width and height of the PCB board, and cut a square hole on the cover for USB connector, it will fit.

author: sd_tony
author_rank: Contributor
timestamp: May 03, 2022, 04:12:33 am
content: Finally I got a blank module cover, and cut a square hole to let USB connector through, the new designed PCB perfectly fit the module cover which has all the hooks/clamps to fix the PCB board.

author: firefly-10
author_rank: Newbie
timestamp: June 27, 2022, 11:02:50 pm
content: really a super thing. I have a TDS 1002 and if I have read correctly, this module should also work on the oscilloscope.Only where do you get the parts you need, like the board (the layouts) and the programmed components?Is there any more info about the project ?GreetingsDirk

author: sd_tony
author_rank: Contributor
timestamp: July 14, 2022, 03:26:08 am
content: Yes, it should work for TDS1002 although I don't have such a oscilloscope to try.The parts are ordered from Digi-Key and eBay, mainly RAM, FLASH, data buffer, UART transceiver, and USB to UART bridge, the most difficult part to find is the 50-pin 2mm pitch connector, it's rare and expensive.PCB layout can be designed by some free tool like KiCad, but you will need dimensions of a real TDS2CM card to make sure the board you designed has the same outline so that it will be able to fit into the cover. You can send Gerber to some PCB vender like JLC, they can get back to you in one week.The firmware (TDS2CM and TDS2MM) for FLASH can be found in this forum, but you will have to make the image for PLD (ATF16LV8) by yourself, that's the most challenge part, this PLD has couple of functions including board ID, address decoder, as well as emulated GPIB controller. To save cost there is no GPIB transceiver on this card, but oscilloscope will check it during boot, so you will have to find a way to fool oscilloscope that the GPIB transceiver does exist, just no GPIB device connected all the time, otherwise, the oscilloscope will hung during boot.It's fun to remove all of these rocks on the road to make it through, I'm not sure if I can share all the source files (schematic, PCB layout, gerber, PLD image etc.) in this forum, but it will be expensive if you just want to make one module (still much less than the price of the TDS2CM card listed on eBay).

author: sd_tony
author_rank: Contributor
timestamp: July 14, 2022, 03:46:44 am
content: by the way, to further save the cost, I created a TDS2MM only module, it removes UART transceiver and UART to USB bridge, so it will not be able to support any communication function, but will enable FFT and rise/fall/positive pule/negative pulse measurement functions for TDS210/220/224 oscilloscope. The PCB board is similar just with different PLD image and without UART/USB related parts installed.

author: TERRA Operative
author_rank: Super Contributor
timestamp: August 21, 2022, 04:57:19 pm
content: What version of the original Tek firmware do you have for the TDS2CM and TDS2MM modules?The latest I have found is 1.04 for both. If you have a later (or other version) do you mind uploading it here?Thanks!

author: SoloTek
author_rank: Newbie
timestamp: August 27, 2022, 04:58:11 pm
content: Would it be possible to upgrade the low-cost module later on by populating the missing componets? Perhaps I find an UART somwhere in my scrap binBtw, how do you emulate a GPIB controller with less than 8 product terms? (if I read the ATF16LV8 correctly?)Thanks!

author: sd_tony
author_rank: Contributor
timestamp: August 27, 2022, 10:32:57 pm
content: Mine is 1.04 for both as well.

author: sd_tony
author_rank: Contributor
timestamp: August 28, 2022, 09:46:15 pm
content: Quote from: SoloTek on August 27, 2022, 04:58:11 pmThat is possible, actually the PCB version of the "low-cost" module is V2.2, it can be a full functional module, or a math only module (without communication), depends on the firmware in PLD.To emulate a GPIB, you don't have to create a full functional controller, instead, you just need to know which register the scope is looking at during boot, and send the valid data back when scope is reading that register, in this way, scope will believe GPIB does exist, and with no slave device connected. Same thing can be done for UART controller, that is why the UART controller can be omitted on the math only module (or "low-cost" module).

author: uski
author_rank: Frequent Contributor
timestamp: September 03, 2022, 02:52:42 am
content: Quote from: sd_tony on March 02, 2022, 02:06:00 amMy first scope was a TDS210 with a TDS2MM. It was great, back in 2000.But today, realistically ? They have abysmal sample memory size (2500 points per channel), lack many features such as protocol decoding, only have an 8 bit ADC, as you mention the LCD is pure crap, and even the FFT sucks. USB communication was slow as hell, I remember screenshots were taking a while and I had to simulate a printer. Their firmware cannot be updated (although I agree, there are little to no bugs - but there are also no features...), and they have their quirks (common issue is a hardware failure of the BNC ports).I don't want to discourage the effort by any means as I love to read about my first scope and see creative projects, but I really wanted to warn beginners - the going price is around $150-200 these days, apparently.Even at this price, there are better options like a Hantek DS2C10 ($189, yeah it has some bugs, but so many more features, can be modded, same bandwidth and higher if you mod it, integrated basic AWG for $20 more, USB host for screenshots, it's a new scope and not a 20 years old unit that can start to have its CCFL-backlit display failing ...), and with only a bit more you can get a Rigol DS1054Z or a Siglent which is even one step higher.I would not advise a beginner to buy a TDS210/TDS220 these days... I would not call it the perfect beginner scope in 2022... Just wanted to share a contrasting opinion.Now, let's go back to the TDS2CM/MM.

