Fluke 289 not quite sorted.

[purpose]

Evening all.
I just took a punt on a faulty ebay 289.
Fixing what was most obvious (a broken battery connector) bore no fruit, but power was getting to it and it was drawing a steady 25mA.
There is no screen action (not booting) and I'm unable to turn it off without removing the battery, or turning off the power supply.
Nothing on the pcb appears to be getting hot and the lcd connector is properly seated.
Bit of supercap crud, but showing 3.2V when powered.
Anything sound familiar?

Any and all help warmly welcomed.

Peter

[retiredcaps]

Q1). Is there any alkaline leaked battery residue/corrosion on the pcb or battery terminals?

Q2). Maybe check Y1 and Y2 to make sure the clock is running.

Q3) Check to see if the MSP430 is getting vcc?

Q4) You could trying removing the supercap to see if that allows the 289 to boot?

I don't have a 28x so I don't know if 25mA is normal or not.  I do know the 28x battery life is supposed to be a minimum of 100 hours.  So if your alkaline are 2500mAH, then 25mA draw sounds correct.

[purpose]

Evening Sir.
A1 There is not. Pcb is in good order, apart from the previous owner scratching up the battery pads, which are now covered in solder and getting power from a psu.
A2 Both clocks running, but wandering.
A3 Pin 1 showing -0.8V... which doesn't sound right. Those pins are miniscule.
A4 I could, but have no hot air. I could butcher it though... needs replacing anyway. I'll report back on that one.

Cheers
Peter

[purpose]

All those lovely test points and no list of pokery... sigh.

[purpose]

Lifted the supercap... no joy.

[retiredcaps]

A2 Both clocks running, but wandering.

What frequency is it running at or what range?

A3 Pin 1 showing -0.8V... which doesn't sound right. Those pins are miniscule.

This a picture of a Fluke 287 from another eevblog post, but I suspect the 289 will be close or identical, but it looks like C42 connects to pin 1 of MSP 430.  You can measure the vcc at the + terminal of C42.

[retiredcaps]

All those lovely test points and no list of pokery... sigh.

I don't have a 28x, but maybe someone with one can kindly provide voltage readings at all these TPs for reference.  That might help narrow down which section is wrong.

Past Fluke service manuals had documented readings for each TP and a suggestions on what might be wrong if that reading was missing.

Those service manuals now are no longer made available to the general public for modern generation meters.

[purp]

Morning,
Second moniker, as I faffed something last night.

The MSP430... I was checking one of the other pin 1s..!! Pushing 60, my eyesight is no longer like a hawk. 3.4V is what my scope is now seeing at C42.
Frequencies are Y1 32.77k and Y2 32.76k and solid.

Cheers
Peter

[purp]

Would you Adam and Eve it... Turned it off and on again and it sprung into life..!! Turned itself off after a minute, but some progress.

[mzacharias]

25 mA quiescent current is excessive - something should be getting hot, perhaps after a minute or two.

[purp]

I believe you to be correct sir, but I can't find the culprit with the back of my finger.
When it works, it's pulling 18-20mA, but then shuts down after a minute or so, usually when menu hopping.
I'll get to the bottom of it if it kills you.

[purp]

On one of the rare occasions that the meter was functional, I managed to do a 'reset to factory default' and it's been on for an hour now.
Looks like this may have been a software problem.
Anyway, I'm delighted to have a meter long lusted after.
The only downside is that it makes my hands look small..!!

Thanks for chiming in gents.

peter

[retiredcaps]

On one of the rare occasions that the meter was functional, I managed to do a 'reset to factory default' and it's been on for an hour now.

I was going to suggest that when I saw your post about it shutting down after menu hopping.  I'm glad you got it all sorted out.

I think 1.16 is the latest firmware for the 28x?  See

http://www.fluke.com/fluke/r0en/Support/Software/DMMUpgrade.htm

[purpose]

I spoke too soon.
It was working flawlessly for around eight hours and then died on me.
My work is still ahead.

I'll not attempt flashing the beast until it's 100% stable.

peter

[Samogon]

 Cold joint?

[purpose]

No thanks... I just had one.

I've got a hot air gun on order and will likely go over the old girl.
Failing that, I see a professional needed.

[Yakuzza]

Hi all.
This is my firts post here at the forum. I did some reasearch and this thread seems to be the closest to what I’m experiencing. Here is my story.

Recently I found a broken Fluke 289 in my company and decided to take it apart and check if I can repair it. Basically, after pressing the power button it lids up for couple of seconds and turns off. Nothing on the LCD, no other action.

Just for the record, I don’t have education in electronics, just some minor hobby projects (like trying to repair a multimeter )

I’ve opened it and examined the PCB, but in general it was in a very good shape. No visually burned elements etc., except for the coroded supercap. I’ve found the thread on this forum about it and I thought that might be a reason for it not to work. I’ve order a new one and replace it, but nothing changed.

Here is what I measured:
1. I push the power button and the meter starts to draw current up to around 45mA in the first 4-5 seconds.
2. There is a very short blink of the power light after maybe 1-2 seconds form powering it up.
3. The power light turns off and the current draw goes down to around 25mA. There is nothing on the LCD. The current draw is steady.
4. I have to push the power button again to see that the current draw is dropping to 130 microA, but dropping slowly, which I assume is due to charging the new supercap.

In addition, which I didn’t mentioned this at the beginning, there was a bit of greenish dried fluid marks in on PCB close to Amper input (between the two left input jacks) and similar thing on the top corner of the LCD, close to the soldered wires. I’ve clean it but found no source.

The meter is probably quite old, but I don’t know how to check that. I have only the unit, no probes, no box etc. There is a date on the board: 2005.

Here are some questions to you guys:
1. Just to check if there is a warranty option, where can I find the production date, serial number, and other info needed to fill the online form for requesting repair by Fluke. I’ve read that it might have 10 years of warranty, right? Note - LCD doesn’t work.
2. Assuming the warranty is not an option, what else can I check?
3. Does the power light in an operational meter behaves in this way, that is lids up for couple of seconds and then turns off? The steady 25mA might be a sign, that everything except the LCD is fine, right?
4. How can I check the LCD itself?
5. Anybody have some readings on the test points, so I can compare them with my unit?
6. This might a silly question, but how can I attache voltage to PCB? There are those two small copper areas in the middle of the board and small holes right next to it. Are there any special probes cable that you stick the board on them or what?

I can upload pictures of any interesting parts of the multimeter.

I would really appreciate any help and tips you can give me.
Thank you all and have a nice day!

[Muttley Snickers]

You can forget about the warranty altogether unless you are the original purchaser and can prove that it was bought from a local authorised Fluke agent. Make sure you are using a good set of new batteries, which batteries are you currently using to power the meter ?.

[Yakuzza]

I’m using Alkaline Energizers with measured 1,47V per cell, with total of 8,82V.

In addition I just checked the following:
  5. On the constant voltage setting the meter is drawing 19,6mA. I started to push other buttons to see if I get other readings and when I pressed the light button the LCD starter to glow nicely with current draw increased to 33mA. After pressing the light button again the intensity of backlight goes up and the current draw also up to 53mA.
Still, there is nothing on the LCD.

[saturation]

Fluke will only warrant defects in factory parts or workmanship, not damage from use.  If you send it in, assuming you find serial number etc., they can reject the claim if they find it damaged from use, also you need to have bought it through an authorized reseller.  However, the cost for a repair maybe less than the cost of a new unit since its cheaper to do a board swap and a cal thereafter.

If the unit refuses to boot and the input jacks appear contaminated make sure there are no shorts on the board, or any liquid residue.  If it still won't boot, its likely toast.

You can download the Calibration manual and follow the troubleshooting procedures, but in all instances, the unit first boots before a test can be run.

The simple first thing to troubleshoot a Fluke DMM if you still choose to proceed is examine the inputs carefully for damage, and then desolder the input protection.  It cannot reliably be troubleshooted in circuit.  This section takes the brunt of most injury during an input fault.  If a fault made it past input protection, the subcircuits are more delicate and it can damage quite a bit. 

Good luck!

[Yakuzza]

@saturation
Do you mean to desolder input protection and check it piece by piece?
Assuming the input protection is fine, what else can I check and how?
If the input protection is faulty, does that mean that the board might be fried as well, or should the input protection actually protect the further elements?

I will be updating this question list from now on.
Here is a summary of my questions (slightly rephrased) and with some answers:

Q1. Just to check if there is a warranty option, where can I find the production date, serial number, and other info needed to fill the online form for requesting repair by Fluke. I’ve read that it might have 10 years of warranty, right? Note - LCD doesn’t work.

Ans: Since I’m not the original owner and I don’t have any papers to even show when and where the meter was bought, the conclusion is that the warranty is off the table.
-Q1 closed-

Q2. Assuming the warranty is not an option, what else can I check?

Q3. Does the power light in an operational meter behaves in this way, that is lids up for couple of seconds and then turns off?

Ans: I’ve just found out that according to Calibration Manual, in the “Power LED test” section: “... power button [should] lights for approximately 4 seconds, and then extinguishes”, which is what I observe in my unit. That is okay than.
-Q3 closed-

Q4. The steady 25mA current draw might be a sign, that everything except the LCD is fine, right?

Q5. How can I check the LCD itself?
Can I assume that pin 1 is ground and pin 2 is VCC, and check if get readings on the board, after disconnecting the LCD?

Here are some data I found in the Calibration Manual:
dot matrix LCD, DS1,
LCD MODULE,289,320X240,FSTN,3.5 MONO GRAPHIC,TRANSFLCTV,WHITE LED,0.22MM PITCH, Part number 2734828.

Q6: Anybody have some readings on the test points, so I can compare them with my unit?

Q7: This might be a silly question, but how can I attache voltage to PCB? There are those two small copper areas in the middle of the board and small holes right next to it. Are there any special probes cable that you stick the board on them or what?

Ans: According to Calibration Manual: “TP8 and TP10 can also be used to apply power to the PCA.” And since these two points are on the side of the board I can use crocodile connectors or something similar.
-Q7 closed-

[purpose]

Yakuzza,
I'll be borrowing a working 289, so I'll get some readings up soonish.
Trouble is knowing from where to where one measures.

I was onto Fluke UK, asking about their 'fixed price repair' and was told £271 plus this and that.
I'll not be sending it to them.

peter

[Yakuzza]

@purpose
Hi. I’ve assumed you managed to repair your unit, but I see you still haven’t fix the issue. Well, about the readings in test points I thought to measure in respect to ground, but maybe that is not a correct approach. Anybody?

I actually just did some readings on the LCD connector and few test pins, and then I realized that it doesn’t make sense to compare it with other unit’s readings. There is no Service Manual available for this model (as far as I tried to find one), so even if we identify differences in readings there is no reference to say what does that mean and what is broken. Don’t you agree?

Tomorrow I will try to grab a friend which owns a CAT mobile phone with infrared camera, so maybe I can have a look at the board and see if there is something suspiciously warmer than other.

The fact is that I don’t want to spend hundreds of pounds for repair of an old unit (with unknown history of usage, without all the accessories and even test leads). I will do few attempts and check what I can, with some advices from you guys, and if it does not help I will just ditch it.

I can share my readings in test points if you like, maybe we can see a pattern anyway 

Cheers,
Mike

[purpose]

Yep... it's back to NFG.
I'll measure all points on the working 289 relative to the common input for starters and post the results.
I invested in a cheap FLIR TG165, in the hope of seeing something the back of my finger is missing.

peter

[purpose]

I've got most readings from a good one... enough to know that my -2.5v rail is kaput.
All measurements taken relative to COM input, switch at VDC and 9V to the battery pads.

TP    BAD    GOOD
1    -0.81   -2.49
2     2.26    0.61
3    -0.13    2.49
4     2.26    0.61
5     2.25    0.61
6     2.24    0.61
7    -0.81   -2.49
8     8.23    6.53
9     1.16    1.11
10  -0.81   -2.49
11   0.23    0.46
12   -0.81   -2.49
13   2.22   0.438
14   -0.81   -2.49
15   2.13   0.438
16   2.11   0.437
17   2.26   0.609
18   0.98   0.68
19   2.13   0.43
20   2.13   0.43
21   2.13   0.43
22   2.13   0.43
23   2.13   0.43

28   -0.81   -2.49

30   -0.81   -2.49
31   -0.81   -2.49
32    2.26    0.61
33    2.26    0.61
 
U20, which I assume to be some sort of pwm, is chuffing along on one side at 293kHz and other side at 143kHz. Both at 97/98% duty.  How pertinent that may be, only one of you can tell me.

BTW... My new TG found the 10mA hungry component, but removing it just brought the draw to the normal 19mA and did nothing for the rails.

peter

[Old Don]

Purpose - if you have a can of air handy you can turn it upside down and spray the board with it. It should freeze the components and help with locating the hot chip(s). First to defrost are the hottest ones. Also, making the PCB cold can help with finding a cold solder joint. Spray sections of the PCB and turn on, when it functions every time a section is cold you've localized the problem area. A soldering iron or hot air gun to reflow should solve a bad solder joint, but not a flaky chip.

[purpose]

Thank you Sir... sound advice... No air handy but just ordered some.

[Yakuzza]

I’ve checked voltages and compare it to @purpose readings. Most of the readings where consisten with the “good” meter. Here are some issue I’ve found:

TP  “good”  mine
...   ...        ...
8     6.53   I couldn’t locate the TP
9     1.11   ~0
10   -2.49  I couldn’t locate the TP
11   0.46   It goes from -1mV up while measuring (I've waited until -33mV and stopped measuring)
...    ...      ...

The rest of the readings are very close to the “good” meter.

I managed to check with a thermal camera that there is a region with higher temperature, but the camera was really crappy so it might be a false positive. I shall check the chip name and spec and see if it makes sense to have higher temp in there. Actually higher temp was on 4 resistor and 1 capacitor on the right side of that chip (ad8617).

I guess, I can try to trace the path from TP 9 and 11 to see if it leads to anything suspicious, but without a service manual it will be like chasing a wind. Any advice anybody?

[frenky]

@purpose: Is there any progress on the repair?

I have bought faulty Fluke 287 from ebay and it has very similar voltages on test points as yours.
When powered on the power led stays green for ever and on the lcd is Fluke logo. Current consumption is 42mA.
I have already removed all the MOVs and super cap. And washed it with IPA.
Next I'll check the power supply voltages on all ICs and frequencies of the oscillators.

[frenky]

The only two components heating up are main IC and Q9 with markings: 1.R





Q9:

[purpose]

Hi Frenky,
No progress yet.
Mine shows nothing on the screen, so am thinking mine is failing earlier than yours in the boot process.
To the right of the battery pads is an unpopulated switch pad, marked S2 MSP RST. I'm wondering if this might be something worth exploring.

peter

[frenky]

I measured oscillators and there is no signal from it. Weird that power button works if it is connected to the IC with "sleeping" oscillator?

Anyway I made a list of all ICs on the meter. (Attached pdf)
It is very strange that nobody tried to reverse engineer 287/289 in the last 10 years. Or at least tried to identify all the elements on it.
This would help many with repairing their faulty units.

[frenky]

Some datasheets from known ICs:

U48: (ADG714) http://www.analog.com/media/en/technical-documentation/data-sheets/ADG714_715.pdf

U26: (MC9328MXS) https://www.nxp.com/docs/en/data-sheet/MC9328MXS.pdf

U19: (LP324M) http://www.ti.com/lit/ds/snosbx6c/snosbx6c.pdf

U16: (AD8617) http://www.analog.com/media/en/technical-documentation/data-sheets/AD8613_8617_8619.pdf

U14: (LTC1968) http://cds.linear.com/docs/en/datasheet/1968f.pdf

U10: (LTC939CS) Voltage Regulators - DC DC Switching Regulators Perhaps similar to: http://cds.linear.com/docs/en/datasheet/15501fa.pdf

U12, U39, U40: (HK4053) Perhaps 74HC4053 https://assets.nexperia.com/documents/data-sheet/74HC_HCT4053.pdf

U17: (PCYI; TPS770) http://www.ti.com/lit/ds/symlink/tps770.pdf

[purpose]

Nice digging.
When I was in touch with Fluke, they said they could help with component ident, but a bom might be out of the question.
I'll try my luck.

peter

PS I've just fired of an e-mail.

[frenky]

Great. Any info will be usefull.

I might have identified a few more elements:

1AM (sot23) 2N3904
ARB (SC70) TPS715
338 (sot23) NDS338N or BC338
A8L (sot23)  MMUN2234
2A (sot23) 2N3906
A41 (sot23) 1S2836 or OPA364
LTKH (S5) LT1615ES5-1
IL44 (sot23) perhaps BAT54S
A6W (sot23) BAS16
1R (sot23) MMBT5089
EHs (sot23) BCW66H
SS (sot23) BSS138
337 (sot23) NDS337N or BC337
R1E (sot23) LM4041EEM3-1.2
RAD (SC70-5) LM4041
5B1 (sot23) XC6106B032MR or XC9236A11CM
JY (sot23) BAV199
6B (sot23) 2N5484 or BC817-25

[retiredcaps]

It is very strange that nobody tried to reverse engineer 287/289 in the last 10 years. Or at least tried to identify all the elements on it.

I suspect that most owners of the very expensive 287/289 just take advanage of the "lifetime" or minimum 10 year warranty rather than fix it themselves.

Others who come here for help usually find that something in the input protection is wrong.

[frenky]

@retiredcaps:
Yes, that makes sense.

@purpose:
If you still have the good dmm available for inspection, could you repeat all the measurements again relative to the "- pad" instead of the COM?
I believe that "- pad" is GND for all the ICs on the board, but it is not on the same potential as COM.
And if you could do separate measurements for when dmm is powered off and on, would be really great.

I know that it would take quite some time and effort but it would be for greater good. 

[purpose]

I think I could arrange that, but only because you're from the land of Melania T.

[frenky]

Thank you.

Not to downplay Melania's importance  but we are a bit more proud of two guys:
Goran Dragic "The dragon"- NBA basketball player at Miami Heat; also led our basketball team to victory on EuroBasket 2017
Anže Kopitar - professional ice hockey player and captain of the Los Angeles Kings

[sacral]

Hi Frenky,

I will reply here, maybe it will be useful for more people...
The test points are measured in ON (VCA position), on a functional Fluke 287 with the negative pole of the power supply as reference. On Off position, only a few test points have power, the other have 0 volts.
There are also a few TPs that i didn't find on the pcb and there are marked with x on the list. Of course I am to lazy to type all the values I find so I will post a picture with my note (I hope it will be clear enough)

[frenky]

Thank you. That is really nice of you.  

