FLUKE 192/ 196 / 199 FW Upgrade

[Maxis]

Dear forum members,

I have FLUKE 196 FW 1.24 (OLD). This FW has a very basic functionality, where there is neither X/Y display nor the trace mathematics present. It's totally silly since even FLUKE 97 model is fully loaded with all these functions. Since FLUKE 196 has isolated channels and I work on the advanced motor control, I badly need the X/Y display functionality.

Recently I have discovered, that the last FW version (version 4.0) released by FLUKE in year 2000 does indeed include A vs B display (X/Y display) and also the trace mathematics:

http://web.archive.org/web/20050209043312/http://www.fluke.com/scopemeter/firmware.asp?AGID=29&SID=210

In order to use the aforementioned SW package I need to already have the version 3.0. But I do have 1.24.

How to upgrade to version 3.0?

1. I found in the service manual schematics, that there is the FW/HW version identification resistor:



And this resistor must be changed from 0 Ohm to 17.8K in order to correctly validate the HW if FW version 3.0 and greater is installed.

2. Also at the same time the signal path compensation must be updated (RC network connected connected to the PIN19 of the both channel C-ASICs).




Now here is THE QUESTION:

Can anyone please share with me the upgrade software package to move from the FW version 1.xx to the version 3.0?


I know the odds and the dangers of turning my FLUKE 196 into a brick (pumpkin)  by running the upgrade.

Thank you!

[Maxis]

More info:
by looking inside FlashTool_V408.exe there are different files.
- FlashTool.exe is the programmer
- data.bin  is the actual FW image
- *.lng are the message files
- FlashTool.ini has several encryption keys (the exact functionality to be understood)

Since FlashTool refuses to flash my Fluke 196 due to the FW version mismatch there is a possibility to patch a bit the thing to let it skip this test.
However, here is the potential risk:
- The content of the data.bin file suggests that the actual flash image is fragmented.

For example:
by looking at the headers there are some different record types:
LOADFILE VERSION
SOFTWARE DESCRIPTION
EXTENSION DATA <starting address in HEX>, <length in HEX>, <length in DEC>  data0, data1, ...., data N
DATA BLOCK <,# 6 bytes starting address in HEX>, <,# 4 bytes length in HEX>, <length in DEC + 1>  data0, data1, ...., data N
EXTENSION COMMAND TABLE
- CF:GO00401780
- EO:GO0040170C
- FC:GO00401652
- FP:GO004006CA
- PF:GO00400C72
- QF:GO00400AB2
- TI:GO00400A7C

Now, it seems that even the command language/syntax between the test tool and the programmer.exe can be re-defined. Actually this is very smart since there were many ROM mask versions of the boot loaders.

The real risk is that when flashing 1.24 FW with 4.08 FW maybe some common modules coming from 3.0 FW are completely missing and wouldn't be updated.

Have anyone already tried to dive inside this?

Greetings..

[Black Phoenix]

I've been looking online and no reference of a firmware lower than the 4.08V that you currently have. Yes currently on the Fluke Page they ask you to contact support:

https://www.fluke.com/en/support/software-downloads/fluke-190-series-non-b-c-models

It was lucky that the Wayback Machine catch a screenshot of the page plus some links as the downloadable installer. Although the installer is still present know on the Fluke servers on this link:

http://assets.fluke.com/download/scopemeter/FlashTool_V408.exe

My thought is since it was an upgrade that needed to have some components swapped on the PCB plus a calibration, there aren't any file to be downloaded since it was never provided to the end user. I even tried to search on xDevs.com, a website from a member here called TiN but I can't access the Docs part of the website, it always return a nginx error.

With other kinds of equipment normally the latest firmware contains the previous code released in older firmwares, say for example you have a equipment that have a 1.1V firmware, a 1.5V and a 2.1V. Normally you don't need to go 1.1V then 1.5V and 2.1V. You can update directly to the 2.1V and both 1.1V and 1.5V code are present in. In this case since they explicitly say that you can't update directly is because or the code is not present, or is related with the PCB component changes needed and the calibration. I can't tell you for sure, It's up to you if you want to take the risk, change the components and try to flash it, and or you get a functional up to date equipment (needing calibration, mind it) or a door stopper.

[Maxis]

Hello,

Right, I had the same thoughts about the integrity of 4.08 upgrade. I've opened up the FlashTool_408.exe, extracted data.bin and checked the continuity of the image. There are chunks of data 4096 bytes each. But there are also some chunks which are shorter than 4096 bytes but still starting at the 0x1000 boundary, suggesting that the FW image isn't continuous, but rather fragmented.

I've also checked the WEB to see if someone already dumped the FLASH of the scopemeter, but found NOP.

It's possible to link the partitions together and run the check on the code. BTW, extracted one code section, thrown into the cross platform disassm and just discovered, that the code is Motorola 68K instruction set 
How interesting.... So, the FLUKE D-ASIC has Motorola 68K inside, not ColdFire core but real 68000. Also I remember, that Philips co-developed their Magnavox CD-I chipset together with Motorola, around mid 90s. So, that was also a 68000 with some fast DMA, LCD controller etc built in.

