Pimp my scope: Unlocking Software Features in a Tektronix TDS784D

By | 3 Feb 2022
0 Comment

A while ago I’ve acquired an old Tektronix TDS784D oscilloscope. Originally, it came with these enabled options:

  • 05 – Video Trigger
  • 13 – Centronics and RS232 interface
  • 1F – Floppy disk drive
  • 1M – Memory upgrade x1
  • 2F – Maths/FFT1Fast Fourier Transformation, differentiation features

While this already is a lot, there’s still option 2C (Comm signal analyser) which is a pure-software option. (In later production runs, the device might also already contain the necessary hardware for the bigger memory option 2M. Check whether your serial number starts with B4xxx. Mine didn’t.)

Some day I’ve discovered a thread about enabling options over on the EEVblog Forums. There, it was said you’d need either console access to the mainboard or a GPIB adapter.

While there are ways to reuse the Option 13 interface board for said console connection, I didn’t need the remaining option that much. (Read: I was lazy.) And a USB-to-GPIB adapter still goes for 100+ € which is a bit much for this one-time experiment.

Half a year later I stumbled upon this thread about a memory dumping/writing tool working via the floppy drive. The thread also explains how each option is a word value in memory – either a 00 00 (option disabled) or a 00 01 (option enabled) and gave memory addresses for the scope series.

So one way of enabling that option would be to dump the memory area, change the bits and write back the modified data to the scope. While preparing all that, I’ve noticed that the tdsNvramFloppyTools “apps” are actually just some sort of plaintext script files and also, that they’re using a command GpibInput("xxx") which seems to send exactly those commands you’d normally send via the GPIB interface.

If you checked the first forum thread above, you’ll probably remember the WORDCONSTANT:ATPUT command you can push via GPIB to modify memory contents. Well, as it turns out, you can also send that command from within such APP file using the GpibInput() command.

So I’ve put together a small APP:

nulldev = open("/null",3,0666)
taskSpawn "Redirect",1,0,0x4000,ioGlobalStdSet,1,nulldev
taskDelay (100)
GpibInput("WAITICON OPEN")

GpibInput("mess:box 80,80,450,200")
GpibInput("mess:show \"\n\n\n\n Unlocking Option 2C for TDS 784D in 6 seconds.\n\nPOWER OFF NOW IF YOU HAVE DIFFERENT SCOPE!\"")

taskDelay (600)

GpibInput("PASSWORD PITBULL")
GpibInput("WORDCONSTANT:ATPUT 327692,1")

GpibInput("mess:show \"\n\n\n\nOption unlocked. (If not, check NVRAM protect switch!)\"")

GpibInput("WAITICON CLOSE")
GpibInput("bel")

I’ve stored this as UNLK_2C.APP on a floppy (well, virtual floppy), used the scope’s file manager to navigate to the disk, switched the NVRAM-protect switch to the OFF position and ran my app. After that finished, I flipped the switch back to the normal position and restarted the scope. When it came back up, I was greeted by this screen:

I’d call this a success.

  • 1
    Fast Fourier Transformation

Leave a Reply