[frenky]

When I power on Fluke 287 I get this out of TX:

Code: [Select]

+jffs2_read_inode() failed

fs: Open failed, error 2
Can't load '/system/apps/clem.img': error 0

err_printf: aborting command
load /system/apps/clem.img failed... trying /system/apps/BackupClem.img

fs: Open failed, error 2
Can't load '/system/apps/BackupClem.img': error 0

err_printf: aborting command
load /system/apps/BackupClem.img failed

No network interfaces found

RedBoot(tm) bootstrap and debug environment [ROMRAM]
Non-certified release, version v2_0_74 - built 15:56:18, Sep 27 2007

Platform: Fluke Clem (ARM9)
Copyright (C) 2000, 2001, 2002, 2003, 2004 Red Hat, Inc.
Copyright (C) 2003, 2004, 2005, 2006, 2007 eCosCentric Limited

RAM: 0x00000000-0x007fb500, [0x0004dcb0-0x005d8500] available
FLASH: 0x10000000-0x107fffff, 63 x 0x20000 blocks, 4 x 0x8000 blocks
RedBoot>
Do I have to reflash firmware? Is that done over IR or with jtag?

[purpose]

I'd imagine having to use the jtag, as our meters are kaput.
There is some info in this pdf that might help.
media.fluke.com/documents/287-289_mveng0200.pdf

peter

[frenky]

Thank you. This document does help me understand how this dmm works a bit better.

I did some investigation around this debug console (baud rate 115200) that I have found:
(This serial console is not related with IR port, there is nothing being transmitted via IR during boot)



On TX I get error message about missing system image. So I tried to hook on with with computer but no luck.
When signal pulls RX to the ground both RX and TX go to LOW state and stay LOW until I reset dmm.

I tried adding 100k pullup resistors to both lines but that did not help.
Every time I try to send a command from PC to DMM both lines go LOW.
I have no idea why.

I have extracted Fluke's exe file and found clem_1_16.img.gz which is the missing file on my DMM. I would like to put it back on via serial port...

RedBoot allows download and execution of embedded applications via serial or Ethernet, including embedded Linux and eCos applications. It provides debug support in conjunction with GDB to allow development and debugging of embedded applications. It also provides an interactive command line interface to allow management of the Flash images, image download, RedBoot configuration, etc., accessible via serial or ethernet. For unattended or automated startup, boot scripts can be stored in Flash allowing for example loading of images from Flash, hard disk, or a TFTP server.

https://wiki.openwrt.org/doc/techref/bootloader/redboot

[purpose]

Frenky,
I barely know the difference between resistors and raspberries, so that's all gobbledegook to me, but I'll leave it to you young ones to get to the bottom of the software stuff.

BTW... did you get enough voltage info from sacral, or do you still need another testfest?

[frenky]

Sorry for late answer...

I would still like to get voltages of this points if possible:



Thank you.

[Yakuzza]

@retiredcaps
If there would be something wrong with the input protection, what would be the symptoms for the device? I would assume that the device should boot up normally, but one could not make any measurements. My unit doesn’t display anything on the LCD, but most of the voltages on test points seem to be similar to those listed by @purpose and @frenky. Can I assume that any potential issue with the input protection does not have anything to do with blank LCD?
I’ve just measured voltages as @sacral described in post #39 and below are those, for which I got different readings.

@sacral
My unit powers down after few minutes and so the voltages are changing. Maybe some of the measurements you’ve made were made after the “sleep”? I’m just asking. It is probably different because mine is broken

Here are deviations from @sacral list:
TP 1: 0.005
TP 3: 4.96
TP 9: 2.28
TP 16: 2.91
TP 18: 1.81
TP 32: 3.07
TP 33: 3.07
TP 34: varies in a mV range
TP 37 0.057

How can I test the LCD? Anybody can give me some simple guiding for this task, so I could eliminate the faulty LCD, please?

[retiredcaps]

@retiredcaps
If there would be something wrong with the input protection, what would be the symptoms for the device? I would assume that the device should boot up normally, but one could not make any measurements.

Correct.

Can I assume that any potential issue with the input protection does not have anything to do with blank LCD?

Correct.

[purpose]

Frenky,
I'll have the meter on Friday night, until Saturday afternoon, so get your questions ready.

peter

[frenky]

Sorted by preference:

1. Voltages on my image a few posts up.

2. Voltages of all test points

3. Voltages of all tantalum capacitors:



All voltages measured at power down state. And power on state with dial knob on AC Voltage.
Ground reference should be - pad of battery: https://goo.gl/NT8har

Thank you in advance.

[frenky]

Some research...

Fluke 287/289 are using RedBoot/eCos:

eCos and RedBoot based products showcase
Industrial and Automotive
Fluke 289 and 287 True-RMS Multimeters. Fluke's "The Most Advanced Multimeters, Ever", data logging & graphing multimeters.

https://lists.ecoscentric.com/ecos/examples.shtml

So I have been reading alot about RedBoot and found this:

Accessing RedBoot
After all connections have been made, start the serial terminal application and apply power to the board. Press Ctrl+C several times on the serial terminal until you see the RedBoot> prompt. If the kernel begins to boot, reset the board and try again (the standard timeout before booting the kernel is one second). On most versions of RedBoot, you will see either a '+' or a message from RedBoot before it boots the kernel, but some configurations have this disabled.

http://wiki.emacinc.com/wiki/Loading_Images_with_RedBoot

So the reason that I could not write to console is that I was trying to do it after the kernel has already booted.
So I'll try sending in Ctrl+C every half a second and then power up the Fluke 287. Hopefully I'll be able to access console this way...

[purpose]

Incoming.

[purpose]

9V TO PADS, IN AC V MODE, ALL READINGS RELATIVE TO NEG PAD.

TP
1   0.005
2   3.11
3   4.99
4   3.11
5   3.09
6   3.09
7   0.00
8   9.00
9   2.30
10  0.00
11  0.158
12  0.00
13  3.06
14  0.00
15  2.94
16  2.909
17  3.11
18  1.82
19  2.94
20  2.94
21  2.94
22  2.94
23  2.94

28  0.00
30  0.00
31  0.00
32  3.11
33  3.11
34  0.22

Off state showed only residual and dropping V readings.

Your pic answers.
tp3 4.99
x1  0.00
x2  0.903
x3  2.941
x4  0.910
x5  1.820

More to follow.

[purpose]

Tants

61  17.55
58  1.245
56  2.493
59  20.03
62  18.79
60  8.99
57  9.00
53  8.69
51  9.00
44  4.98
32  2.50
26  2.50
20  4.98
89  8.99
80  1.82
68  1.82
79  2.94
67  2.94
68  1.82
41  2.50
42  3.11
35  3.11

Peter

[frenky]

Wow thank you. You are the best!

I'm sure that many (including me of course) will find your effort realy helpful while trying to fix faulty Fluke 287/289.

[frenky]

Tadaaaa:

Code: [Select]

RedBoot> ^C
RedBoot> help
Manage aliases kept in FLASH memory
   alias name [value]
Set/Query the system console baud rate
   baudrate [-b <rate>]
Manage machine caches
   cache [ON | OFF]
Display/switch console channel
   channel [<channel number>]
Compute a 32bit checksum [POSIX algorithm] for a range of memory
   cksum -b <location> -l <length>
Test clock accuracy
   clock
Display (hex dump) a range of memory
   dump -b <location> [-l <length>] [-s] [-1|-2|-4]
Execute an image - with MMU off
   exec [-w timeout] [-b <load addr> [-l <length>]]
        [-r <ramdisk addr> [-s <ramdisk length>]]
        [-c "kernel command line"] [-t <target> ] [<entry_point>]
Manage FLASH images
   fis {cmds}
Manage configuration kept in FLASH memory
   fconfig [-i] [-l] [-n] [-f] [-d] | [-d] nickname [value]
Manage Filesystem files
   fs {cmds}
Execute code at a location
   go [-w <timeout>] [-c] [-n] [entry]
Help about help?
   help [<topic>]
Display command history
   history
Set/change IP addresses
   ip_address [-b] [-l <local_ip_address>[/<mask_len>]] [-h <server_address>] [-d <dns_server_address]
Load a file
   load [-r] [-v] [-d] [-h <host>] [-p <TCP port>][-m <varies>] [-c <channel_number>]
        [-b <base_address>] <file_name>
Compare two blocks of memory
   mcmp -s <location> -d <location> -l <length> [-1|-2|-4]
Copy memory from one address to another
   mcopy -s <location> -d <location> -l <length> [-1|-2|-4]
Fill a block of memory with a pattern
   mfill -b <location> -l <length> -p <pattern> [-1|-2|-4]
Network connectivity test
   ping [-v] [-n <count>] [-l <length>] [-t <timeout>] [-r <rate>]
        [-i <IP_addr>] -h <IP_addr>
Reset the system
   reset
Display RedBoot version information
   version
Display (hex dump) a range of memory
   x -b <location> [-l <length>] [-s] [-1|-2|-4]


Correct pinout:

[purpose]

You're welcome Frenky.
Does Tadaaaa mean you've fixed her?

[frenky]

You're welcome Frenky.
Does Tadaaaa mean you've fixed her?

No sadly not. But it is a progress. Next I'll try to load a data image from firmware update into flash memory.

Sent from my SM-N9005 using Tapatalk

[purpose]

Good luck.

[frenky]

Tnx.

I'm digging trough debug console...

RedBoot> fconfig -l

Code: [Select]

Run script at boot: false
Use BOOTP for network configuration: false
Gateway IP address: 0.0.0.0
Local IP address: 192.168.9.133
Local IP address mask: 255.255.0.0
Default server IP address: 192.168.100.100
Console baud rate: 115200
DNS server IP address: 0.0.0.0
Set eth0 network hardware address [MAC]: true
eth0 network hardware address [MAC]: 0x00:0x80:0x40:0x00:0x22:0x85
GDB connection port: 9000
Force console for special debug messages: false
Network debug at boot time: false
RedBoot>fis list

Code: [Select]

Name              FLASH addr  Mem addr    Length      Entry point
RedBoot           0x10000000  0x10000000  0x00040000  0x00000000
fs                0x10040000  0x00000000  0x007A0000  0xFFFFFFFF
FIS directory     0x107E0000  0x107E0000  0x0001F000  0x00000000
RedBoot config    0x107FF000  0x107FF000  0x00001000  0x00000000
RedBoot>fs info

Code: [Select]

Filesystems available:
devfs
jffs2

Devices available:
/dev/flash/

RedBoot>fs list

Code: [Select]

fs: No filesystems mounted
RedBoot> fs mount -d /dev/flash/ -t jffs2 /hmm1

Code: [Select]

fs mount: mount(/dev/flash/,/hmm1,jffs2) failed 2
RedBoot> fs mount -d /dev/flash/ -t devfs /hmm1
RedBoot> fs info

Code: [Select]

Filesystems available:
devfs
jffs2

Devices available:
/dev/flash/

Mounted filesystems:
            Device               Filesystem Mounted on
                     /dev/flash/      devfs /hmm1
RedBoot> fs list

Code: [Select]

fs list: no such directory /

[frenky]

So I dumped contents of "RedBoot config" and got this out:

d -b 0x107FF000 -l 0x00001000

Code: [Select]

107FF000: 00 10 00 00 CE FA AD 0B  01 0C 01 00 62 6F 6F 74  |............boot|
107FF010: 5F 73 63 72 69 70 74 00  00 00 00 00 04 11 01 0C  |_script.........|
107FF020: 62 6F 6F 74 5F 73 63 72  69 70 74 5F 64 61 74 61  |boot_script_data|
107FF030: 00 62 6F 6F 74 5F 73 63  72 69 70 74 00 66 69 73  |.boot_script.fis|
107FF040: 20 75 6E 6C 6F 63 6B 20  66 73 0A 66 73 20 6D 6F  | unlock fs.fs mo|
107FF050: 75 6E 74 20 2D 64 20 2F  64 65 76 2F 66 6C 61 73  |unt -d /dev/flas|
107FF060: 68 2F 66 69 73 2F 66 73  20 2D 74 20 6A 66 66 73  |h/fis/fs -t jffs|
107FF070: 32 20 2F 0A 6C 6F 61 64  20 2D 6D 20 66 69 6C 65  |2 /.load -m file|
107FF080: 20 2F 73 79 73 74 65 6D  2F 61 70 70 73 2F 63 6C  | /system/apps/cl|
107FF090: 65 6D 2E 69 6D 67 0A 66  73 20 75 6D 6F 75 6E 74  |em.img.fs umount|
107FF0A0: 20 2F 0A 67 6F 20 2D 63  20 2D 6E 0A 0A 00 00 00  | /.go -c -n.....|
107FF0B0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF0C0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF0D0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF0E0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF0F0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF100: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF110: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF120: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF130: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF140: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF150: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF160: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF170: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF180: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF190: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF1A0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF1B0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF1C0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF1D0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF1E0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF1F0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF200: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF210: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF220: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF230: 00 00 00 00 00 00 00 00  00 00 00 00 00 02 14 01  |................|
107FF240: 0C 62 6F 6F 74 5F 73 63  72 69 70 74 5F 74 69 6D  |.boot_script_tim|
107FF250: 65 6F 75 74 00 62 6F 6F  74 5F 73 63 72 69 70 74  |eout.boot_script|
107FF260: 00 01 00 00 00 01 06 01  00 62 6F 6F 74 70 00 00  |.........bootp..|
107FF270: 00 00 00 05 14 00 06 62  6F 6F 74 70 5F 6D 79 5F  |.......bootp_my_|
107FF280: 67 61 74 65 77 61 79 5F  69 70 00 62 6F 6F 74 70  |gateway_ip.bootp|
107FF290: 00 00 00 00 00 05 0C 00  06 62 6F 6F 74 70 5F 6D  |.........bootp_m|
107FF2A0: 79 5F 69 70 00 62 6F 6F  74 70 00 C0 A8 09 85 05  |y_ip.bootp......|
107FF2B0: 11 00 06 62 6F 6F 74 70  5F 6D 79 5F 69 70 5F 6D  |...bootp_my_ip_m|
107FF2C0: 61 73 6B 00 62 6F 6F 74  70 00 FF FF 00 00 05 10  |ask.bootp.......|
107FF2D0: 01 00 62 6F 6F 74 70 5F  73 65 72 76 65 72 5F 69  |..bootp_server_i|
107FF2E0: 70 00 C0 A8 64 64 02 12  01 00 63 6F 6E 73 6F 6C  |p...dd....consol|
107FF2F0: 65 5F 62 61 75 64 5F 72  61 74 65 00 00 C2 01 00  |e_baud_rate.....|
107FF300: 05 07 01 00 64 6E 73 5F  69 70 00 00 00 00 00 01  |....dns_ip......|
107FF310: 09 01 00 65 74 68 30 5F  65 73 61 00 01 00 00 00  |...eth0_esa.....|
107FF320: 06 0E 01 09 65 74 68 30  5F 65 73 61 5F 64 61 74  |....eth0_esa_dat|
107FF330: 61 00 65 74 68 30 5F 65  73 61 00 00 80 40 00 22  |a.eth0_esa...@."|
107FF340: 85 00 00 02 09 01 00 67  64 62 5F 70 6F 72 74 00  |.......gdb_port.|
107FF350: 28 23 00 00 01 13 01 00  69 6E 66 6F 5F 63 6F 6E  |(#......info_con|
107FF360: 73 6F 6C 65 5F 66 6F 72  63 65 00 01 00 00 00 02  |sole_force......|
107FF370: 14 01 13 69 6E 66 6F 5F  63 6F 6E 73 6F 6C 65 5F  |...info_console_|
107FF380: 6E 75 6D 62 65 72 00 69  6E 66 6F 5F 63 6F 6E 73  |number.info_cons|
107FF390: 6F 6C 65 5F 66 6F 72 63  65 00 00 00 00 00 01 0A  |ole_force.......|
107FF3A0: 01 00 6E 65 74 5F 64 65  62 75 67 00 00 00 00 00  |..net_debug.....|
107FF3B0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF3C0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
Made it readable and run found commands manually:

fis unlock fs
fs mount -d /dev/flash/fis/fs -t jffs2 /
load -m file /system/apps/clem.img
fs umount /
go -c -n

Code: [Select]

RedBoot>
fis unlock fs.fs
fis unlock fs.fs
No image 'fs.fs' found
RedBoot>
fis unlock fs
fis unlock fs
RedBoot>
fs mount -d /dev/flash/fis/fs -t jffs2 /
fs mount -d /dev/flash/fis/fs -t jffs2 /
RedBoot>
load -m file /system/apps/clem.img.fs
load -m file /system/apps/clem.img.fs
fs: Open failed, error 2
Can't load '/system/apps/clem.img.fs': error 0
RedBoot>
fs list
fs list
   1 drwxr-xr-x  1 size      0 .
   1 drwxr-xr-x  1 size      0 ..
   4 drwxr-xr-x  1 size      0 tmp
   5 drwxr-xr-x  1 size      0 user
   3 drwxr-xr-x  1 size      0 system
   2 drwxr-xr-x  1 size      0 checkpoint
RedBoot>
fs list tmp
fs list tmp
   4 drwxr-xr-x  1 size      0 .
   1 drwxr-xr-x  1 size      0 ..
RedBoot>
fs list user
fs list user
   5 drwxr-xr-x  1 size      0 .
   1 drwxr-xr-x  1 size      0 ..
  10 drwxr-xr-x  1 size      0 setup
  11 drwxr-xr-x  1 size      0 stored
   9 drwxr-xr-x  1 size      0 calibration
RedBoot>
fs list system
fs list system
   3 drwxr-xr-x  1 size      0 .
   1 drwxr-xr-x  1 size      0 ..
   6 drwxr-xr-x  1 size      0 apps
   7 drwxr-xr-x  1 size      0 health
RedBoot>
fs list system/apps
fs list system/apps
   6 drwxr-xr-x  1 size      0 .
   3 drwxr-xr-x  1 size      0 ..
jffs2_read_inode() failed
Unable to stat file system/apps/clem.img
So I get the error "Unable to stat file system/apps/clem.img".
Perhaps this image is somehow corrupted?

But now I'm pretty sure that I'll be able to load image into flash via xmodem.

[purpose]

 

[frenky]

With ExtraPuTTY I was able to load clem.img into mcu's memory:

load -m xmodem
go -c -n

But When I run "go -c -n" nothing happened so I'm a bit lost here...

Anyway I went into another path of finding all jtag intefaces...

First of ARM9 MC9328MXS mcu. I overlaid pinout from datasheet on  the back of pcb to see were are jtag bga pads:



Then I measured resistance to the header on the side of pcb, to find out which signal goes where:

trst   tms   tdo   tck   tdi
e37   e36   e34   tp19   tp21



Then used jtagenum to confirm that pins are correct:

ntrst:DIG_6 tck:DIG_3 tms:DIG_5 tdo:DIG_4 tdi:DIG_2 IR length: 4

Starting scan for IDCODE...
 ntrst:DIG_6 tck:DIG_3 tms:DIG_5 tdo:DIG_4 tdi:DIG_2  devices: 1
  0x1092001D

And yes this is correct id according to this: https://github.com/MonsieurV/msk/blob/master/apf9328flash.cfg

# The CPU - mc9328mxl
set _CHIPNAME mc9328mxl
set _ENDIAN little

# There is only one TAP
set _CPUTAPID 0x1092001d

[Terry01]

Frenky.