It would be awesome if someone could help me in getting the FLASH DUMP for version 3.0 and greater. This way it's possible to check the integrity of the upgrade image (see if all the parts are present).

One more thing coming from the DATA.BIN scan - unfortunately there is no exception table or anything like that in the provided image suggesting that the vital part of it is sitting in the D-ASIC on-chip mask ROM. Likely mask ROM has all the initialization and exception processing table which after some tests is relocated to the SRAM.

One more option would be to unsolder the FLASH, back it up and only then start fiddling with the FLASHTOOL loader. There are no other IC apart from FLASH ROM
where the information can be stored.

BTW, does anyone have a FLASH dump of their 192/196 or 199 without a letter?

Thank you

[Maxis]

More information:

The built in CPU is indeed the bare bone 68000! No instruction set extensions common for 010-060 are identified.

The flash ROM starts at the physical address 0x680000    in the D-ASIC address space.
The first 512K are empty (at least in rev 4.00 and 4.08). The actual code content starts at 0x700000

[Maxis]

Here are more updates:

The partition which is loaded into the instrument RAM at the address 0x40000 is the Programmer Client. It has all the facilities to download from the HOST, erase and program the built-in FLASH memory. Its dynamic run-time code is combined from EXTENSION DATA sections in data.bin file at the start of the flashtool. The code to be flashed (the actual content of the FLASH ROM at the end of the DFU exercise), however, is usually limited to 4KBytes chunks and has a different header -> DATA BLOCK.

The EXTENSION COMMAND TABLE supplies the entry points inside Programmer Client sitting in the scopemeter RAM during the instrument update. It's interesting to find that not only Intel and Mitsubishi, but also AMD flash chips (not mentioned in the Service Manual) are supported.


These are the entry points:
- CF:GO00401780
- EO:GO0040170C
- FC:GO00401652
- FP:GO004006CA
- PF:GO00400C72
- QF:GO00400AB2
- TI:GO00400A7C

GO is the directive followed by 32 bit address

These entry point functions are yet unknown. At some point they are all called as functions in the single function one after another, which is a bit perplexing. Could this correspond to the DFU order of things? If so, then the "command master" is not the HOST, but the scopemeter itself requesting commanding the host.

The code is well structured, but not hand written in assembly.
It uses the mask ROM of the D-ASIC extensively (likely for optical interface COMM, LCD output etc) but entry points are to be analyzed.


Here is a little fragment of the sector erase as it resides inside the Programmer Client

00401C4C   ; --------------------------------------------------------------------------------------
00401C4C   ; D4 holds the Flash IC type: 1 - Intel 28F160, 2 - AMD 29LV160, 3 - Mitsubishi, 4 - Intel
00401C4C   BlkEraseFLASH:            ; CODE XREF: sub_0_401A94+8E
00401C4C         lea   $5E(a5),a1
00401C50         move.w   #$FF,d3
00401C54         cmpi.b   #2,d4
00401C58         bne.s   BlkErase_CHK1
00401C5A   
00401C5A   BlkEraseI28F160:
00401C5A         moveq   #-2,d1
00401C5C         move.l   d6,d0
00401C5E         add.l   d5,d0
00401C60         and.l   d0,d1
00401C62         move.l   d1,(a1)
00401C64         movea.l   (a1),a4
00401C66         move.w   d3,(a4)
00401C68         movea.l   (a1),a4
00401C6A         move.w   d3,(a4)
00401C6C         movea.l   (a1),a4
00401C6E         move.w   #$50,(a4)   ; Clear   status register
00401C72         movea.l   (a1),a4
00401C74         move.w   #$20,(a4)   ; Erase   setup
00401C78         movea.l   (a1),a4
00401C7A         move.w   #$D0,(a4)   ; Erase   confirm
00401C7E         lea   $6A(a5),a2
00401C82   
00401C82   loc_0_401C82:            ; CODE XREF: sub_0_401A94+1F8j
00401C82         movea.l   (a1),a4
00401C84         move.b   1(a4),(a2)
00401C88         btst   #7,(a2)
00401C8C         beq.s   loc_0_401C82   ; Erase   not finished
00401C8E         movea.l   (a1),a4
00401C90         move.w   d3,(a4)
00401C92         movea.l   (a1),a4
00401C94         move.w   d3,(a4)
00401C96         move.b   (a2),d2
00401C98         btst   #3,d2
00401C9C         bne.s   loc_0_401CB4   ; VPP range error
00401C9E         btst   #6,d2
00401CA2         bne.s   loc_0_401CB4
00401CA4         btst   #5,d2
00401CA8         bne.s   loc_0_401CB4   ; Block   erase error
00401CAA         clr.l   d1
00401CAC         move.b   d2,d1
00401CAE         btst   #4,d1
00401CB2         beq.s   loc_0_401CB8
00401CB4   
00401CB4   loc_0_401CB4:            ; CODE XREF: sub_0_401A94+208
00401CB4                  ; sub_0_401A94+20E ...
00401CB4         moveq   #1,d1
00401CB6         bra.s   loc_0_401CBA   ; Return error code D1=1
00401CB8   ; --------------------------------------------------------------------------------------
00401CB8   
00401CB8   loc_0_401CB8:            ; CODE XREF: sub_0_401A94+21E
00401CB8         clr.l   d1      ; Erased successfully D1=0
00401CBA   
00401CBA   loc_0_401CBA:            ; CODE XREF: sub_0_401A94+222
00401CBA         move.l   d1,d0
00401CBC         bra.w   loc_0_401BE2   ; Transfer the error code to D0
00401CC0   ; --------------------------------------------------------------------------------------
00401CC0   
00401CC0   BlkErase_CHK1:            ; CODE XREF: sub_0_401A94+1C4
00401CC0         move.l   #-$10000,d2
00401CC6         cmpi.b   #3,d4
00401CCA         bne.s   BlkErase_CHK2
00401CCC   
00401CCC   BlkErase29LV160:
00401CCC         moveq   #-2,d1