author: TERRA Operative
author_rank: Super Contributor
timestamp: September 03, 2022, 03:36:48 am
content: You certainly can upgrade the firmware.Well, on the earlier models at least, all you need is a chip programmer and a replacement PROM chip.I'm still figuring out how on the late model ones that use flash memory, but I need to get my hands on more of those to play with.

author: uski
author_rank: Frequent Contributor
timestamp: September 03, 2022, 09:15:32 pm
content: Ah yeah that's right. I had two boards on hands for my scope. One of them was an earlier revision and looked very different than the later revision.If I recall properly, the first one used PLCC chips while the other one used SMT chips. Maybe they also switched from EPROM to FLASH too.

author: mtk
author_rank: Contributor
timestamp: January 05, 2023, 12:00:33 pm
content: And why you haven’t published the final TDS2CM/TDS2MM module schematic and PLD image files ? 88.27 USD (shipping included) for TDS2CM/TDS2MM module with USB seems quite a lot, considering that whole oscilloscope is sold for around 100 USD. To mention not that a WiFi edition can be made.

author: coromonadalix
author_rank: Super Contributor
timestamp: January 05, 2023, 12:43:52 pm
content: Check their "original" pricing .... on fleabay and the most ridiculous prices for some of them loll you have one in the 300$ range?

author: mtk
author_rank: Contributor
timestamp: January 05, 2023, 03:10:14 pm
content: My point is different. This person sd_tony created this topic - Reverse Engineering TDS2CM/TDS2MM. Posted one schematic that is marked as: not complete nor correct and stated look I am selling those modules on eBay. I do not think that this is correct practice and it is kind of misleading that actually this topic provides any useful data or information.

author: coromonadalix
author_rank: Super Contributor
timestamp: January 05, 2023, 04:08:49 pm
content: good point, if the OP got help here to built / decode the original(s) modules and sell them ....We've been had in a way ...

author: sd_tony
author_rank: Contributor
timestamp: January 24, 2023, 04:38:42 am
content: This module is way complicated to make than what you thought, I ended up bought two TDS2CM modules with $100+ each, and reverse engineered them completely by myself, please remember that you will need to decode the PLD on the original module, and find out what exactly the firmware is doing during scope boot and during RS232 communication, the 1st TDS2CM module was broken after too many experiments, and I have to bought another one to continue my project.Picture attached is the 1st prototype I made to verify the concept, as you can see that there are lots of blue-wire to correct the mistake and verify the solution. I can give you an example how difficult to debug the issue encountered: after the module finally can be recognized by scope, the communication with PC is not stable somehow, sometimes it can be identified by PC, sometimes not, that frustrated me a lot. After weeks of debug, it ended up that the UART transceiver (SCN68681) has a limitation which requires the serial resistance of 3.6864M crystal to be <180 ohm and the shunt capacitance to be < 15pF, otherwise the oscillator may have power-up failure. after trying couple of different type of 3.6864M crystals, I finally found one that perfectly meet the requirements.After this issue got resolved, I realized that this module is component depended (PLD and UART transceiver etc.), it can't be simply reproduced with schematic and PLD firmware, if somebody want to create one as what I did, he may encounter different issues which I may not be able help because I don't the exactly same hardware he has, not even mention that it's not worth to just make one module from cost perspective.

author: mtk
author_rank: Contributor
timestamp: March 05, 2023, 07:46:22 pm
content: @sd_tonyIn my opinion your concept is wrong. This whole module including the PROM and RAM can be emulated on fast MCU like ESP32 and have additional capabilities like WiFi, Bluetooth, USB connectivity as well as internal storage on SD card.It is disappointing that some prefer to keep their findings instead to share with the community and make better projects.On the other hand, currently there are much better offers on the market. For example, I found recently an offer for Owon SDS 7102V - 155 €, large color display, USB, Ext, LAN, VGA even possibility to use an internal battery.

author: Fieroluke
author_rank: Contributor
timestamp: November 18, 2023, 06:16:06 pm
content: Interesting thread!Inside the TDS2000C series there is an unpopulated 50 pin connector that could be installed, and I assume the pinout is probably at least compatible.Since the B-version firmware works on the C-series, I wonder if the old expansion modules would be recognized.For instance adding a printer or serial or gpib. I know the 2000C has USB, but I’m curious…

author: djwilly
author_rank: Newbie
timestamp: March 22, 2025, 02:53:53 pm
content: Hallo Tony, great work, did you stop selling this Modul, or where can i find it?