I have just been In my new 289 to check the cap, yours looks upside down compared to mine. Please don't shout at me for being a ***** IDIOT or anything like that. I may/probably be completely wrong. I am a complete beginner electronics wise to you guys so don't know much about these things. The cap looking upside down compared to mine jumped right out at me when I saw the picture of yours.

Hope this helps....

[Terry01]

If you wait till tonight UK time I will be able to get a decent quality pic of mine and post it?

[frenky]

Yes please do take a picture. 

[AnJu]

I connected my working Fluke 287 to the debug console.
But during boot I see only: +Entry point: 0x00060040, address range: 0x00060000-0x003beba0
When I send Ctrl C Fluke 287 shutdown and I see: $T02thread:00000001;0f:24930600;0d:64fc3b00;#f8
So I can't access to the RedBoot console.
Frenky, what the firmware version on your Fluke 287?

[AnJu]

I have seen, but it does not work for mine Fluke 287
I've come to the conclusion that access to the console is closed in the latest firmware 1.16
I found the old firmware version 1.1: http://www.elso.sk/media/download/sw-drv/fluke/28xUpdatePkg_V1_10.exe
But it does not allow me to make downgrade.
To bypass protection, I need to calculate (MD5?) signature in the manifest.txt or path the firmware updater Upd28X.exe

// MANIFEST SIGNATURE
!8a28a20042f8b0a4b31d041e9ccc4c18

Any ideas?

[FrankE]

Thank you Sir... sound advice... No air handy but just ordered some.

FFR: You can get air tins in Poundland. £1

[frenky]

I do not know about firmware version, because IR is not working.
To get to console you could try sending Ctrl+C every 100ms with a script on pc or microcontroller.
That should stop loading OS and show you redboot. In my case OS load fails so I get into redboot immediately.

[AnJu]

Frenky, I successfully downgraded to 1.1 version but the console works the same way. 
What terminal program did you use to access redboot?

[frenky]

ExtraPuTTY. http://www.extraputty.com/
So I could upload binary file with xmodem.

[AnJu]

Ok I will try connect with ExtraPuTTY.
Also please provide your working script too.

[frenky]

I do not have a script.
My fluke is faulty so on boot-up sequence it tries to load OS from ROM/Flash, but it can't find it. (Corrupted memory?)
So it stays in redboot.
But I have read, that if you send Ctrl+C early during boot it will stop booting OS and show redboot console.

[AnJu]

Pinout J6 ENET1
1   GND
2   nCS4
3   nEB3
4   nOE
5   GND
6   nRW
7   RESET_IN
8   TIN
9   GND
10   A1
11   A2
12   A3
13   GND
14   D0
15   D1
16   D2
17   GND
18   D3
19   D4
20   GND

Pinout J7 ENET2
1   GND
2   D5
3   D5
4   D7
5   GND
6   D8
7   D9
8   D10
9   GND
10   D11
11   D12
12   D13
13   GND
14   D14
15   D15
16   GND
17   VCC
18   VCC
19   VCC
20   GND

[radistx]

Hi everyone!
Please help me identify this component Q2 SMD SS S.

[frenky]

Great. Any info will be usefull.

I might have identified a few more elements:

1AM (sot23) 2N3904
ARB (SC70) TPS715
338 (sot23) NDS338N or BC338
A8L (sot23)  MMUN2234
2A (sot23) 2N3906
A41 (sot23) 1S2836 or OPA364
LTKH (S5) LT1615ES5-1
IL44 (sot23) perhaps BAT54S
A6W (sot23) BAS16
1R (sot23) MMBT5089
EHs (sot23) BCW66H
SS (sot23) BSS138
337 (sot23) NDS337N or BC337
R1E (sot23) LM4041EEM3-1.2
RAD (SC70-5) LM4041
5B1 (sot23) XC6106B032MR or XC9236A11CM
JY (sot23) BAV199
6B (sot23) 2N5484 or BC817-25

That was my guess too.

[radistx]

Another question. One meter was shot by high voltage I have good meter to compare to this is what I am getting on optocoupler. does anyone know what optocoupler part number is?

[sunfire]

I don't know the original part number for that, I used SFH 325 FA-3 (made by Osram) when I replaced one of those in my 287, works perfectly.

[Samogon]

I thought it is opto sensors for leads position, to alarm if leads in current but meter in other position

[coromonadalix]

thoses white optos are the leads detection ...

@radistx  have you pull out every mov / resistor / protection inputs and checked them,  checked pcb traces layout up to the dial contacts ... ??

[AnJu]

+fs: Open failed, error 2
Can't load '/system/apps/clem.img': error 0
err_printf: aborting command
load /system/apps/clem.img failed... trying /system/apps/BackupClem.img
fs: Open failed, error 2
Can't load '/system/apps/BackupClem.img': error 0
err_printf: aborting command
load /system/apps/BackupClem.img failed
No network interfaces found

RedBoot(tm) bootstrap and debug environment [ROMRAM]
Non-certified release, version v2_0_74 - built 08:38:05, Jun 25 2010

Platform: Fluke Clem (ARM9)
Copyright (C) 2000, 2001, 2002, 2003, 2004 Red Hat, Inc.
Copyright (C) 2003, 2004, 2005, 2006, 2007 eCosCentric Limited

RAM: 0x00000000-0x007fb500, [0x0004dd98-0x005d8500] available
FLASH: 0x10000000-0x10ffffff, 127 x 0x20000 blocks, 4 x 0x8000 blocks
RedBoot> help
Manage aliases kept in FLASH memory
   alias name [value]
Set/Query the system console baud rate
   baudrate [-b <rate>]
Manage machine caches
   cache [ON | OFF]
Display/switch console channel
   channel [<channel number>]
Compute a 32bit checksum [POSIX algorithm] for a range of memory
   cksum -b <location> -l <length>
Test clock accuracy
   clock
Display (hex dump) a range of memory
   dump -b <location> [-l <length>] [-s] [-1|-2|-4]
Execute an image - with MMU off
   exec [-w timeout] [-b <load addr> [-l <length>]]
        [-r <ramdisk addr> [-s <ramdisk length>]]
        [-c "kernel command line"] [-t <target> ] [<entry_point>]
Manage FLASH images
   fis {cmds}
Manage configuration kept in FLASH memory
   fconfig [-i] [-l] [-n] [-f] [-d] | [-d] nickname [value]
Manage Filesystem files
   fs {cmds}
Execute code at a location
   go [-w <timeout>] [-c] [-n] [entry]
Help about help?
   help [<topic>]
Display command history
   history
Set/change IP addresses
   ip_address [-b] [-l <local_ip_address>[/<mask_len>]] [-h <server_address>] [-d <dns_server_address]
Load a file
   load [-r] [-v] [-d] [-h <host>] [-p <TCP port>][-m <varies>] [-c <channel_number>]
        [-b <base_address>] <file_name>
Compare two blocks of memory
   mcmp -s <location> -d <location> -l <length> [-1|-2|-4]
Copy memory from one address to another
   mcopy -s <location> -d <location> -l <length> [-1|-2|-4]
Fill a block of memory with a pattern
   mfill -b <location> -l <length> -p <pattern> [-1|-2|-4]
Network connectivity test
   ping [-v] [-n <count>] [-l <length>] [-t <timeout>] [-r <rate>]
        [-i <IP_addr>] -h <IP_addr>
Reset the system
   reset
Display RedBoot version information
   version
Display (hex dump) a range of memory
   x -b <location> [-l <length>] [-s] [-1|-2|-4]

[frenky]

You are getting the same error as I am.
Please post here any updates that might help me or others with fixing fluke 287/289.

[AnJu]

JFFS2 image from working Fluke 287 see the attached files.
Can you extract BackupMeter.hex and clem.img from it?

[nixxon]

@retiredcaps
If there would be something wrong with the input protection, what would be the symptoms for the device? I would assume that the device should boot up normally, but one could not make any measurements. My unit doesn’t display anything on the LCD, but most of the voltages on test points seem to be similar to those listed by @purpose and @frenky. Can I assume that any potential issue with the input protection does not have anything to do with blank LCD?
I’ve just measured voltages as @sacral described in post #39 and below are those, for which I got different readings.

@sacral
My unit powers down after few minutes and so the voltages are changing. Maybe some of the measurements you’ve made were made after the “sleep”? I’m just asking. It is probably different because mine is broken

Here are deviations from @sacral list:
TP 1: 0.005
TP 3: 4.96
TP 9: 2.28
TP 16: 2.91
TP 18: 1.81
TP 32: 3.07
TP 33: 3.07
TP 34: varies in a mV range
TP 37 0.057

How can I test the LCD? Anybody can give me some simple guiding for this task, so I could eliminate the faulty LCD, please?

I bought a faulty 289 yesterday. After some internet search I ended up reading through this thread.

Yakuzza: Somehow I believe I have ended up with your particular 289 multimeter with a non working LCD display (background light is good). So everything you have written in this thread about your 289 applies to the 289 I  bought yesterday.

What is new information regarding the particular 289 is that I connected it to my computer via the IR189USB rev. II interface. All readings look good in FlukeView Forms... Does this fact imply that the problem is simply regarding the LCD display hardware?

The resistance reading is a little funny, reading 25 MegaOhms initially, but after shorting the probes for a brief moment it reads ~3.7 MOhms with open probes...

I have a 5 year old NIB 287 that is barely powered up a couple of times. I am considering swapping LCD's from the 287 to the 289 to figure out if only the 289's LCD is broken. However I am reluctant to disassembling my 287 as it is in mint condition.

Is it possible to do a factory reset via the IR189USB interface cable?

Is it possible to use the RS-232 serial type command "RSM" as described here: http://uniteng.com/neildocs/facilities/Fluke289_remote_spec28X.pdf

RMP
Reset Meter Properties

Reset meter properties to their factory default state.
This is the same operation as Reset Setup under
Setup front panel soft key.

[retiredcaps]

The resistance reading is a little funny, reading 25 MegaOhms initially, but after shorting the probes for a brief moment it reads ~3.7 MOhms with open probes...

So the DCV and ACV mode are accurate?  Just resistance is bad?

To confirm, with open probes you get 25M ohm?  If you short the probes, you get 3.7M ohm?

[nixxon]

After turning the dial into resistance mode, the display shows 25 M Ohms while probes are open circuit.
Shorting the probes gives a reading of 0.15 - 0.25  0.09-0.10 Ohms
When the probes are separated again, the display doesn't return to 25 M Ohms, but shows ~3.7 M Ohms (while probes are open circuit)

[retiredcaps]

After turning the dial into resistance mode, the display shows 25 M Ohms while probes are open circuit.

When the probes are separated again, the display doesn't return to 25 M Ohms, but shows ~3.7 M Ohms (while probes are open circuit)

The non display of 0L might indicate that one or more of your input protection circuits has been damaged.

You can measure all in circuit and see if they are good.  If not, desolder them to verify.

A MOV should measure infinite resistance.  The PTC should be around 1.1k ohm.  The fusible resistor should be around 1k ohm.

[nixxon]

I forgot to mention that the VAC and VDC measurements are all good compared to my Fluke 83V.

The screenshot from the 289 FW 1.16 installer reveals the software and hardware versions.

Should I press the "Next" button and go for a 1.16 update? Maybe everything will be working again after a fresh FW install?

[nixxon]

I performed the FW 1.16 update and all seemed well. The installer confirmed update was competed and everything seemed ok with the install.

Just after atomatic reboot of the 289 it started beeping 4 times per second.
I started FlukeView Forms, but could see no data from the DMM in FlukeView Forms anymore.

I was certain I had bricked this sick puppy for good.

I completed a firmware install again with no error messages, but there was no change in meter behavior. Just beeping. Almost the same way as when you have your probes connected the wrong way...

So - after fiddling with the rotary switch and buttons, I managed to silence the meter by setting the selector to current measurement mode (A/mA or uA), while probes are connected to the COM and V/Ohm jacks.
The data is again registered in FlukeView Forms.

While in current measurement mode, the meter is silent until I move the red probe from the V/Ohm-jack to the appropriate A jack. This behavior is opposite of what to expect.

Connecting the red lead to the mA/uA jack does not make the meter beep.

Maybe the probe position sensor logic in the A jack has failed in some way (inverted signal)?

For the first time it is now possible to turn the meter off with the soft on/off button.

[nixxon]

Suddenly the meter was beeping all the time no matter where the jacks were connected.

I cleaned some of the input areas, components Q24, Q27 and DS2 with Q-tips + IPA.

I also resoldered a corroded looking solder joint on the tiny DS2 diode between the current inputs.

Now the Current Terminal Sensing works as it should - Only beeping (4 times per second) when jack a jack is inserted in any current input and not corresponding selection on rotary selector.

Now I have to figure out why the LCD doesn't show any information.

[coromonadalix]

Is the flexible pcb foil is well inserted in the white connector or have some physical damage ?   maybe pull it out and replug it ?

[Terry01]

Nice! That's 1 less thing to be sorted out. You'll have it up and running properly before you know it my friend. 

[nixxon]

I measured oscillators/crystals  Y1 and Y2.
Y1 oscillates steadily at 32.764 kHz.
Y2 oscillates steadily at 32.766 kHz.

Y1 signal amplitude is however relatively low, only 200 mVpp (measured between ground [negative pad] and either oscillator terminals).
Y2 signal amplitude was easier to measure with an amplitude of 900 mVpp.

Does anyone know the right specs of Y1 and Y2?

[nixxon]

Is the flexible pcb foil is well inserted in the white connector or have some physical damage ?   maybe pull it out and replug it ?

I haven't noticed any PCB foil inside the meter. I will look for it and the white connector the next time I get some spare time to do more troubleshooting.

[coromonadalix]

When the back case of the meter is removed, you see an white connector with an yellowish flexible foil who go to the front panel,  named J3 on the pcb, this is the lcd supply and data connector.

https://www.eevblog.com/forum/reviews/fluke-287-dmm-teardown-and-photos/?action=dlattach;attach=11256

OR

like this lcd picture on Ebay : https://www.ebay.co.uk/itm/U-S-A-FLUKE-289-LCD-Display-Meter-Display-Fluke-LCD-OEM-new-/262485299580

[nixxon]

When the back case of the meter is removed, you see an white connector with an yellowish flexible foil who go to the front panel,  named J3 on the pcb, this is the lcd supply and data connector.

https://www.eevblog.com/forum/reviews/fluke-287-dmm-teardown-and-photos/?action=dlattach;attach=11256

OR

like this lcd picture on Ebay : https://www.ebay.co.uk/itm/U-S-A-FLUKE-289-LCD-Display-Meter-Display-Fluke-LCD-OEM-new-/262485299580

The flat flex ribbon cable for the LCD display looks like new. I undo it practically every time I take the meter apart to troubleshoot. If i seat the cable while the DMM is running, I can see funny artifacts on the LCD screen. So the LCD seems to be «alive and kicking»

[Yakuzza]

@nixxon
Hello! Have you picked up the meter in Oslo? I see you've went much further than I did in this attempt to rescue the poor unit. I gave up few months ago but I hope you will succeed!
Good luck!

Sent from my SM-G935F using Tapatalk

[nixxon]

@nixxon
Hello! Have you picked up the meter in Oslo? I see you've went much further than I did in this attempt to rescue the poor unit. I gave up few months ago but I hope you will succeed!
Good luck!

Sent from my SM-G935F using Tapatalk

Yes, I picked up the meter in Oslo three days ago. From you I guess. I suspect that the blue-green stuff that was found inside the unit is both corrosive and somewhat conductive. One of the solder pads for component DS2 was partly corroded away and made poor contact with the funny looking and somewhat transparent component DS2 with a diode-like symbol printed on the silk screen.

[commongrounder]

@nixxon
Hello! Have you picked up the meter in Oslo? I see you've went much further than I did in this attempt to rescue the poor unit. I gave up few months ago but I hope you will succeed!
Good luck!

Sent from my SM-G935F using Tapatalk

Yes, I picked up the meter in Oslo three days ago. From you I guess. I suspect that the blue-green stuff that was found inside the unit is both corrosive and somewhat conductive. One of the solder pads for component DS2 was partly corroded away and made poor contact with the funny looking and somewhat transparent component DS2 with a diode-like symbol printed on the silk screen.

Would DS2 be the surface mount LED light source for the lead sensors? Its position directly between the jacks would imply it works as a common source for both photosensors. Wonder if there is a reflective part in the cover to split and redirect the light in the needed directions? The lack of light due to the corroded pad on the LED could explain why the meter was confused about the current jacks lead state.

[nixxon]

Commongrounder: I really dont know how the «current terminal sensing» works. There are two components (Q24 and Q27) «looking» at each other across both terminal cavities. I would, with my limited electronix knowledge, assume that one side was active and the other was passive. However, both Q24 and Q27 are active components. I even dont know if the terminal sensing discriminates between the two current terminals. I will have to check it out when I get home tomorrow. For all that I know, the DS2 component may register an inserted probe jack and is able to discriminate between the two current terminals throug differently coded signals missing from either Q24 or Q27 when a jack is inserted.

If someone more experienced could share his or her thoughts about how the optical current terminal sensing works in the Fluke 287/289, I would surely be happy to read about it...

[commongrounder]

So, I own a 289, and took a peek through the current jacks (not inclined to disassemble it at this time as I’m using it today). I can see a clear plastic prism reflector between the current jacks that appears to be part of the molded plastic jack frame. The light isn’t visible, but I have a small infrared probe which detected IR light in the jack cavities. I believe the diode is an IR LED, and the two outer devices are IR photo transistors. I was able to prove this, as well as understand the reasoning, by trying different combinations of plug insertions. The beeps are in conjunction with an on-screen warning of improper lead positioning. 1) Warning when lead(s) are inserted in current jack(s) in any mode but current measurement modes. 2) Warning when lead is not inserted into one or the other current jack in current measurement modes only. 3) Warning when plugs are inserted into *both* current jacks at the same time, in current measurement modes. Obviously, 3) is not a proper lead configuration for any purpose. This can only be discerned with two independent optical sensors.
Hope you can get the display up and running again. Best of luck.

[nixxon]

Aha, so the tiny guy in the middle (DS2) is the active part and the powered Q24 and Q27 are the sensors? Wow, My mind was set the other way around. The «optical» part of DS2 looks so small. But the transparent top edges of DS2 are angled 45 degrees both left and right and would transmit both ways towards both Q24 and Q27, across both cavities.
[EDIT: Actually there is a transparent optical path between the two A - mA/uA input jacks. The top surface of the DS2 touches the middle of the optical path surface.]