[memeruiz]

I also have a 196 v1.24 fluke scope in case you are into upgrading the flash also.

Maybe I can help. I recently saw in fluke webpage a mention of GPL for some version of this scope. I wonder if the firmware on ours are some embedded linux build.

[clod22]

Hi all,

Please helpppp, I bot an old fluke 199 fromEbay, but unfortunately the flash rom is missing from main board, the question is i have any possibilities to find somewhere a new chip with original software, thank .

[asis]

Hi,

Maxis

Judging by your descriptions, you came closest to the truth.
About a year ago, I was able to reverse engineer the A201 Fluke199c module (V08.04) and read using LabTool-48UXP its contents without solder the Flash SST39LF800 chips.
A dump of a functioning appliance.
Now I see at what addresses and in which chips the serial number of the device is located, which is very important when  checking the ASIC mask.

If you are still interested, let me know.

Vladimir.

[crazy]

Hi
I wander if someone has ca fluke 190 memory dump ?
And share all the schematic ?
Thank you.

[asis]

Hi,
I do not yet have a dump on devices of older versions of Fluke 192,196,199 (without the letter B, C).
There the MS TE28F160B3xxxxx 16MB Flash or M5M29FB160AVP-80 is installed and, probably, dump substitution is hardly possible.
There OTP ROM D-ASIC checks the serial number of your device, which is located on the back of your device.
Look at the algorithm and try to use the rollback procedure.
Not the fact that the devices purchased at the auction are not rearranged from one case to another.
Keep that in mind.
Vladimir.

[mojoe]

My understanding is that the early Scopemeters with 1.xx firmware won't take the later firmware. It would be nice if you prove this incorrect.

[lostking2008]

Hi There, I need a memory module for Fluke 199C, but it has been discontinued by Fluke back in 2017. Unfortunately, the service manual doesn't come with the circuit drawing of the Flash/SRAM module (80 contacts in two rows, 0.8mm pitch) itself. Does anyone happen to have a schematic drawing of the memory module?

Thanks,
Ken

[vishaldotgupta]

hi

can anyone share flash file bin  / hex file for Fluke 199c

[asis]

https://www.eevblog.com/forum/repair/fluke-199c-scopemeter-repair/25/ 

[harrimansat]

FLUKE 199 (not C) dump

[smaultre]

Anybody have a FlashTool_F190BC_V702.exe ??

[msquared]

If you're just trying to upgrade a scope I think 7.06 was the last version released.

Hopefully this will work for you.

[smaultre]

ha-ha its not worked too, upgrade the 6.15 to 7.xx . Who know the way?

[memeruiz]

These guys are offering the complete service. This _apparently_ is possible.

https://www.ebay.com/itm/234220465665

Not cheap, though

[coromonadalix]

Must be them

http://scopemeterrepair.com/

[Victor jose teixeira]

Good afternoon,
I have several FLUKE devices, multimeters and oscilloscopes.
I recently bought a FLUKE 199 on Ebay in excellent condition and with calibrations, it already had firmware version V04.08 (last), the multimeter measurement works.  But the functions OSCILLOSCOPE channel A and B do not measure, the lines of channels A and B do not appear.
I've tried several configurations and nothing, the tips are fine, the problem is really in the oscilloscope. Someone can help me? Any idea what the problem is?

[Victor jose teixeira]

Good afternoon,
I have several FLUKE devices, multimeters and oscilloscopes.
I recently bought a FLUKE 199 on Ebay in excellent condition and with calibrations, it already had firmware version V04.08 (last), the multimeter measurement works.  But the functions OSCILLOSCOPE channel A and B do not measure, the lines of channels A and B do not appear.
I've tried several configurations and nothing, the tips are fine, the problem is really in the oscilloscope. Someone can help me? Any idea what the problem is?

[eb4fbz]

More information:

The built in CPU is indeed the bare bone 68000! No instruction set extensions common for 010-060 are identified.

The flash ROM starts at the physical address 0x680000    in the D-ASIC address space.
The first 512K are empty (at least in rev 4.00 and 4.08). The actual code content starts at 0x700000

Are you sure? Fluke Spider D-ASIC (HS353063) is supposed to use an ARM 720 core.

[smaultre]

Looks like bad input asic (or problems with it powering) You can try the pre-calibration diagnostic procedure.