Cloning Tektronix Application Modules.pdf

(1)

Hackaday

Cloning Tektronix Application Modules

July 28, 2014 By Brian Benchoff

Tektronix’s MSO2000 line of oscilloscopes are great tools, and with the addition of a few ‘application modules’, can do some pretty interesting tasks: decoding serial protocols, embedded protocols like I2C and SPI, and automotive protocols like CAN and LIN. While testing out his MSO2012B, [jm] really like the (limited time) demo of the I2C decoder, but figured it wasn’t worth the $500 price the application module sells for. No matter, because it’s just some data on a cheap 24c08 EEPROM, and with a little bit of PCB design it’s possible to build this module for under $5.

The application module Tektronix are selling is simply just a small EEPROM loaded up with an SKU. By writing this value to a $0.25 EEPROM, [jm] can enable two applications. The only problem was getting his scope to read the EEPROM, a problem easily solved with a custom board.

The board [jm] designed is available at OSH Park, with the only additional components needed being an EEPROM, a set of contacts for reading a SIM card, and a little bit of plastic glued onto the back of the board for proper spacing.

Hacktek

hacktek - Tektronix Application Module Hack

I purchased a new Tektronix MSO2012B Oscilloscope and quickly found utility in the demo I2C decoder for when I need to diagnose the failed controller in my hot tub. Before the demo period expired, I decided that the capability was rather compelling but didn't have money to purchase the actual application

modules. This scope is used purely for hobbies and will never make a buck. After scraping the internet (and Google Translate) for information about this scope, I was able to produce my own Application Modules. It was a whole lot easier than I expected it to be.

After some investigation and trial/error I found that each application module can be enabled with up to two applications by writing the SKU of the application module (SKU can be found on the Tektronix website) onto a 24c08 eeprom.

Once this was proven, boards were created at OSHPark, a few parts purchased from Digikey and I now have a rather capable device.

(2)

board published on OSHPark

1x Haktek Module ($3.00) - https://oshpark.com/profiles/mchamster 1x 24c08 ($0.25) - Digikey - 24LC08BT-I/OTCT-ND

1x Sim holder ($1.50) Digikey - 609-1401-1-ND 1x Spacer - Free

The 24c08 goes on the back of the board while the SIM holder will need to be trimmed to fit onto the board. Program the 24c08 by any means you have. I used a spare RaspberryPi. The I2C header to write to the module is labeled on the PCB.

To make it fit in the Tektronix, use a spacer to fill the gap between the PCB and the module bay. I initially used a piece of paper folded up but eventually found a scrap piece of plastic and glued it on.

What amazed me about this was Tektronix used no encryption, hashing or any other forms of

authentication. It's just an EEPROM and for under $5 I was able to enable functionality that was not initially exposed. This shouldn't even be considered hacking. It's synonymous to flipping a bit in a configuration file.

(3)

- Jm

Tektronix

Serial Bus MDO/MSO/DPO 4000B Series Module

MDO3000 Series Module

MSO/DPO2000B Series Module

I2C, SPI DPO4EMBD MDO3EMBD DPO2EMBD

RS-232 / 422 / 485 / UART

DPO4COMP MDO3COMP DPO2COMP

CAN, LIN DPO4AUTO MDO3AUTO DPO2AUTO

FlexRay -- MDO3FLEX

--CAN, LIN, FlexRay DPO4AUTOMAX --

--I2S/LJ/RJ/TDM DPO4AUDIO MDO3AUDIO

--MIL-STD-1553 DPO4AERO MDO3AERO

(4)

--Ethernet DPO4ENET --

--Discontinued products

Serial Bus MDO4000 Series Module MSO/DPO4000 Series Module MSO/DPO3000 Series Module MSO/DPO2000 Series Module

I2C, SPI DPO4EMBD DPO4EMBD DPO3EMBD DPO2EMBD

RS-232 / 422 / 485 / UART

DPO4COMP DPO4COMP DPO3COMP DPO2COMP

CAN, LIN DPO4AUTO DPO4AUTO DPO3AUTO DPO2AUTO

FlexRay -- -- DPO3FLEX

--CAN, LIN, FlexRay

DPO4AUTOMAX DPO4AUTOMAX --

--I2S/LJ/RJ/TDM DPO4AUDIO DPO4AUDIO DPO3AUDIO

--MIL-STD-1553 DPO4AERO DPO4AERO DPO3AERO

--USB DPO4USB DPO4USB --

--Ethernet DPO4ENET -- --

--OSH Park

Eagle File

<?xml version="1.0" encoding="utf-8"?> <!DOCTYPE eagle SYSTEM "eagle.dtd"> <eagle version="6.4">

(5)

(6)

(7)

<text x="5.715" y="6.0325" size="1.778" layer="22" rot="MR180">oontz.org</text> </plain>

<description><h3>SparkFun Electronics' preferred foot prints</h3>

In this library you'll find connectors and sockets- basically anything that can be plugged into or onto.

We've spent an enormous amount of time creating and checking these footprints and parts, but it is the end user's responsibility to ensure correctness and suitablity for a given componet or application. If you enjoy using this library, please buy one of our products at www.sparkfun.com.

Licensing: CC v3.0 Share-Alike You are welcome to use this library for commercial purposes. For attribution, we ask that when you begin to sell your device using our footprint, you email us with a link to the product being sold. We want bragging rights that we helped (in a very small part) to create your 8th world wonder. We would like the opportunity to feature your device on our homepage. </description>

</packages> </library>

<library name="Microchip_By_element14_Batch_1"> <description>Developed by element14 : element14 CAD Library consolidation.ulp

at 30/07/2012 11:22:31</description> <packages>

(8)

<text x="-4.2672" y="2.0574" size="2.0828" layer="25" ratio="10" rot="SR0">>NAME</text> <text x="-5.461" y="-4.0894" size="2.0828" layer="27" ratio="10" rot="SR0">>VALUE</text> </package> </packages> </library> <library name="testpad"> <description>Test Pins/Pads Cream on SMD OFF.

new: Attribute TP_SIGNAL_NAME

<author>Created by [email protected]</author></description> <packages>

<text x="-0.508" y="-0.635" size="0.0254" layer="27">>VALUE</text> <text x="0" y="-2.54" size="1" layer="37">>TP_SIGNAL_NAME</text>

(9)

</package> </packages> </library> </libraries> <attributes> </attributes> <variantdefs> </variantdefs> <classes>

</classes>

<description language="de">EAGLE Design Rules

Die Standard-Design-Rules sind so gewählt, dass sie für die meisten Anwendungen passen. Sollte ihre Platine

besondere Anforderungen haben, treffen Sie die erforderlichen Einstellungen hier und speichern die Design Rules unter einem neuen Namen ab.</description>

<description language="en">EAGLE Design Rules

The default Design Rules have been set to cover a wide range of applications. Your particular design may have different requirements, so please make the necessary adjustments and save your customized design rules under a new name.</description> <param name="layerSetup" value="(1*16)"/>

(10)

(11)

(12)

</pass> </autorouter> <elements>

</element>

(13)

</elements> <signals>

</signal>

</signal>

(14)

</signal> </signals> </board> </drawing> </eagle>