[ElecSeb]

Q24 & Q27 = SFH 325 FA-3/4-Z - SIDELED® Silicon NPN Phototransistor in SMT SIDELED®-Package
DS01 = SMD LED (exact type unknown atm)

[nixxon]

(...)
In addition, which I didn’t mentioned this at the beginning, there was a bit of greenish dried fluid marks in on PCB close to Amper input (between the two left input jacks) and similar thing on the top corner of the LCD, close to the soldered wires. I’ve clean it but found no source.
(...)

Very interesting information about the LCD top corner... I will check it out next...

[nixxon]

After turning the dial into resistance mode, the display shows 25 M Ohms while probes are open circuit.

When the probes are separated again, the display doesn't return to 25 M Ohms, but shows ~3.7 M Ohms (while probes are open circuit)

The non display of 0L might indicate that one or more of your input protection circuits has been damaged.

You can measure all in circuit and see if they are good.  If not, desolder them to verify.

A MOV should measure infinite resistance.  The PTC should be around 1.1k ohm.  The fusible resistor should be around 1k ohm.

I will have to figure out a way to identify the components that are involved in measuring resistance. I guess watching some of David L. Jones' old DMM teardown videos will be helpful.

In the meantime I used another DMM to measure the voltage output of the 289 terminals (COM and V) while the 289 was in resistance mode. Initially (while displaying 25 M Ohms) the voltage is 1.92 volts. After the terminals have been shorted momentarily the voltage increases to 2.76 volts (while displaying 3.7 M Ohms).

Does anyone have any idea what is going on, and why the voltage increase after the probes have been shorted?

I measured the blue Metal Oxide Varistors (MOV) and they did not show infinite resistance:
RV1: 17.5 M Ohm
RV2: 24.0 M Ohm (not stable)
RV3: 23.5 M Ohm (not stable)

Can they all be bad? I have read that "When MOVs degrade they become more conductive after they have been stressed by either continuous current or surge current." Source: https://iaeimagazine.org/magazine/2004/03/16/metal-oxide-varistor-degradation/

The black Positive Temperature Coefficient (PTC) thermistors were measured ok:
RT1: 1.1 k Ohm
RT2: 1.2 k Ohm


The fusible resistor R4 has a good resistance of 1.01 k Ohm

I also measured the main fuses
XAF1 ("DMM 44/100"): 0.8 Ohm
XAF2 ("DMM-11A"): 0.1 Ohm.

Is XAF1 supposed to have such a high resistance? It seems wrong.

Now I will read the Service Manual for Fluke 76 Chapter 2 Theory of operation and hopefully learn quite a few things about how this and other DMM's work...
I found it here: http://assets.fluke.com/manuals/76______smeng0000.pdf

[retiredcaps]

I measured the blue Metal Oxide Varistors (MOV) and they did not show infinite resistance:
RV1: 17.5 M Ohm
RV2: 24.0 M Ohm (not stable)
RV3: 23.5 M Ohm (not stable)

Can they all be bad?

Desolder all the MOVs and re-measure them out of circuit.  With the MOVs removed, see if the meter works on resistance mode.

Verify that ACV and DCV works with the MOVs on low energy circuits (i.e. no mains, etc).

I also measured the main fuses
XAF1 ("DMM 44/100"): 0.8 Ohm
XAF2 ("DMM-11A"): 0.1 Ohm.

Is XAF1 supposed to have such a high resistance? It seems wrong.

The fuses only affect current measurement.

[retiredcaps]

In the meantime I used another DMM to measure the voltage output of the 289 terminals (COM and V) while the 289 was in resistance mode. Initially (while displaying 25 M Ohms) the voltage is 1.92 volts. After the terminals have been shorted momentarily the voltage increases to 2.76 volts (while displaying 3.7 M Ohms).

When the non working 289 is set to DCV, its input impedance should be around 11.11M ohm.

[nixxon]

In the meantime I used another DMM to measure the voltage output of the 289 terminals (COM and V) while the 289 was in resistance mode. Initially (while displaying 25 M Ohms) the voltage is 1.92 volts. After the terminals have been shorted momentarily the voltage increases to 2.76 volts (while displaying 3.7 M Ohms).

When the non working 289 is set to DCV, its input impedance should be around 11.11M ohm.

When the non working 289 is set to DCV, its input impedance is shown alternating between 11.004 or 11.005 M Ohm on my good 287 and alternating between 11.00 and 11.01 M Ohms on my good 83V. So the impedance of the non working 289 is ~0.105 M Ohm or ~105 k Ohm lower than what you suggested.

A comparison:
When my good 287 is set to DCV, its input impedance is shown as (10.982 M Ohm on the non working 289 and) alternating between 10.99 and 11.00 M Ohm on my good 83V. (and steady 11.00 M Ohm on my 87 (version 1)).

After shorting the probes on the non working 289 for a moment (open probes display 3.7 M Ohm), the reading on the 289 is lowered from 10.982 to 3.6542 M Ohms while the DUT 287 shows 2.7498 VDC. Lots of figures. Go figure...

Are you shure the imput impedance of a 287/289 in VDC mode is supposed to be 11.11 M Ohms?  (rather than 11.00 M Ohms)

The input impedance of my 83V and 87 (version1) in VDC mode are both ~11.11 M Ohms, though.

[nixxon]

The faulty 289 (while in resistance measurement mode) goes from 25 M Ohms open circuit to 3.7 M Ohm open circuit after a resistance below 3.7 M Omhs is registered. Check enclosed log graph where you se me touching both the probes firmer and firmer until measured resistance goes below 3.7 M Ohm.

[nixxon]

In order to troubleshoot the 289 LCD that is not working, I am thinking about using my fully working 287's parts for troubleshooting.

I want to figure out if the LCD of the non working 289 is all right.

What is the best way to go:

1) Connecting the working 287's LCD to the non working 289 multimeter? or
2) Connecting the non working 289's LCD display to the working 287 multimeter?

[ElecSeb]

Expected non-working LCD to Working DMM.
This way when it works you know for sure the LCD works.

Other way around when good LCD attached to defect DMM, you know screen from new unit is good, but if it does not work, you know the Mainboard of the defect DMM is broken. But till that moment you still do not know if the suspected LCD is broken.

My 2 cents

[nixxon]

Expected non-working LCD to Working DMM.
This way when it works you know for sure the LCD works.

Other way around when good LCD attached to defect DMM, you know screen from new unit is good, but if it does not work, you know the Mainboard of the defect DMM is broken. But till that moment you still do not know if the suspected LCD is broken.

My 2 cents

I did as you suggested. The LCD from the 289 woke up fine when connected to my good DMM (287).

It seems that the LCD driver circuit on the 289 is no good. I noticed that one of the crystals had a low amplitude (200 mVpp) the way I measured it. According to the Fluke 27 Service Manual a similar 32.768 kHz crystal should measure 600 mVpp or more.:

• 4. Connect either an oscilloscope or frequency counter, using a low-capacitance probe,
  to pin 54 of U1 or to the junction of C17 and Y1 (the crystal). A 32.768 kHz sine
  wave with an amplitude of approximately 600 mV peak-to-peak should be present at
  the junction of C17 and Y1 (3 V peak-to-peak at U1 pin 54). Note that U2 and the
  display will not operate if the clock signal is not present. If the clock signal is not
  present, the most likely causes are U1, Y1 or C17.

Can a missing (or low) clock signal be a part of the LCD problem when the rest of the meter seems to be working ok?

[ElecSeb]

At this moment I do not have a scope available (bought a new one recently and is still in transit).
However did you measure your power lines?

And how do you know that the unit powers-on (sorry if I missed it in your posts).

[nixxon]

At this moment I do not have a scope available (bought a new one recently and is still in transit).
However did you measure your power lines?

And how do you know that the unit powers-on (sorry if I missed it in your posts).

Hello. Good luck with your new scope. Are you planning to use it to do measurements on a working 287/289?

I have not measured power lines. I  bought the 289 as non working.

I have fixed one fault in the current terminal sensing and updated the firmware from v1.10 to v1.16.

I can read the 289's "screen" via the IR189USB interface on my computer using FlukeView Forms.

Now I am trying to fix it's LCD driving circuit (LCD itself is working) and the resistance measurement function not reaching "OL" while probes are open circuit.

[ElecSeb]

This means the green light from the power button is "ON"?
And concerning SCOPE -> I will measure, but I do not have a working unit.

[Samogon]

OL on open corcuit is ok.

[nixxon]

OL on open corcuit is ok.

The meter never displays "OL" in resistance measuring mode. After selecting resistance mode on the rotary switch the DMM displays 25 Mohms initially wile open circuit. If I measure anything with a resistance lower than 3.7 Mohm, the open circuit resistance is displayed as ~3.7 Mohm.

The DMM is latched to ~3.7 Mohm max. (while open circuit) until the rotary switch is rotated to some other mode and then back to resistance mode. Then the DMM indicates 25 Mohm again open circuit.

ElecSeb: Yes, the power button shows a green light for a few seconds while the DMM is booting. Just like a fully functional 287/289.

[nixxon]

Today I was troubleshooting the Y1 crystal with the low amplitude signal, still 200mVpp. The input position sensors were however acting up again, beeping all the time. I managed to silence the beeps if I put a piece of paper or a piece of tape along the optical path. It is almost like the transmitter in the middle was transmitting at a wrong angle and that the piece of paper reflected the IR light back onto the receivers.
[EDIT: This makes sense because when the top cover is separated fromt the PCB, the optical path from DS2 to both Q24 (A jack sensor) and Q27 (mA/uA sensor) is removed]


The Y1 frequency was all over the place, varying between 32.667 and 32.720 kHz (using short gate time on the frequency counter due to significant frequency variations)
The Y2 crystal was pretty steady and varied only between 32.7660 and 32.7661 kHz (longer gate time  possible with the stable frequency).

The green light is not lighting up any more during booting, and there is no relay clicking during the boot. (Normally there is a relay click as the green light turns on, and another click as the green light turns off)
[EDIT: It seems that the green diode has failed as it measures 1.9 ohms both ways.]

In other words, there were quite a few setbacks today.   

[ElecSeb]

Well, start with "off-state" and measure all V on the defined testpoint +-33 TP.

My fluke 289 is turning the greenled on for a short moment, then turns-off, but no screen.
Also no power from the torex PWM IC.
But unfortunately I do not have a lot of time during the day to test mine. I will try this afternoon.

I have created a XLS with all TP and reference values found in this thread (ON & OFF).
Furthermore I have created a second tab with all components I have identified so far. On mine I have tested all SOT32 elements (which are all OK).
I need to add this test data to this XLS before upload.
And last I have added a link to the specific component (I do not guarantee it is 100% correct, but I think it will come close, but any addition later on will be great!).

Only thing I am missing at the moment is a comprehensive TP layout. IN earlier posts some mention TP which are unknown to me (cannot find them visueally and in Calibration manual they are also not mentioned).

Hope to add this info to this topic soon.

[ElecSeb]

Update from my side:
This afternoon I have finished my analysis from all SOT23 elements. All seem to be fine.
However last time I was playing with it I massively f&ckedup and created a shortage on U20. This now results in having a short between L1 and ground 
Initially the unit did not work and I broke L1 coil, burned 2 capacitors and removed the super-cap. Also removed burned C27 and C36 (hot air destroyed them)
The issue with my unit is, that when I turn it on, I see a green led for lets say 2 seconds, no screen and no power (unit is really off). Therefore I have checked all SOT23 elements.
I have looked-up up almost all data-sheets to see which IC's are used and next is to figure out why some voltage lines are not comparable with a post earlier in this threat.

Luckily I recently purchased a toneohm 850. 1 problem, I never ever used such a device, so I need to figure out how to trace to the broken component.
I already removed CR9, C79 and C67 (randomly -> goose-chase). But I need to do this more structured -> Toneohm.

I have some questions for here on the board already:
1. What are these components (ideally with link to a data-sheet):
Q12, Q13 -> Code 337 -> FDN337N -> N-Channel Enhanced Mosfet + body diode -> Cannot find any data-sheet
Q20, Q21, Q43 -> Code 338 -> NDS338N -> P-Channel Enhanced Mosfet + body diode -> Cannot find any data-sheet
U11 -> Code S08H -> No Idea (AND port?)

2. What is the difference between VR05 and U04 (why is one name with a "U" and the other "VR"):
VR05 ->Code 8H -> MMBZ5233BLT1G -> Zener Voltage Regulators 225 mW SOT−23 Surface Mount
U04 -> Code R1E -> LM4041 -> LM4041-N-xx Precision Micropower Shunt Voltage Reference

3. Is this part a correct replacement for the white capacitors (high precision) -> C27 and C36
Code 223 KZS -> Kemet SMC F125PP223J100
(Original part is in PL housing, but that seems not for sale, however size is then upgraded to PP, SMC series, 223 matches. However KZ is still unknown in code name) -> Any help would be highly appreciated!

@Nixxon:
If your unit is not doing anything anymore, check if U17 is actually giving juice (even when powered off.
U17 =  Code PCYI -> TPS770 -> Power 5V   ULTRALOW-POWER 50-mA LOW-DROPOUT LINEAR REGULATORS

Tomorrow I will try to find my shortage with my toneohm and once fixed I will dig into this unit a little further.

[ElecSeb]

3. Is this part a correct replacement for the white capacitors (high precision) -> C27 and C36
Code 223 KZS -> Kemet SMC F125PP223J100
(Original part is in PL housing, but that seems not for sale, however size is then upgraded to PP, SMC series, 223 matches. However KZ is still unknown in code name) -> Any help would be highly appreciated!

Update from Kemet concerning KZS:
Please find below the explanation about the marking for our SMC series:

• 223 is the tolerance code for 0.022uF
• K is the capacitance tolerance code – +/-10%, but as per our catalog we not manufacture only +/-5%, +/-2.5%, +/-2%,
• Z is the code for the voltage means 50VDC
• S stands for SMC

I suppose that the correct PN would be SMC5.7223(1)50J33(2)
Where:

• 1=J (5% -> which is the only one on Farnell)
• 2=Just packaging -> not important for ordering

SMC5.7223J50J33

[ElecSeb]

@Nixxon any progress?

[nixxon]

@Nixxon any progress?

Not yet. I am figuring out how stuff works by studying the Fluke 27 Service Manual. That manual includes schematic diagrams as well.

I am also studying how graphical LCDs work, possibly gaining useful knowledge by reading links like:
https://www.microcontroller-project.com/128x64-graphical-lcd.html this one has a 20-pin connector as does the 287/289 320X240 pixel LCD display. I wonder how similar the pinout is.

And why do some graphical LCD's, like the Nokia 84x84 pixel displays, only need 8 pin connectors to work? I will have to read more about this stuff. This could be a start: https://learn.sparkfun.com/tutorials/graphic-lcd-hookup-guide/all

It looks like the LCD flat flex connector traces lead go to the area close to the PCB flip side MC9328MXS chip that includes an LCD controller. I guess I have to study the pinout and do some measurements.
https://www.nxp.com/docs/en/data-sheet/MC9328MXS.pdf

The i.MX Family of applications processors provides a
leap in performance with an ARM9™ microprocessor
core and highly integrated system functions. The i.MX
family specifically addresses the requirements of the
personal, portable product market by providing
intelligent integrated peripherals, an advanced processor
core, and power management capabilities.
The MC9328MXS (i.MXS) processor features the
advanced and power-efficient ARM920T™ core that
operates at speeds up to 100 MHz. Integrated modules,
which include a USB device and an LCD controller,
support a suite of peripherals to enhance portable
products. It is packaged in a 225-contact MAPBGA
package

[ElecSeb]

Since I am not that far with my unit I cannot do this (yet).
But why not using your (scope) and test the signals from the connector and sees what comes up?

Furthermore, some posts earlier you mentioned that your device did not power on anymore. Got it fixed?

[nixxon]

Since I am not that far with my unit I cannot do this (yet).
But why not using your (scope) and test the signals from the connector and sees what comes up?

Furthermore, some posts earlier you mentioned that your device did not power on anymore. Got it fixed?

For some reason I would like to know what to expect before probing the LCD circuit.

My 289 has been powering on all the time. However there is no longer a green light while booting anymore. It seems to be a correlation between the current jack sensing circuit acting up and the green startup light not working.

[say]

I ran into a Fluke 289 that was working perfectly except some problem in the lcd display. Initially the display showed black vertical lines. Typically this happens when flat flex cable glue detaches from the LCD display.

I disassembled the display and heated the flat flex and applied some pressure. The black vertical lines disappeared but then I realized that there was another problem too. The display also had evenly spaced vertical lines of missing pixels. Repeated application of heat and pressure didn't resolve this issue. I concluded that one of the 20 pins has developed some sort of bad connection on the main board. Here are before and after heat/pressure treatment pics of the display.

[Terry01]

There's a guy on Ebay somewhere in the US who sells lots of genuine Fluke parts. I haven't seen him selling flat cables or components or things like that. He sells more cases, screens and buttons things like that. He does sell some LCD's though so maybe he would be able to source the cable you need if you messaged him? Worth a shot if it gets your meter running again?

[say]

Thanks Terry01. I'm not skilled enough to change the flat flex cable on the LCD display. May be a replacement LCD would be a better choice if I could find a cheap one .

Sent from my SAMSUNG-SM-N920A using Tapatalk

[Terry01]

No prob. The guy has normal LCD displays for sale for around £35 for other Fluke modals but I take it the 289's screen will be more expensive? You could shoot him a mail. No harm in asking and if it gets you a working 289 it'll be worth spending a little ££'s on it. If it turns out he can't get you 1 or it's too expensive you won't have lost nothing asking right? Here's his Ebay site. Good luck buddy!

http://www.ebay.co.uk/usr/fluke-usa?_trksid=p2053788.m1543.l2754

[dacman]

Have you asked Fluke if the meter is under warranty?  Some 289's have a limited lifetime warranty.

[say]

No prob. The guy has normal LCD displays for sale for around £35 for other Fluke modals but I take it the 289's screen will be more expensive? You could shoot him a mail. No harm in asking and if it gets you a working 289 it'll be worth spending a little ££'s on it. If it turns out he can't get you 1 or it's too expensive you won't have lost nothing asking right? Here's his Ebay site. Good luck buddy!

http://www.ebay.co.uk/usr/fluke-usa?_trksid=p2053788.m1543.l2754

It didn't work out.

[say]

Have you asked Fluke if the meter is under warranty?  Some 289's have a limited lifetime warranty.

It also didn't work out.

[Terry01]

Where in the world are you? You might live near or within reasonable posting distance of one of the more experienced members who could replace the flex for you no probs if that turns out to be the problem on your meter. I am sure if you get the flex which may or may not be too expensive someone here on the site would fit it for you. The guys here are very helpful to those of us who are not so experienced. Worth a shot if the flex turns out to be cheap and easy to get.

Just another idea? 

[coromonadalix]

The 289 lcd   
https://www.ebay.com/itm/U-S-A-FLUKE-289-LCD-Display-Meter-Display-Fluke-LCD-OEM-new-/262485299580


You see the picture,  the lcd flex can't be changed  unless mistaken


And the Aliexpres suckers sell it way higher 

[say]

As if the LCD problem wasn't enough, the meter died today for no apparent reason. Now when I push the power button, the green LED (power button) blinks five times, pauses and then the cycle repeats itself. Every few cycles the LCD also flickers momentarily as if the meter is trying to reboot but fails. Removing the LCD doesn't alter the cycle. Removing the supercap also didn't help. The problem is similar to a failed/leaking capacitor but I don't know which one. The only way I can stop the power button from blinking is by removing the batteries.

[Terry01]

Sounds like you need the help of someone who really knows their way around the 289 

[say]

Sounds like you need the help of someone who really knows their way around the 289 

Thanks Terry01. I'm sure someone will step forward to help;)

[Terry01]

Sounds like you need the help of someone who really knows their way around the 289 

Thanks Terry01. I'm sure someone will step forward to help;)

I'm sure they will. There are a lot of very knowledgeable people on the forum and they are usually keen to help where they can. That's the thing with these meters, they are awesome bits of kit but when they break down or whatever it can take a genius to sort them. I've seen the guys help fix loads of things from just a picture or a description of the problem!

Hope you get it sorted buddy! I love mine!

[say]

Only thing I am missing at the moment is a comprehensive TP layout. IN earlier posts some mention TP which are unknown to me (cannot find them visueally and in Calibration manual they are also not mentioned).

Hope to add this info to this topic soon.

This might help

[say]

I have also tried to identify some of the voltage supply ICs, which might be helpful:

U17 is a 5 volt regulator.
U42 19AI25 is 2.5V precision reference, which I believe is connected to COMM jack.
U44 is an adjustable supply set to 1.9V as per my calculation.
U21 is a 20V LCD supply,  I guess.
There is a U15 IC, which I could not locate but guess it's hidden under U42. I also guess it would be 3.3V (or 3.11V)  regulator.

U18 is a voltage supervisor IC, which shuts down the MS430 if one of the monitored voltage supplies fail.

Any correction/comments on the above data would be welcome.

[ElecSeb]

I have also tried to identify some of the voltage supply ICs, which might be helpful:

U17 is a 5 volt regulator.
U42 19AI25 is 2.5V precision reference, which I believe is connected to COMM jack.
U44 is an adjustable supply set to 1.95V as per my calculation.
U21 is a 20V LCD supply,  I guess.
There is a U15 IC, which I could not locate but guess it's hidden under U42. I also guess it would be 3.3V (or 3.11V)  regulator.

U18 is a voltage supervisor IC, which shuts down the MS430 if one of the monitored voltage supplies fail.


Any correction/comments on the above data would be welcome.

U42 is non existent to my idea, this should be U15 (look at leads of chips and regular naming).
U15 belongs to nothing else and it seems this is a multi-purpose PAD/IC.
U44 is 3.6V
U18 OpAmp

Only thing I am missing at the moment is a comprehensive TP layout. IN earlier posts some mention TP which are unknown to me (cannot find them visueally and in Calibration manual they are also not mentioned).

Hope to add this info to this topic soon.

This might help

Nope, this I know, but read earlier posts, there are folks who are mentioning:
https://www.eevblog.com/forum/repair/fluke-289-woes/msg1380051/#msg1380051

[say]

ElecSeb thank you for chipping in. IMO the list of TPs you are referring to is just a list and the crosses against some TPs reflect their absence on the board.

Since I'm on vacations now, I can't test the output of U44 but according to the datasheet its an adjustable LDO regulator. It's output is determined by the formula Vo=1.205 (1+R2/R1). In the circuit R1=1Mega Ohm and R2=0.562 Mega Ohm, therefore, the Vout equals approx 1.9V. I may be wrong but if someone could test the output, which is on pin5, we will know for sure. Or I will do that after ten days .

[ElecSeb]

It's output is determined by the formula Vo=1.205 (1+R2/R1). In the circuit R1=1Mega Ohm and R2=0.562 Mega Ohm, therefore, the Vout equals approx 1.9V. I may be I'm wrong but if someone could test the output, which is on pin5, we will know for sure.

On R258 is the code: 562 (with a 4th char not readable, however it seems like an S). Just de-soldered one and it is 562 kΩ (0.562MΩ).
I calculate based on: 562kΩ

Which then leaves us with:
Vo=1.205 (1+(R1/R2)) -> Please be careful with formulas (see brackets)
Vo=1.205 * (1+(1MΩ/0.562MΩ))=3.34V (which is what I measure on my 3 boards -> 2.9V, 3.14V and 3.00V!!!)

So I think I can 100% surely say it should be between 3.0 and 3.34V

Your formula is faulty (should be R1/R2 furthermore first divide/multiply then subtract etc).

Which leaves us with the question, is your measurement 1.9V? Then there is a problem in your circuit.
Please answer the questions from my other topic before I can help you in giving you directions.

An update on my meters:
2 NXP chips are broken (short);
1 and possibly 2 MSP430 are broken (hope to use the 2nd to read program from with MSP programmer when it arrives, same for 3rd chip). Big chance they are all blown).

So for now I am stuck waiting for the programmer.

[say]

@ElecSeb

You are right. I wrote the formula from memory and made a mistake. Thanks for the correction.

Since I'm currently travelling, I'm not in a position to check the TPs and resistances. When I return I will post a reply with requisite data. Thanks again.

[ElecSeb]

NP, enjoy your vacation 

[romantronixlab]

I have some questions for here on the board already:
1. What are these components (ideally with link to a data-sheet):
Q12, Q13 -> Code 337 -> FDN337N -> N-Channel Enhanced Mosfet + body diode -> Cannot find any data-sheet
Q20, Q21, Q43 -> Code 338 -> NDS338N -> P-Channel Enhanced Mosfet + body diode -> Cannot find any data-sheet
U11 -> Code S08H -> No Idea (AND port?)

2. What is the difference between VR05 and U04 (why is one name with a "U" and the other "VR"):
VR05 ->Code 8H -> MMBZ5233BLT1G -> Zener Voltage Regulators 225 mW SOT−23 Surface Mount
U04 -> Code R1E -> LM4041 -> LM4041-N-xx Precision Micropower Shunt Voltage Reference

3. Is this part a correct replacement for the white capacitors (high precision) -> C27 and C36
Code 223 KZS -> Kemet SMC F125PP223J100
(Original part is in PL housing, but that seems not for sale, however, size is then upgraded to PP, SMC series, 223 matches. However, KZ is still unknown in code name) -> Any help would be highly appreciated!

@Nixxon:
If your unit is not doing anything anymore, check if U17 is actually giving juice (even when powered off.
U17 =  Code PCYI -> TPS770 -> Power 5V   ULTRALOW-POWER 50-mA LOW-DROPOUT LINEAR REGULATORS

Tomorrow I will try to find my shortage with my toneohm and once fixed I will dig into this unit a little further.

1. What are these components (ideally with link to a data-sheet):
Q12, Q13 -> Code 337 -> FDN337N -> N-Channel Enhanced Mosfet + body diode -> FDN337N
Q20, Q21, Q43 -> Code 338 -> NDS338N -> P-Channel Enhanced Mosfet + body diode -> FDN338P
U11 -> Code S08H ->  NC7S08 -> AND GATE -> NC7S08

2. What is the difference between VR05 and U04 (why is one name with a "U" and the other "VR"):[/b]
VR05 ->Code 8H -> MMBZ5233BLT1G -> Zener Voltage Regulators 225 mW SOT−23 Surface Mount.  As the name implies it regulates the incoming voltage to a stable predetermined voltage. Hence VR-Voltage Regulator
U04 -> Code R1E -> LM4041 -> LM4041-N-xx Precision Micropower Shunt Voltage Reference. The U - Integrated Circuit device

Have no clue as to the third Q.  And just typing this I noticed the date of the post.  Still good information. 

Edit: Updated to reflect added information related to U11 component.

[Terry01]

Did you get your meter fixed buddy?

[say]

Did you get your meter fixed buddy?

I ruined mine.

[Terry01]

Did you get your meter fixed buddy?

I ruined mine.

Awe man! That sucks buddy. 

[giosif]

Hi,

Apologies for piggybacking this thread, but thought I'd take advantage of the attention the conversations here have had recently and also save creating another thread.
I recently purchased a Fluke 289 from our loved & hated online auction site and this meter not only has the screen broken, but it doesn't exhibit any signs of life.
I mean, if I press the power button, it turns green, but it stays that way and doesn't turn off (watching some videos online, I see the button led should turn off once the meter has completed booting).
Also, testing "on the blind" some functions like continuity didn't work (no audio output).
Finally, using the useful information contributed to this thread, I checked for serial communication on the J5 port, but there was no output of any kind (checked with the scope and the TX line is High all the time).

So, I started checking the other things mentioned here:

• Y1 and Y2 are oscillating at the right frequencies
• pin 1 on U13 gets power
• all power rails are fine, with one exception: the 5V rail
• another measurement that didn't match was the 2.5V, but that's the reference voltage, not a power rail.

Now, tracing the above problematic power rail got me to U17, which is responsible with generating the 5V.
The input of the regulator is getting 9V, so we're good there, but this regulator also has an ENABLE pin which is active Low.
And, you guessed it, it is always High.
As such, no 5V rail and, checking further down the line, no 2.5V voltage reference output from U15 either, since it is being powered by the 5V rail.
Next, I checked who is keeping the U17 ENABLE pin High and I traced the connection to pin 72 on U13.

And this is where I'm stuck at the moment, as I don't know what to do next, to determine what makes U13 keep pin 72 High.
I guess it could be that U13 is toasted or that it is waiting for some signal before turning on the 5V rail, but never gets that signal.

Anyone any suggestions, please?

Thanks!

[say]

You may like to check this thread too.

https://r.tapatalk.com/shareLink?url=https%3A%2F%2Fwww%2Eeevblog%2Ecom%2Fforum%2Findex%2Ephp%3Ftopic%3D59991%2E0&share_tid=59991&share_fid=25658&share_type=t

[giosif]

You may like to check this thread too.

https://r.tapatalk.com/shareLink?url=https%3A%2F%2Fwww%2Eeevblog%2Ecom%2Fforum%2Findex%2Ephp%3Ftopic%3D59991%2E0&share_tid=59991&share_fid=25658&share_type=t

Thank you, say!
That is a very useful thread but which, unfortunately, significantly diminished my hope I might be able to resurrect this meter: all three caps - C46, C55 and C92 - measure short across their terminals (and are all tied to the battery negative).
Although, I don't know... I find it strange this tends to happen in most cases with a dead 289...
Also, these three caps are located quite apart from each other on the board and I am trying to imagine what kind of failure can lead to this short measurement across each of them.
Could it be a common power rail that, once the NXP goes bad, gets somehow shorted?
Let me ask on the other thread, then.

Thanks again!

[kjk24]

Hi,

here a pic of the PCB under MSP430, i replaced it on two meters and reprogrammed it via jtag this works fine.
i replaced also on both bad units the MC9328 but i made no foto  of the pcb i forgot it shame.

the tree units in my lab have PCB Rev. 014, 015, 027
my meters are switching on and the power led stays on, i have no console output and no communication on spi,rs232, no lcd
the specker make a short sound at switching it on.

there are two spi communication path from  MSP430 to MC9328 and from MSP430 to the Analog part of the meter for switching Analog switches adg714.
MSP430 to MC9328 8Bit 2Mhz
70 SDI
69 SDO
68 clk
67 cs

MSP430 to ADG714
48 clk
50 SDI
49 SDO

i try to find out howto enable the ram to get excess from the jtag of the MC9328 to flash the fw to the flashchip via j-flash .
attached readout address spaces from a working unit.

iam searching for mx1flash utility for programming the external flash connected to MC9328
 

[kjk24]

new fotos of the MC9328 & the Falsh & RAM

[kjk24]

i replaced on one board the flash chip with a empty one,

tryed to flash the contense from other peoples flash and my extractions to 0x10000000 with j-flash and j-link-edu programmer.
loadfile "Z:\data.bin", 0x10000000
The j-link sw returned error unspecific -1.

in the i.MX Development Tools User Guide is a description how to doit, but i have not such a file to test it:
in chapter: 2.1.3 Flashing Bootloader
"BSP/Bootloader/bin/AMDFlash/programBoot_b.txt"

who has knowlage how to write the bootloader iguess its redBoot @ 0x10000000 in the flash chip ?
please let us know 

other:
i add the bootloader jumper, and open a terminal program "9600-57600/8N1", and start the device connected to the rs232 pins next to the speaker.
it will respond with ":" when you type "a"
that means the chips first stage bootloader is alive.

[kjk24]

additional info

U20 is a pwm controller with two outputs one for 1.8V one for 2.8V both for the ARM cpu
the U13 the MSP CPU enable the outputs with 3.0V

R130 and R129 0Ohm
R130 for 1.8V rail
R129 for 2.8V rail
remove and test the pwm controller, it will divide the cpu from the powersupply

U26 CPU Boot Pins
TP16 = Boot0 & Boot2 normaly Hi
TP28 = Boot1 normaly Lo pulldown 1K
TP30 = Boot3 normaly Lo pulldown 1K

TP16 is the Boot jumper pullup with R134 85K
Jumper set = Boot from BootStrapRom
Jumper not set (Normal) = Boot from FlashRom CS0

Parts
R129 0R
R130 0R
R133 10k
R1345k
R132 1k
R128 10k
R124 10k
R141 1k
R140 1k
R139 1k
R138 1k
R137 1k


Testports
TP16 = Boot0 & Boot2 normaly Hi
TP28 = Boot1 normaly Lo pulldown 1K
TP30 = Boot3 normaly Lo pulldown 1K

TP18 = 1.8V
TP17 3.1V
TP16 2.91V
E29 RBinit Abort (pullup)
E30
E31
E32
E33
E33
E39
E38
E40

U26CPU Ports from Fluke clem Board definitions, not sure if all correct.
PortB are korrekt i ckeckt it.

/*---------------------------------------------------------------------------*/
// Pin assignments
// Format: MACRO_NAME (pin #)

// PORT A
#define MXS_TIN_PIN   (1)
#define BACKLIGHT_PIN (2)
#define HIBEAM_PIN    (3)
#define E30_PIN       (4)
#define _1V8_MODE_PIN (5)
#define _3V_MODE_PIN  (6)
#define E29_PIN       (7)
#define E31_PIN       (
#define E32_PIN       (9)
#define CRE_PIN       (10)
#define LCD_OFF_PIN   (11)
#define FAC_PROG_CNRL_PIN (12)
#define E33_PIN       (15)
#define E39_PIN       (16)

// PORT B
#define KEY_5_PIN  (
#define KEY_6_PIN  (9)
#define KEY_7_PIN  (10)
#define KEY_1_PIN  (12)
#define KEY_2_PIN  (13)
#define KEY_3_PIN  (14)
#define KEY_4_PIN  (15)
#define MODEL_A_PIN   (16)
#define MODEL_B_PIN   (17)
#define KEY_9_PIN  (18)
#define KEY_10_PIN  (19)
#define KEY_11_PIN  (20)
#define KEY_12_PIN  (21)
#define KEY_13_PIN  (22)
#define KEY_14_PIN  (23)
#define KEY_8_PIN  (24)
#define UART2_TXD_PIN (30)
#define UART2_RXD_PIN (31)

// PORT C
#define UART1_TXD_PIN (11)
#define UART1_RXD_PIN (12)
#define SPI_CS_PIN    (13)
#define SPI_SCLK_PIN  (14)
#define SPI_INT_PIN   (15)
#define SPI_MISO_PIN  (16)
#define SPI_MOSI_PIN  (17)

// PORT D
#define BOARD_ID_0    (23)
#define BOARD_ID_1    (24)
#define BOARD_ID_2    (25)
#define BOARD_ID_3    (26)
#define BOARD_ID_4    (27)
#define BOARD_ID_5    (28)
#define BOARD_ID_6    (29)
#define BOARD_ID_7    (30)
#define BEEP_PIN      (31)
plf_hardware_init(void)
{
    const PORT_INIT portInit[] = {                // NAME ON SCHEMATIC DIAGRAM
#ifdef FOR_REDBOOT
        {PORT_A, MXS_TIN_PIN, PIN_INPUT_HIZ},     // 1, MXS_TIN (interrupt
                                                  // from eth)
#endif
        {PORT_A, BACKLIGHT_PIN, PIN_OUTPUT_LOW},  // 2, BACKLIGHT
        {PORT_A, HIBEAM_PIN, PIN_OUTPUT_HIGH},    // 3, HIBEAM
        {PORT_A, E30_PIN, PIN_OUTPUT_LOW},        // 4, E30
        {PORT_A, _1V8_MODE_PIN, PIN_OUTPUT_HIGH}, // 5, 1V8_MODE
        {PORT_A, _3V_MODE_PIN, PIN_OUTPUT_HIGH},  // 6, 3V_MODE
//        {PORT_A, E29_PIN, PIN_OUTPUT_LOW},        // 7, E29
        {PORT_A, E29_PIN, PIN_INPUT_PULLUP},        // 7, E29
        {PORT_A, E31_PIN, PIN_OUTPUT_LOW},        // 8, E31
        {PORT_A, E32_PIN, PIN_OUTPUT_LOW},        // 9, E32
#ifdef FOR_REDBOOT
        {PORT_A, CRE_PIN, PIN_OUTPUT_LOW},        // 10, CRE
#endif
        {PORT_A, LCD_OFF_PIN, PIN_OUTPUT_LOW},    // 11, LCD_OFF
        {PORT_A, FAC_PROG_CNRL_PIN, PIN_INPUT_PULLUP},  // 12, FAC_PROG_CNTL
                                                        // (normally unused)
        {PORT_A, E33_PIN, PIN_OUTPUT_LOW},        // 15, E33
        {PORT_A, E39_PIN, PIN_OUTPUT_LOW},        // 16, E39
        {PORT_A, 17, PIN_INPUT_PULLUP},           // 17, See chip errata

        {PORT_B, KEY_5_PIN, PIN_OUTPUT_LOW},   // 8, KEY_5
        {PORT_B, KEY_6_PIN, PIN_OUTPUT_LOW},   // 9, KEY_6
        {PORT_B, KEY_7_PIN, PIN_OUTPUT_LOW},   // 10, KEY_7
        {PORT_B, KEY_8_PIN, PIN_OUTPUT_LOW},   // 11, KEY_8
        {PORT_B, KEY_1_PIN, PIN_OUTPUT_LOW},   // 12, KEY_1
        {PORT_B, KEY_2_PIN, PIN_OUTPUT_LOW},   // 13, KEY_2
        {PORT_B, KEY_3_PIN, PIN_OUTPUT_LOW},   // 14, KEY_3
        {PORT_B, KEY_4_PIN, PIN_OUTPUT_LOW},   // 15, KEY_4
        {PORT_B, MODEL_A_PIN, PIN_INPUT_HIZ},     // 16, MODEL_A
        {PORT_B, MODEL_B_PIN, PIN_INPUT_HIZ},     // 17, MODEL_B
        {PORT_B, KEY_9_PIN, PIN_OUTPUT_LOW},   // 10, KEY_9
        {PORT_B, KEY_10_PIN, PIN_OUTPUT_LOW},   // 11, KEY_10
        {PORT_B, KEY_11_PIN, PIN_OUTPUT_LOW},   // 12, KEY_11
        {PORT_B, KEY_12_PIN, PIN_OUTPUT_LOW},   // 13, KEY_12
        {PORT_B, KEY_13_PIN, PIN_OUTPUT_LOW},   // 14, KEY_13
        {PORT_B, KEY_14_PIN, PIN_OUTPUT_LOW},   // 15, KEY_14

// For some reason, the SPI output ports can not be reset. Doing so causes the
// Clem application to not work.
#ifdef FOR_REDBOOT
        {PORT_B, UART2_TXD_PIN, PIN_MODULE},      // 30, UART2_TXD
        {PORT_B, UART2_RXD_PIN, PIN_MODULE_PULLUP}, // 31, UART2_RXD
                                                    // (normally unused)

        {PORT_C, UART1_TXD_PIN, PIN_MODULE},      // 11, UART1_TXD
        {PORT_C, UART1_RXD_PIN, PIN_MODULE},      // 12, UART1_RXD
        {PORT_C, SPI_CS_PIN, PIN_OUTPUT_HIGH},    // 13, MXS_CS   (SPI)
        {PORT_C, SPI_SCLK_PIN, PIN_OUTPUT_LOW},   // 14, MXS_SCLK (SPI)
#endif
        {PORT_C, SPI_INT_PIN, PIN_INPUT_HIZ},     // 15, MXS_INT  (SPI)
        {PORT_C, SPI_MISO_PIN, PIN_INPUT_HIZ},    // 16, MXS_MISO (SPI)
#ifdef FOR_REDBOOT
        {PORT_C, SPI_MOSI_PIN, PIN_OUTPUT_LOW},   // 17, MXS_MOSI (SPI)
#endif

        {PORT_D, 6, PIN_OUTPUT_LOW},              // 6, LSCLK    (LCD)
        {PORT_D, 11, PIN_OUTPUT_HIGH},            // 11, CONTRAST
        {PORT_D, 12, PIN_OUTPUT_LOW},             // 12, LCD_M
        {PORT_D, 13, PIN_OUTPUT_LOW},             // 13, LCD_LP
        {PORT_D, 14, PIN_OUTPUT_LOW},             // 14, LCD_FLM
        {PORT_D, 15, PIN_OUTPUT_LOW},             // 15, LD0
        {PORT_D, 16, PIN_OUTPUT_LOW},             // 16, LD1
        {PORT_D, 17, PIN_OUTPUT_LOW},             // 17, LD2
        {PORT_D, 18, PIN_OUTPUT_LOW},             // 18, LD3
        {PORT_D, 19, PIN_INPUT_PULLUP},           // 19, LD4 (unused)
        {PORT_D, 20, PIN_INPUT_PULLUP},           // 20, LD5 (unused)
        {PORT_D, 21, PIN_INPUT_PULLUP},           // 21, LD6 (unused)
        {PORT_D, 22, PIN_INPUT_PULLUP},           // 22, LD7 (unused)
        {PORT_D, BOARD_ID_0, PIN_INPUT_PULLUP},   // 23, Board ID 0
        {PORT_D, BOARD_ID_1, PIN_INPUT_PULLUP},   // 24, Board ID 1
        {PORT_D, BOARD_ID_2, PIN_INPUT_PULLUP},   // 25, Board ID 2
        {PORT_D, BOARD_ID_3, PIN_INPUT_PULLUP},   // 26, Board ID 3
        {PORT_D, BOARD_ID_4, PIN_INPUT_PULLUP},   // 27, Board ID 4
        {PORT_D, BOARD_ID_5, PIN_INPUT_PULLUP},   // 28, Board ID 5
        {PORT_D, BOARD_ID_6, PIN_INPUT_PULLUP},   // 29, Board ID 6
        {PORT_D, BOARD_ID_7, PIN_INPUT_PULLUP},   // 30, Board ID 7
        {PORT_D, BEEP_PIN, PIN_OUTPUT_LOW},       // 31, BEEP
    };

the init sequence (Register settings) for the U26 CPU
who have the Redboot running and output on the uart ?

example:
RedBoot>dump -b 0x100000 -4
00100000: DEADFACE DEADFACE DEADFACE DEADFACE

i need them Register contens of Address:
0x00200000 - 0x00223fff

the command for it sould:
dump -b 0x00200000 -4 -l 0x2 3FFF


need the RAM Register settings to init the RAM and have access to it,
the device is still not booting redboot from flash, now i like to flash the redboot bootloader into the flash again to see if its help.
best regards
kai

[kjk24]

Hello Kaiser thanks for your PN,

No iam not further,  i have still 3 units not running.
But i changed both cpu's and ram and flash. The units start only to boot mode like yours.
The flash programming is done with a script i guess over rs232 interface.
I cant programm the flash, i tryed to fiigure out how to get the ram intitial to but no succsses.
If you connect seeger debuggeer you should have access to the cpu regist er.

Hope i have time and luck in the future to fixit.
Greetings
Kai

[kjk24]

Hello Kaiser,

i have 3 Meters on all C11, C26, C54 short and no Voltage across if its on (to turn it on i press on and the led is lightning nothing else hepend)

have a simular problem on one meter, MXS getting hot. i desoldered R129 (0Ohm), R130 (0Ohm) to check if the dcdc rails are ok, 2.8V and 1.8V next to TP18, TP17.
you can power the CPU from a external supply to see how much mA it sucks.
i replaced the CPU and it get not hot anymore and boot into MXS Bootloader only!

i check now how you able to upload code to the Flash, iam not able to make it happen.
best regards
kai

[kjk24]

Hi Kaiser,
lets discuse here , other people may need the info too.

Hi Kaiser,

no display attatched , and boot jumper set !

Meter1 C56=0V, C58=20V, C62=0V, C59= 0.9V, C61= 0V
Meter2 C56, C58, C62, C59= 1.2V, C61= 15.6V,
Meter3 C56, C58, C62, C59= 1.2V, C61= 15.6V,

Meter1 C56, C62, C59, C61, C58=2mV, C98 =0V (should ~20VDC) iguess Q43 bad on bottom, i have to check.
    no its ok, its a P channel Mosfet, U21 the PWM ic for the 20V, Q42 a NPN is witched on by U13 Pin73
   i disconnected this in on U13 a wile ago ! i reconnect it and the 20V are there.



best regards
kai

[kjk24]

some infos & thank to Kaiser

RedBoot Abort Pin E29 next to J4
pull it low with pulldown resistor for aborting Redboot to boot

SPLASH_BMP_FLASH_ADDR 0x107C0000

1. flash redboot only
2. fis init

--------------------
bootscript :

3. fconfig- l show config

4. fconfig -i
Initialize non-volatile configuration - continue (y/n)? y
Run script at boot: true
Boot script:
Enter script, terminate with empty line
>> fis unlock fs
>> fs mount -d /dev/flash/fis/fs -t jffs2 /
>> load -m file /system/apps/clem.img
>> fs umount /
>> go -c -n -w 10000
>>
Boot script timeout (1000ms resolution): 10
Use BOOTP for network configuration: false
Gateway IP address:
Local IP address:
Local IP address mask:
Default server IP address:
Console baud rate: 115200
DNS server IP address:
Set eth0 network hardware address [MAC]: false
GDB connection port: 9000
Force console for special debug messages: true
Console number for special debug messages: 0
Network debug at boot time: false
Update RedBoot non-volatile configuration - continue (y/n)? y

copy file to device:
load clem.img -r -b 0x00050000 -m ymodem
fs write -b 0x00050000 -l 0x003bd617 clem.img
RedBoot> fs list
   3 drwxr-xr-x  1 size      0 .
   2 drwxr-xr-x  1 size      0 ..
   4 -rwxr-xr-x  1 size 3921431 clem.img
RedBoot>

reset

SerialNumber @ 0x1DEB60

Rev015
without VR1,VR2 etc.
R121/125 assembeld ModellA
no Jumper ID's on Board

Rev020
without VR1,VR2 etc.
R121/125 assembeld ModellA
R277 (1K pulled down) assembeld ID0

Rev027
without VR1,VR2 etc.
R121/125 assembeld ModellA
R277 (1K pulled down) assembeld ID0
R278 (1K pulled down) assembeld ID1

Rev024
with VR1,VR2 etc.
R121/126 assembeld ModellB
R277 (1K pulled down) assembeld ID0
R278 (1K pulled down) assembeld ID1

[kjk24]

for me the Project is finished, i repaired all my 3 dmm.
Thanks to Kaiser he help me a lot.

all infos on your own risk, you can damage your filesystem or calibration or whatever.
dont touch it if you dont sure what you do.

here some infos.

1. dmm switch on and the LCD flickers and not normal screen, check U19 voltages and R101
see attached pic
2. dmm switch on and the LCD hang with a bark, check SPI communication from MXS to MSP
3. dmm switch on and the LCD has additional lines on the screen check ram
4. dmm switch on and bootlogo hang, check clem.img or CRC on flashdrive

my fails on the units wars: LCD Voltage bad (R101) cracked, MXS CPU dead, Ram bad, flash bad, most annoying bad via under MXS (Mosi) to MSP, LCD brocken, batterie metall thing brocken on 2 units.

boot to redboot:
1K pulldown to E29 and switch on, type ctrl-C or space on RS232 Terminal ( i used extra putty)

check RAM:
 boot into redboot becorse the ram has to be initialised, try to read and write to ram or use J-MEM with the  (MC9328MXS.jflash file for initram) and write and read FF and 00 to 0x12000000-0x12FFFFFF

CRC:
 boot into redboot check for a message "somthing with CRC not correct" then some is with filesystem wrong.

clem.img: (extra putty with ymodem)
 boot into redboot and look for the clem.img if its there
>fis unlock fs
>fs mount -d /dev/flash/fis/fs -t jffs2 /
>fs cd /system/apps/
RedBoot> fs list
   6 drwxr-xr-x  1 size      0 .
   3 drwxr-xr-x  1 size      0 ..
 621 -rwxr-xr-x  1 size 3921431 clem.img
 596 -rwxr-xr-x  1 size 3922423 BackupClem.img

copy clem.img to flash via RS232 (115200 8N1 on J5):
 boot into redboot
 fis unlock fs
 fs mount -d /dev/flash/fis/fs -t jffs2 /
 fs cd /system/apps/
 fs list
 fs move clem.img BackupClem.img
 load clem.img -r -b 0x00050000 -m ymodem
 fs write -b 0x00050000 -l 0x003bd617 clem.img
 RedBoot> fs list
   6 drwxr-xr-x  1 size      0 .
   3 drwxr-xr-x  1 size      0 ..
 621 -rwxr-xr-x  1 size 3921431 clem.img
 596 -rwxr-xr-x  1 size 3922423 BackupClem.img
 RedBoot> reset

check redboot bootscript:
boot into redboot,
fconfig -l show config

change the bootscript with wait 10seconds to boot:
fconfig -i
Initialize non-volatile configuration - continue (y/n)? y
Run script at boot: true
Boot script:
Enter script, terminate with empty line
>> fis unlock fs
>> fs mount -d /dev/flash/fis/fs -t jffs2 /
>> load -m file /system/apps/clem.img
>> fs umount /
>> go -c -n -w 10000
>>
Boot script timeout (1000ms resolution): 10
Use BOOTP for network configuration: false
Gateway IP address: 0.0.0.0
Local IP address: 192.168.9.133
Local IP address mask: 255.255.0.0
Default server IP address: 192.168.100.100
Console baud rate: 115200
DNS server IP address: 0.0.0.0
Set eth0 network hardware address [MAC]: true
eth0 network hardware address [MAC]: 0x00:0x80:0x40:0x00:0x22:0x85
GDB connection port: 9000
Force console for special debug messages: true
Console number for special debug messages: 0
Network debug at boot time: false
Update RedBoot non-volatile configuration - continue (y/n)? y

LCD:
J3 (LCD)
1= +20V
2= +18.8V
3= +17.6V
4= +2.4V
5= +1.2V
6= GND
7= GND
8= ?
9-18= Data
19= +9V
20= ? Backlight
if Voltage not correct check R101 & U19


redboot found clem.img and booting it:


MSP Chip bad or communication to it bad:


redboot dont find clem.img bootloader hang:
[ Specified attachment is not available ]


Regards
Kai

[goaty]

Wanted to add something I encountered, which might not have to do anything with the Fluke problems, but I thought it might fit:

I have a set of Mastech cable finder which use MSP430F135.

Both sender and receiver have a problem and did not start reliable.
I found that the decoupling caps are very very critical on the analog and digital supply lines.
In the sender, I managed to get it starting up after replacing the caps. Before it had excessive current draw. 3.3V regulator got hot and CPU was not running.

On the receiver it also does not start up, but caps replacement did not help.
I have the suspicion that the MSP430 is very sensitive.

[kaiser]

Might come in handy for some..
Here is a J-Flash config setting to read and write to the flash with the use of Flukes onboard RAM which I used on my 289.

In the J-Flash CPU tab, tick "Use target RAM" : write time = approx 2min..
Not ticked write time = approx 5Hrs...... for each write

J-Flash ARM V4.20a was used in this case.


K.
                         

[nixxon]

Update from my side:
(...)
@Nixxon:
If your unit is not doing anything anymore, check if U17 is actually giving juice (even when powered off.
U17 =  Code PCYI -> TPS770 -> Power 5V   ULTRALOW-POWER 50-mA LOW-DROPOUT LINEAR REGULATORS
(...)

I have now started all over again troubleshooting my dead 289. I  am going through all posts regarding 289 troubleshooting in this forum. My 289 has entered the 5x flashing power button state (dead mode). There is no output from the 5V regulator U17 (TP3). This is probably because the enable input pin 3 (EN) of the TPS770 reads 3.1 Volts ("A voltage of 1.7 V or greater on the EN input will disable the TPS770xx internal circuitry...). Does anyone know which component has decided to shut off the 5V regulator by feeding 3.1V to the EN-pin of U17?

[kjk24]

Hi nixxon,

the Regulator until the lcd show the regular application is off, u17 is switched on from MSP430 when the app is running (LCD shows it)
it has prop nothing todo with the error message.
check if the bootloader can load the app. by connecting rs232 and bootloader jumper..... see older posts.

[MihaiV]

Hello everyone,

I saw a cheap and faulty Fluke287/NUC on ebay. The seller said it shows the leads connection error on any setting, so I went for it.
A different meter with a different fault arrived, and the other one was already gone. Shipping it back would have been more expensive than the unit itself, so I kept it.

At power-up, it lights the led for 1 second, than it blinks very shortly and it make an extremely short beep, it displays the Fluke logo and the led turns off (as it should) and the screen goes gray when it should display its measurements.

No button is active, switching functions does nothing and it can only be turned off by removing the batteries.

On some occasions the display does not turn on at all.

Let's inspect: no damage at all on the case, the screen has its protection foil on. Input terminals clean.
Inside: no sign of input damage: MOVS have "infinite" resistance, PTC, 1K resistor and the high voltage resistor are ok. The fuse is missing though... The board is clean, no sign of fluid damage anywhere. It appears someone was here before: the screws from the input terminals indicate that an unsuitable screwdriver was used to remove them.

Anyway: the back-up capacitor was a bit corroded but it did not leak. I removed it.
I measured all power rails for shorts: the 21V for the LCD, the 3.3V for MSP, the 1.8V and the 2.9V, the 5V and the 2.5V reference, and finally the LCD display outputs from the LP324. I found none. Next, I checked all jelly-bean semiconductor: all diodes (CR and VR) and all transistors (from the posts above), are ok, no shorts, no obvious conduction in both ways.

Now apply power: 9V through the battery pads. I see the 3.2V for the MSP is on and all capacitors around it measure the same, except C41. This is the external ADC reference input, taken from the voltage reference. No other voltage is present on any other test points and caps.

Power on:
- The dual buck provides 2.94V (158KHz switching frequency, 98% duty cycle, 0.958V at the feedback pin) and 1.8V (300KHz switching, 92% duty cycle and 0.904V at the feedback pin).
   
- The 21V boost converter is on and U19 (LP324) provides voltages close to the ones from the previous posts: 1.31V, 2.62V, 18.55V and 19.8V. While at it, I also checked the opa-mp operation but there was no significant difference from the inverting and non-inverting inputs (<1mv)
   
- U17 outputs only 0.58V... But it is not faulty, it is disabled by the MSP. I checked that trace and it is not shorted to VCC. So, no 5V and no 2.5V reference output. No other voltage is present on any capacitor in the analog section, including the ADC.
   
- A look with a thermal camera didn't show anything. The 2.9V + 1.8V converter and the MXS were barely showing up, everything else was cold.
   
After several power-ups, I noticed that the display only operates when my hand is near the main processor, U26. Pressing lightly on it made the display show the logo every time. So I reflowed it (and the Flash + RAM chips while at it) at the university with a dedicated BGA rework station, and that partly fixed the problem. The display shows the logo every time.

But the display still becomes gray after the logo and the led. What I noticed is that after removing the power, a single horizontal line briefly remains on the display, fading away in less than 1 second. So it appears it continuously sweeps the screen, making it gray.

Here is what I measured on the LCD connector:
   1. 21.1V constant.
   2. 19.26V constant.
   3. 18.55V constant.
   4. 2.62V constant.
   5. 1.32V constant.
   6. 0V
   7. 0V
   8. 2.94V constant.
   9. Square wave, 171Hz, 50% duty cycle, 3V logic.
   10. Square wave, 75Hz, 0.8% duty cycle, 3V logic, appears to be a syncro signal.
   11. Square wave, 18.1KHz, 3.6% duty cycle, 3V logic.
   12. 2.94V constant.
   13. Square wave, 1.67MHz, 50% duty cycle, 3V logic. Looks like a clock signal.
   14. 0v
   15. 0V, goes towards the MXS.
   16. 0V
   17. 0V, goes towards the MXS.
   18. 0V
   19. 9V (from supply)
   20. 0V, connected to the collector of Q17. Appears to be the cathode of the backlight.
   
The LCD itself appears ok, since it correctly displays the Fluke logo. The ribbon cable looks good to, no sharp bends or interruptions.

I also checked the crystals: the MSP 32.768KHz crystal resonates near enough (32.77KHz), with 200mVpp.
The MXS crystal shows a 32.7KHz wave on one side (as if half-wave rectified) and nothing on the other pin.
I changed it with a different one and it resonates nicely now on one side, with 900mVpp. The other side still appears like a half-wave rectified sine.

However, this still does not change anything, the LCD is still gray after booting.

As indicated in previous posts, I checked the SPI connection between the MXS and the MSP. I see data, clock and CS on all of them, with nice clean transitions. Data is being exchanged every time the ON button is pressed. The MXS also responds something when turning on and before powering off. If the power button is pressed for 5s continuously it reboots.

Speaking of booting, I also sniffed J5, a serial interface. Immediately after power-on, I get a "+" character, and right before gray-screening I get "Entry point: 0x00060040, address range: 0x00060000-0x003bef68" followed by a carriage return and a line feed. This looks like the output of a healthy meter (seen on one post above). This indicates that it can communicate with the flash memory, since MXS is only a processor, taking its program from the flash chip.

I started to focus on the MSP not enabling the 5V regulator. The scope shows that it does enable it, immediately after power-up. It pulls it down for 20ms and than it disables it again. The regulator appears to be working, as it outputs 5V. The reference is also ok, providing 2.5V at the MSP ADC reference input (for those 20ms).

I also noticed that the IR led does not blink to detect the probe connection. The driving transistor measures ok, the led lights up on the camera and the trace to the MSP is not interrupted (the pins are all well soldered too).

And here is where I got stuck.
I only have two (rather cold) leads: a faulty solder joint or via in the LCD data bus, since pins 15 and 17 are always 0v and both go to the MXS (but why does the start-up logo display correctly ?) and the weird driving signal for the MXS crystal (but MXS boots and displays proper message on the serial interface).

None of them appear connected to disabling the analog 5V rail.
Sorry for the long bed-rime story...

Any ideas on what else can I check?

Thanks,
MihaiV

[MihaiV]

Here come the rest of the photos. This is the one with the gray screen.

[MihaiV]

Immediately after removing the power, a single line briefly remains on the display. It is interesting that the conductive line from "beyond" the pixel array is also showing in black (at the edges). During "normal" operation is is not visible though.

The console output at booting is in the second attachment.
I also tried to send Ctlr-C during booting, but that simply hangs the power led in the on state and does nothing else.

[YetAnotherTechie]

The line on the lcd doesn't mean that it's bad, it just means that it was an uncontrolled shutdown, i.e. the lcd drivers were not turned off in software before power went unregulated.

[MihaiV]

Hi YetAnotherTechie,

Agreed, it is a sudden shutdown and it always displays another line, wherever it happens to be when power goes out.
I am curious if the two lines that are always low (pin 15 and 17) are driven somehow in a functional meter.
The scope shows that the clock signal is continuously going. But what you said points out that is is not necessarily writing only 1s and it might not be a single line that scans from top to bottom like crazy.

I will return with a 4 channel oscilloscope to check more signals at the same time.
But the fact that the MSP does not enable the 5V rail indicates that the MXS is still not operating properly and the application is not correctly running. MSP might expect a specific message on the SPI from the MXS.

[MihaiV]

Good evening,

I did replace the crystal on the MXS chip, as it showed no signal on one of its pins. I could only see the driving signal from the IC. The new one does resonate with fairly high amplitude but I have a doubt concerning the driving part.

Pictures 3 and 4 are the scope captures of each MXS crystal pins. Is this how it's supposed to look?
Pictures 1 and 2 are coming from the each of the MSP crystal pins and the driver looks  different. The driving signal does have a DC offset, so it can do a complete sinusoid (or close to it).

Could the crystal driving part be faulty or the driver in here simply does not need a full sinusoid swing and it does not use a DC offset for it?

While at it, I also captured a the brief moment in which the 5V analog power rail is enabled (picture 5). This happens immediately after pressing the power button, way before the logo on the display vanishes, so it does not appear to be related to the MXS not running its application. Does anyone know if MSP checks something during this sequence, or measures something and that is not right (and shuts down the power) ?

Thanks,
MihaiV.

[bdunham7]

I don't mean to interrupt anyone's repair, but since the topic is not quite sorted F289s, can anyone tell me how long the memory/date/time should be retained by the supercap with the batteries removed?  Fluke's online tech support seems to be suffering and their rep couldn't answer questions with anything but nonsense.  Mine is v1.16, had the supercap serviced by Fluke last year and loses the memory in less time than it takes me to charge the Eneloops that I use in it.  It works fine otherwise and doesn't drain the batteries unreasonably.

[alex_hobeanu]

I removed the batteries on mine for 24 hours and found the date / time to be correct after I put them back and power up the meter.
I have no data stored in the meter but the rtc ran fine so I guess there was enough energy stored internally to keep the memory alive.
Fluke 289 serial # 41840060 (March 2018), firmware version 1.16 / V0.88.

[bdunham7]

I removed the batteries on mine for 24 hours and found the date / time to be correct after I put them back and power up the meter.
I have no data stored in the meter but the rtc ran fine so I guess there was enough energy stored internally to keep the memory alive.
Fluke 289 serial # 41840060 (March 2018), firmware version 1.16 / V0.88.

Thank you for checking that.  Mine is older, 2011 or so, but AFAIK, there are only two versions  and yours is the same FW level as mine, so it is the 'older' version. 

[Towlerar]

I have a Fluke 287 I acquired from eBay for cheap. At first I found that none of the power rails would come up and pressing the power button resulted in the LED coming on for a couple seconds, flashing briefly and emitting a quick chirp, then powering down with nothing on the LCD.

I found two shorted tantalum capacitors in the 20V section for the LCD bias (C97 and C98). These caps also appeared to have shorted the output driver in the 20V converter IC (U21). Removing all of these caused the meter to  now stay on after turning on but the LED never goes out so it is still not booting correctly. There is no SPI communication between the MXS chip and the MSP430. The UART on the MXS does not output anything at all, nothing on the screen, no buttons respond. The crystal on the MSP is working fine but the crystal on the MXS is running at 100khz even after replacing.

I have come to the conclusion that the MXS chip is one sick puppy. It is getting slightly warm to the touch and indeed the thermal camera confirms this. I am powering the VBatt supply and the 20V supply from a lab supply. The 20V supply pulls about 10mA during powerup which seems normal. The 9V VBatt supply was drawing a whopping 258mA prior to finding and removing shorted components in the 20V section. Now it's at 50mA, which is still high. It seems normal is around 15-20mA on good meters according to earlier posts.

I think my next step is to obtain a JTAG programmer and upload the hex files from the existing application processor. It's unclear to me of there even is any programming in the MXS however. Can anyone confirm this? It seems maybe I could simply replace the MXS chip and it will upload the code it needs from the NOR flash? Either way, replacing the MXS chip seems to be my next obvious step.

[Towlerar]

This evening I decided to try pushing on the PCB behind the MXS processor during booting and it got into the boot menu and complained about the date and time due to a bad supercapacitor which I removed. However, the meter never fully booted because no readings made it to the screen. I wasn't sure whether the issue was with a cracked ball on the BGA or a cracked MLCC so I started measuring across the various bypass caps and found C76 would intermittently short when I pressed on the board and released. The problem seemed to go away when I removed the cap but now I can't get the meter to boot anymore. Thinking maybe the problem is actually the BGA I tried reflowing it with the hot air rework station to no avail. So it seems the MXS chip is alive but perhaps there is a cracked solder ball that doesn't want to reflow. I may have no choice but to replace it anyway. Even still, I'm concerned the meter never fully booted, which might mean a missing or corrupted file in flash.

[Towlerar]

This morning I replaced the suspected bad capacitor with a new one and I can consistently boot to the point that the power LED extinguishes and the buttons seem to mostly respond. Though, notably, the backlight button does not respond and I get nothing on the LCD anymore. This is probably no coincidence because both are tied to the MXS IC. The 9V Vbatt rail is pulling 18mA at idle now, which appears to be normal. I think the trick now is to check the UART debug communication and see if an error is being thrown out there.

[Towlerar]

new fotos of the MC9328 & the Falsh & RAM

May I ask where you sourced your RAM from? I cant find it stocked anywhere.

[Towlerar]

Today I attempted to get the debug data out of the UART port on the MXS IC. Try as I might I could not get the data out. My understanding is that the baud rate is 115200, 8, 1, N but I was not able to receive in TeraTerm or even decode with my Rigol DS2302, despite there clearly being data there. 3V TTL with nice, clean rise and fall. I was probably making some stupid mistake. Either way, the point is moot I guess because I made progress even without that data. I'll probably go back and figure out what I was doing wrong. I would expect even if my baud rate is wrong I would get gibberish.

Anyway, I took a break from the UART problem and decided to look at the weird issue where the LCD worked once and did not work again. I started by flowing contact cleaner into the flat flex connector and inserted/removed the flat flex several time even though both sides are gold plated and shouldn't oxidize. Then I heated up the solder joints on the connector pins, still no change to the display. Next, I pressed on the flat flex it multiple directions to see if it would come good and to my surprise I got a partial image. I then took the LCD out and inspected the flat flex under the microscope. The edge of the connector where the wipers contacted the gold pads looked fine. However, I noticed a micro strain hairline crack on the traces coming off the pads where the area of the flat flex with stiffener exited the connector body. It probably had small vibrations over long periods of time which ultimately strained the copper and cracked it. I'm guessing this meter had a hard life riding in a truck mounted toolbox based on the condition of the outside case. That can obviously set up sustained vibrations at certain vehicle speeds and eventually crack. Being that these LCDs sell for near $200USD on eBay, I was keen to try to fix it myself. I essentially  tinned the gold plated fingers with solder and cleaned it with alcohol. I know it's not the best for longevity,  but there weren't a lot of options. Also, this meter is now in a form of retirement and will have a cushy life on a bench in a temperature and humidity-controlled lab. The clearance became a bit tighter in the connector, but it worked! Again, I'm unsure what kind of longevity it will enjoy. I was still not getting the meter to fully boot, and given my UART problems I decided to try something different. I used some thin liquid flux and dropped it under the MXS applications processor and tried reflowing it at 315C with the hot air rework station. To my surprise this seems to gave worked! There was a definite improvement in how far the meter booted. However, at this point I was getting just a black line where the measurement should be regardless of what position the rotary switch was in. I verified that the notches between the switch and the housing lines up correctly. Then it struck me that if the switch was not making good contact with the PCB, measurements would not be able to come through. I cleaned the PCB and switch contacts with contact cleaner and rotated the switch back-and-forth several time and tested again. And... It's alive! It's almost a bit disappointing I didnt have to get into flashing any ICs. I think I'll still go back and figure out the UART issue that clearly is attributed to my setup a f not the meter itself. I'm also going to go forward with getting a JTAG programmer and will carefully probe around the MSP430 and MXS. It wouldn't hurt to have uploads of their hex files for the future. I'll probably also buy a spare MXS chip since those are EOL. I already cant find the RAM chips. The NOR flash and MSP are still available so I wont worry about that yet. I'll go ahead and order some replacement parts and get it put back together. This should just about wrap up troubleshooting for me. I just need to run some performance tests using my various calibrator to ensure everything meets spec. Who knows, perhaps there is still some calibration or even more troubleshooting in my future.

[giosif]

Hi,

Congrats on resurrecting your multimeter and I hope it serves you for a long time!
About the baud rate, I've used the info on the page at the below link to determine unknown rates:
https://www.kumari.net/index.php/random/37-determing-unknown-baud-rate

HTH

[MihaiV]

Hello,

Does the MSP430 check the analog 5V regulator and the voltage reference or just use it as external reference? My unit enables the 5v regulator but it shuts down immediately (photo in a previous post). I have not seen anything related to power coming from the analog side to any pin or other component near the MSP. My unit displays the start screen ("Fluke true rms....") but instead of measurements it displays a dark screen). Dark screen appears when the led turns off.

[Towlerar]

Hello,

Does the MSP430 check the analog 5V regulator and the voltage reference or just use it as external reference? My unit enables the 5v regulator but it shuts down immediately (photo in a previous post). I have not seen anything related to power coming from the analog side to any pin or other component near the MSP. My unit displays the start screen ("Fluke true rms....") but instead of measurements it displays a dark screen). Dark screen appears when the led turns off.

As far as I am aware, the MSP430 only checks the 2.5V reference voltage level. It's more likely that the MSP430 is shutting down the 5V rail as you stated. However, the 2.5V voltage reference IC that the MSP430 monitors (U42) is fed from the 5V regulator. So if there is no 5V, there's no reference voltage.

If everything seems normal with the regulators, I would also recommend checking the UART output from the MXS IC (U26). An easy point to tap into is the unpopulated J5 at the top of the PCB. Pin 3 is TX on U26, Pin 1 is RX on U26, Pin 2 is GND and the baud rate is 115200,8,1,N. This should give you some debug info and may give you insight as to why the unit is not completing booting. Also, if the rotary switch is dirty, not making good contact, or is in an invalid rotation, you also won't get any measurements on the screen after booting.

[MihaiV]

Hi Towlerar,

The 5V regulator is indeed disabled by the MSP. In a previous post there is a scope capture with it. I also checked the UART output and it shows a clean entry.

With a few precautions, I powered the 5V rail from a different source, after powering the rest of the meter, and there were no problems with the current consumption or voltage outputs. 5V was clean and so was the reference. A quick check with a thermal camera did not show any component warming up. But the behavior remained the same, meaning that it was not expecting something from the analog side.

Another thing I checked was the SPI bus between the MXS and MSP. I managed to see the MISO and MOSI signals. When powered and turned on, in the gray screen state, i can see some messages being sent by the MSP, most likely a shut-down command, but nothing happens. Perhaps that ball under the BGA (or even a via) is cracked. I will return with some scope prints with the messages.

By the way, I had to change the MXS crystal because there was no oscillation on one side of it. The chip was driving but the crystal was not resonating. After changing it with something from my junkbox is started oscillating strong and clean (see post 171 at page 7).

I assume that the crystal was broken due to a strong mechanical shock, so there may be a cracked ball somewhere. I already reflowed it once, but to no success. What else could i check?

[Towlerar]

Hi Towlerar,

The 5V regulator is indeed disabled by the MSP. In a previous post there is a scope capture with it. I also checked the UART output and it shows a clean entry.

With a few precautions, I powered the 5V rail from a different source, after powering the rest of the meter, and there were no problems with the current consumption or voltage outputs. 5V was clean and so was the reference. A quick check with a thermal camera did not show any component warming up. But the behavior remained the same, meaning that it was not expecting something from the analog side.

Another thing I checked was the SPI bus between the MXS and MSP. I managed to see the MISO and MOSI signals. When powered and turned on, in the gray screen state, i can see some messages being sent by the MSP, most likely a shut-down command, but nothing happens. Perhaps that ball under the BGA (or even a via) is cracked. I will return with some scope prints with the messages.

By the way, I had to change the MXS crystal because there was no oscillation on one side of it. The chip was driving but the crystal was not resonating. After changing it with something from my junkbox is started oscillating strong and clean (see post 171 at page 7).

I assume that the crystal was broken due to a strong mechanical shock, so there may be a cracked ball somewhere. I already reflowed it once, but to no success. What else could i check?

It seems to me that since you have a clean boot-up (based on your screen capture) that the issue is likely not with the MXS, MSP, or Flash. The problem could be with bad sectors in RAM - I'm not sure how involved RAM is in the regular operation of the meter vs. simply data logging.

My fear is that there is a problem with U9, the measurement processor, which is a Fluke branded item. I'm not sure whether or not that part is available. You could check the SPI comms between the MSP and U9. On the MSP430, the following pins are SPI to the measurement processor - 63 CS, 50 SDI, 48 SCK. There is also a reset pin which comes from pin 51 on the MSP.

Since the MSP is looking for a valid rotation of the rotary switch, and you've verified that it's in a valid rotation and clean, try checking the resistor ladder it uses for determining which position it is in. R30-R35, R40-44 are used as a large resistor divider, each going to a switch position to tell the MSP what position the switch is in. I would make sure all of those values are good.

[MihaiV]

Hello Towlerar,

Thank you for the advice.
I checked first that the contacts of the rotary switch are clean. Next, I checked that it was not installed in a wrong way. Someone was inside the meter before me (the heads of the input screws are slightly damaged). Since all parts are indexed, there is no way to assemble it wrong. I removed it to gain access to the contacts.

Next, i checked all vias around the switch, by buzzing to some visible traces through the PCB (all ok).

A visual inspection and a buzz of each branch of the resistor divider revealed the contacts at the switch. I traced a crude schematic (in the attachement). Pin 95 of the MSP appears to be connected to a position in the resistor ladder. It is P6.0/A0, obviously used as ADC input.

First, I must say that the 5V regulator is immediately disabled by the MSP, so I had to remove R88 (a 0R resistor) and to apply 5V externally. I noticed that if I turn the 5V too soon after pushing the power button the boot logo does not appear anymore and the power led remains on. If i apply 5v later (or never) it shows the boot logo, and the led turns off, simultaneously bringing the gray screen.

The 5V rail takes around 1mA (indicated by the power supply). I will measure it with a proper meter at the next debugging session.

Next, I measured all voltages of the resistor ladder with the rotary switch removed (see photos, positions on the ladder marked in red). They appear fairly well spaced apart in voltage, and are stable.

I buzzed the MSP pin, to see where it connects on different functions (with power removed, of course). The results are in the top right corner of the photo. Interestingly, some functions connect the pin at 2 positions in the ladder (VAC, mVAC, VDC). The others connect to a single position.

After that, I applied power an measured the voltages on each function. And they do not match the ones with the rotary switch removed! Obviously, the voltages in the ladder are also deranged. The values are indicated in the top right of the attached photo. I started buzzing all over the board, but couldn't find another connection anywhere else.

Is guess that is not normal. Is it?

It is a bit late here and my eyes are burning, so i will continue tomorrow, before i damage something else. I will try to hardwire one of the functions to the pin (like the VAC), without the rotary switch, and see what happens.

[Towlerar]

Hello Towlerar,

Thank you for the advice.
I checked first that the contacts of the rotary switch are clean. Next, I checked that it was not installed in a wrong way. Someone was inside the meter before me (the heads of the input screws are slightly damaged). Since all parts are indexed, there is no way to assemble it wrong. I removed it to gain access to the contacts.

Next, i checked all vias around the switch, by buzzing to some visible traces through the PCB (all ok).

A visual inspection and a buzz of each branch of the resistor divider revealed the contacts at the switch. I traced a crude schematic (in the attachement). Pin 95 of the MSP appears to be connected to a position in the resistor ladder. It is P6.0/A0, obviously used as ADC input.

First, I must say that the 5V regulator is immediately disabled by the MSP, so I had to remove R88 (a 0R resistor) and to apply 5V externally. I noticed that if I turn the 5V too soon after pushing the power button the boot logo does not appear anymore and the power led remains on. If i apply 5v later (or never) it shows the boot logo, and the led turns off, simultaneously bringing the gray screen.

The 5V rail takes around 1mA (indicated by the power supply). I will measure it with a proper meter at the next debugging session.

Next, I measured all voltages of the resistor ladder with the rotary switch removed (see photos, positions on the ladder marked in red). They appear fairly well spaced apart in voltage, and are stable.

I buzzed the MSP pin, to see where it connects on different functions (with power removed, of course). The results are in the top right corner of the photo. Interestingly, some functions connect the pin at 2 positions in the ladder (VAC, mVAC, VDC). The others connect to a single position.

After that, I applied power an measured the voltages on each function. And they do not match the ones with the rotary switch removed! Obviously, the voltages in the ladder are also deranged. The values are indicated in the top right of the attached photo. I started buzzing all over the board, but couldn't find another connection anywhere else.

Is guess that is not normal. Is it?

It is a bit late here and my eyes are burning, so i will continue tomorrow, before i damage something else. I will try to hardwire one of the functions to the pin (like the VAC), without the rotary switch, and see what happens.

Good work getting the rotary switch reverse engineered. It seems like you might possibly be onto something.

I just had another thought. Is it possible the MSP is disabling the 20V bias boost supply after bootup? The boost converter IC is U21 and the signal to enable it appears to be on the gate of Q43 PFET via a bootstrap transistor Q42.

[MihaiV]

Hello,

The 20V power supply is enabled at power-up and remains on as long as the meter is on. I can't turn it off without removing power. Holding the power button for more than 4 seconds reboots the unit. By the way, I have 21V, not 20. All other voltages generated by U19 are a bit higher too.

I tried to hard-wire one function to the MSP pin 95, but no results (the Ohms measurement). Tested with and without the rotary switch contacts, with and without external 5v supply.

But the fact that the voltages seen by the MSP are so different from the ones at the resistor ladder seems weird. I hope the selector was not changed with one of a different model, as someone was inside this unit before.

For a moment I suspected that the MSP pin 95 might be faulty and drag the voltages down, as they were connected to it by the selector, but hard-wiring proved it is ok, I measured 1.47V connected at position 5 (Ohms measurement).

Next, I will focus on the communication between the measurement processor and the MSP.

[MihaiV]

Hello everybody,

I tried some SPI bus probing between the MSP and the other components.
I started with the MSP to MXS communication, and I saw that the MSP sends commands and the MXS responds. I did not decode the actual commands, I wanted to see that the traces/vias are intact and that there is no short-circuit between them.

Waveforms in photo 1 appear when the power button is pressed first time after applying 9v. The timebase is large, so the clock appears simply as a few pixels (channel 1 is CS, channel 2 is the CLK, channel 3 is MISO and  4 is MOSI).

Photo 2 is zoomed in a little; it seems that there is some communication with the CS line high too and the messages are different (photos 3 and 4). No activity appears on the bus when other buttons are pushed or the rotary switch is switched (not even with 5v applied externaly). But the traces up to the MXS are ok.

Next, I tried the MSX to ADG714. Accodrind to post 153 from KJK24, MSP pin 48 is clk, 50 SDI and 49 SDO. There is no activity here at all, with or without 5V from outside. A quick buzz indicated that pins 48 and 50 buzz to pins 1 and 3 (SCLK and DIN) respectively on the ADG714 switches. Pin 48 doesn't ring to pin 22 (DOUT) of the ADG! It goes to R291 (unpopulated) and nowhere else on the board. Pin 22 of ADG does not buzz anywhere, too.

I checked the photo from post 153 because I remembered it had a photo of the vias under the MSP but noticed that my board has a slightly different layout. My DIN trace goes away from the MSP, to the south-west part of the board (photo 5), but the photo in 153 goes right under the IC. Seeing post 139 I noticed that I have a ton of parts unpopulated in the south of MSP (my unit is 287/NUC). My board says FLUKE-28x-3001 REV 015.

Can anyone check that pin 49 of MSP is in direct connection to pin 22 on the ADG714 on the other side of the board (U48) ?

Thank you in advance!

[MihaiV]

Hi,

Ignore the second part of my previous message... Just being dumb 
I rechecked the datasheet and DOUT of ADG714 does not need to connect to anything (unless you wnat do daisy-chain multiple devices). No need for it to go anywhere.
Took a photo of what's under the ADG, while at it.
Back to square 1. And to the SPI between MXS and the measurement processor.

[MihaiV]

Hello again,

First with the (somewhat) good news: the LTC2415-1 (U10) ADC appears to be working. Attachment 1 shows the CS, SCK and SDO signals. The CS doesn't look too good with that falling edge. The data and the clock look good though.

The ADC is powered by the 5V rail, so the signals will have the same level. On the board, the CS and the SCK are connected directly to the MSP, but the SDO connects through a large resistor (measured ~50k in circuit). It seems that the ADC is operating alone right now, meaning that SCK is an output. AS the datasheet says, if SCK is HIGH or floating at power-up or during a High-to-Low transition, the converter enters SCK internal mode. Might be the reason for the dodgy CS signal too.

I believe it operates with SCK from the MSP in normal mode, because if I power it up with the scope probe attached to SCK it does not output anything, but if i power it without and attach it later it outputs clock and data.

Photos 2 and 3 show a weird data output (blue trace mostly High), and a zoom of the falling edge of CS.

And here is the bad news.
I just checked the SPI connection to U9 (SL10327) and nothing happens there, with or without external 5V. Checked absolutely every pin, powered up the meter on each one and I only see something on the power and the reference voltage.

Good news is that I found the IC on ebay.

Could anybody post a scope capture of what happens on the SPI bus of a functional unit ? Please?

Thanks,
MihaiV.

[MihaiV]

Anyone?

[booyeah]

From a good 289:

1. U10 (LTC2415), attachment 1 and 2 -  CS bar, SCK, SDO.    CS bar is directly connected to MSP 47 , but couldn't find where SCK and SDO went.

2. U9 (SL10327), attachment 3, 4, 5 -   CS*(26) to msp (63), SCK (28) to msp (48), SDI (27) to msp (50).
 
Probe connections aren't the best, so some extra ringing.

[MihaiV]

Hello Booyeah,

Thank you for taking the time to open your meter and investigate the signals!
My U9 appears very dead, so I ordered one from ebay(most likely removed from some other meter). There are some chances to be faulty too, but I'll take my chances for 5$.

Thanks,
MihaiV.

[MihaiV]

Hello again,

The SL10327 arrived! The part appears new, in the tape, with no traces of removal from other equipment.
Swap it in and... nothing.
The problem is somewhere else.
Don't know where else to look at the moment...
Could it be a problem from the MXS or the RAM? Could the start-up logo be displayed from the ROM and when RAM operations start, everything goes wrong?

[booyeah]

I'd like to say a massive thanks to everyone in this thread.

A couple of years ago I decided to make a lipo battery circuit for my 287, I either reversed the polarity or possibly over volted the battery inputs. Anyway the end result was a dead meter with just the five power button flashes. I had a go at troubleshooting but got nowhere, so it's just been sitting in a drawer ever since.

After following this thread, I decided to have another go at fixing it.
There was a short on the MXS 3v rail. Testing with an external supply caused the CPU to heat up. So I ordered a replacement and had a go at soldering it with a cheap ebay hot air gun.

I couldn't do it as the lead free solder paste just wouldn't melt properly. I hand re-balled the chip with some leaded solder and thankfully it worked this time. I then edited the MXS boot script using an Arduino as a serial pass through. Success, my 287 has come back to life.

Something to note is how delicate/finicky the lcd flex can be.
Initially I thought I had damaged the lcd as well, as it was very faint on booting. The fluke logo would show faintly them fade to nothing. I tried it on another meter with similar results, sometimes there were graphical lines missing as well.

I checked all of the connector pin voltages and signals, they roughly agreed between the two meters. I tried re-seating the connector, cleaning etc. I found that applying a little bit of pressure to one side of the flex connector fixed it, so I tinned the pads a little bit and now the screen works perfect.

[booyeah]

Hello again,

The SL10327 arrived! The part appears new, in the tape, with no traces of removal from other equipment.
Swap it in and... nothing.
The problem is somewhere else.
Don't know where else to look at the moment...
Could it be a problem from the MXS or the RAM? Could the start-up logo be displayed from the ROM and when RAM operations start, everything goes wrong?

In an earlier post you checked the lcd pins. Is it possible the solder connections to the cpu are damaged / cracked?

My    287,     289   lcd connector
1  20.349   21.19
2  19.017   19.88
3  17.83     18.56
4   2.525     2.637
5   1.272     1.32
6   0            0
7   0            0
8   2.953     2.931
9    pic 1
10  pic 2
11  pic 3
12  2.953    2.934
13  pic 4
14  pic 5
15  pic 6
16  very busy like pic 6
17  very busy like pic 6
18  0          0
19  6.986    6.98
20  4.758    4.69

Pins 13-17 were very busy non repetitive signals so hard to capture, but you should be seeing some activity, not 0 volts.

[MihaiV]

Good evening booyeah,

Thank you for the scope captures! There is a ton of signal missing from my LCD lines!
I will check them again in case I missed them somehow.
I took pins 19 and 20 as backlight circuitry, with Q17, Q18 and Q18 part of the intensity adjustment. There is nothing there too.
I will try to reverse engineer that part and come with a schematic.
Was your backlight on?

I also fear(ed) that there is a solder joint cracked somewhere. In fact, the meter was rarely showing the start logo. I noticed that it worked constantly only when pressing near or on the MXS. I reflowed it once with some equipment at university and it booted every time since then. Also reflowed RAM and Flash while at it.

Also, the MXS crystal was not oscillating at all (but it was still showing the start logo). I changed it with something from the junkbox, and now it oscillates nicely (pics in a previous post). Changed nothing though.

Broken joints and a possibly cracked crystal could indicate a healthy mechanical schock (although the case is like new).
One thing I could try is to reflow the MXS again and gently move the part while in liquidus phase (with a bucket of flux). Maybe the cracked joints are oxidated and did not allow the solder ball to regain continuity. I have seen that before in other equipment.
Will return with updated status on those LCD lines.

Thank you,
Vidrascu Mihai.

[MihaiV]

Hello,

Back with the LCD pins scope captures.
My final pins are definitely silent (see attached pictures).
I used the low(er) capacity probe at work to also check the crystals of the MSP and MXS, also in the attachments.
I did not manage to reflow the MXS yet, no spare time at work the last days.
Anyway, isn't the LCD communication unidirectional? The meter should work (beep at button push or at continuity test) even if the screen is detached (or with a faulty solder joint).

Happy Holidays!
MihaiV.

[MihaiV]

The remaining scope captures, attached below.

[MihaiV]

Hello,

Before scorching the MXS (again) to reflow it, I played a little with the TTL console at J5.
At power on it sends a "+"  followed by "Entry point: 0x00060040, address range: 0x00060000-0x003bef68".
Ctrl-C during power-up did not get me to RedBoot.
I pulled down E29 with 1k and that solved it.
Here it is:

Code: [Select]

RedBoot(tm) bootstrap and debug environment [ROMRAM]
                         
Non-certified release, version v2_0_74 - built 15:56:18, Sep 27 2007)
                                                                               
Platform: Fluke Clem (ARM9)
                                                 
Copyright (C) 2000, 2001, 2002, 2003, 2004 Red Hat, Inc.
                     
Copyright (C) 2003, 2004, 2005, 2006, 2007 eCosCentric Limited
             
                                                                               
RAM: 0x00000000-0x007fb500, [0x0004dcb0-0x005d8500] available
                 
FLASH: 0x10000000-0x107fffff, 63 x 0x20000 blocks, 4 x 0x8000 blocks

Next, I poked around the console, especially following the lines from frenky (post 59). My returns are the same, except that the app loads, clem.img.fs is ok.

RedBoot>fconfig -l

Code: [Select]

                                                                   
Run script at boot: false
                                                     
Use BOOTP for network configuration: false
                                   
Gateway IP address: 0.0.0.0
                                                   
Local IP address: 192.168.9.133
                                               
Local IP address mask: 255.255.0.0
                                           
Default server IP address: 192.168.100.100
                                   
Console baud rate: 115200
                                                     
DNS server IP address: 0.0.0.0
                                               
Set eth0 network hardware address [MAC]: true
                                 
eth0 network hardware address [MAC]: 0x00:0x80:0x40:0x00:0x22:0x85
           
GDB connection port: 9000
                                                     
Force console for special debug messages: false
                               
Network debug at boot time: false
      
RedBoot>fis list

Code: [Select]

                                                             
Name              FLASH addr  Mem addr    Length      Entry point
             
RedBoot           0x10000000  0x10000000  0x00040000  0x00000000
             
fs                0x10040000  0x00000000  0x007A0000  0xFFFFFFFF
             
FIS directory     0x107E0000  0x107E0000  0x0001F000  0x00000000
             
RedBoot config    0x107FF000  0x107FF000  0x00001000  0x00000000
        
RedBoot> fs info

Code: [Select]

                                                                 
Filesystems available:
                                                       
devfs
                                                                         
jffs2
                                                   
Devices available:
                                                           
/dev/flash/
             
    
RedBoot>  fs list

Code: [Select]

                                                                   
fs: No filesystems mounted

RedBoot>  fs mount -d /dev/flash/ -t jffs2 /hmm1

Code: [Select]

                                     
fs mount: mount(/dev/flash/,/hmm1,jffs2) failed 2

RedBoot> fs mount -d /dev/flash/ -t devfs /hmm1
                     
RedBoot> fs info

Code: [Select]

                                                         
Filesystems available:
                                                       
devfs
                                                                         
jffs2
                                                               
Devices available:
                                                           
/dev/flash/
                                                                                                   
Mounted filesystems:
                                                         
            Device               Filesystem Mounted on
                       
                     /dev/flash/      devfs /hmm1
                           
RedBoot> fs list

Code: [Select]

                                                           
fs list: no such directory /
   
 
RedBoot>  d -b 0x107FF000 -l 0x00001000

Code: [Select]

                                           
107FF000: 00 10 00 00 CE FA AD 0B  01 0C 01 00 62 6F 6F 74  |............boot|

107FF010: 5F 73 63 72 69 70 74 00  00 00 00 00 04 11 01 0C  |_script.........|

107FF020: 62 6F 6F 74 5F 73 63 72  69 70 74 5F 64 61 74 61  |boot_script_data|

107FF030: 00 62 6F 6F 74 5F 73 63  72 69 70 74 00 66 69 73  |.boot_script.fis|

107FF040: 20 75 6E 6C 6F 63 6B 20  66 73 0A 66 73 20 6D 6F  | unlock fs.fs mo|

107FF050: 75 6E 74 20 2D 64 20 2F  64 65 76 2F 66 6C 61 73  |unt -d /dev/flas|

107FF060: 68 2F 66 69 73 2F 66 73  20 2D 74 20 6A 66 66 73  |h/fis/fs -t jffs|

107FF070: 32 20 2F 0A 6C 6F 61 64  20 2D 6D 20 66 69 6C 65  |2 /.load -m file|

107FF080: 20 2F 73 79 73 74 65 6D  2F 61 70 70 73 2F 63 6C  | /system/apps/cl|

107FF090: 65 6D 2E 69 6D 67 0A 66  73 20 75 6D 6F 75 6E 74  |em.img.fs umount|

107FF0A0: 20 2F 0A 67 6F 20 2D 63  20 2D 6E 0A 0A 00 00 00  | /.go -c -n.....|

107FF0B0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF0C0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF0D0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF0E0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF0F0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF100: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF110: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF120: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF130: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF140: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF150: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF160: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF170: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF180: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF190: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF1A0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF1B0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF1C0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF1D0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF1E0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF1F0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF200: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF210: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF220: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF230: 00 00 00 00 00 00 00 00  00 00 00 00 00 02 14 01  |................|

107FF240: 0C 62 6F 6F 74 5F 73 63  72 69 70 74 5F 74 69 6D  |.boot_script_tim|

107FF250: 65 6F 75 74 00 62 6F 6F  74 5F 73 63 72 69 70 74  |eout.boot_script|

107FF260: 00 01 00 00 00 01 06 01  00 62 6F 6F 74 70 00 00  |.........bootp..|

107FF270: 00 00 00 05 14 00 06 62  6F 6F 74 70 5F 6D 79 5F  |.......bootp_my_|

107FF280: 67 61 74 65 77 61 79 5F  69 70 00 62 6F 6F 74 70  |gateway_ip.bootp|

107FF290: 00 00 00 00 00 05 0C 00  06 62 6F 6F 74 70 5F 6D  |.........bootp_m|

107FF2A0: 79 5F 69 70 00 62 6F 6F  74 70 00 C0 A8 09 85 05  |y_ip.bootp......|

107FF2B0: 11 00 06 62 6F 6F 74 70  5F 6D 79 5F 69 70 5F 6D  |...bootp_my_ip_m|

107FF2C0: 61 73 6B 00 62 6F 6F 74  70 00 FF FF 00 00 05 10  |ask.bootp.......|

107FF2D0: 01 00 62 6F 6F 74 70 5F  73 65 72 76 65 72 5F 69  |..bootp_server_i|

107FF2E0: 70 00 C0 A8 64 64 02 12  01 00 63 6F 6E 73 6F 6C  |p...dd....consol|

107FF2F0: 65 5F 62 61 75 64 5F 72  61 74 65 00 00 C2 01 00  |e_baud_rate.....|

107FF300: 05 07 01 00 64 6E 73 5F  69 70 00 00 00 00 00 01  |....dns_ip......|

107FF310: 09 01 00 65 74 68 30 5F  65 73 61 00 01 00 00 00  |...eth0_esa.....|

107FF320: 06 0E 01 09 65 74 68 30  5F 65 73 61 5F 64 61 74  |....eth0_esa_dat|

107FF330: 61 00 65 74 68 30 5F 65  73 61 00 00 80 40 00 22  |a.eth0_esa...@."|

107FF340: 85 00 00 02 09 01 00 67  64 62 5F 70 6F 72 74 00  |.......gdb_port.|

107FF350: 28 23 00 00 01 13 01 00  69 6E 66 6F 5F 63 6F 6E  |(#......info_con|

107FF360: 73 6F 6C 65 5F 66 6F 72  63 65 00 00 00 00 00 02  |sole_force......|

107FF370: 14 01 13 69 6E 66 6F 5F  63 6F 6E 73 6F 6C 65 5F  |...info_console_|

107FF380: 6E 75 6D 62 65 72 00 69  6E 66 6F 5F 63 6F 6E 73  |number.info_cons|

107FF390: 6F 6C 65 5F 66 6F 72 63  65 00 00 00 00 00 01 0A  |ole_force.......|

107FF3A0: 01 00 6E 65 74 5F 64 65  62 75 67 00 00 00 00 00  |..net_debug.....|

107FF3B0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF3C0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF3D0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF3E0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF3F0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF400: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF410: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF420: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF430: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF440: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF450: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF460: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF470: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF480: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF490: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF4A0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF4B0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF4C0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF4D0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF4E0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF4F0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF500: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF510: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF520: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF530: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF540: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF550: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF560: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF570: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF580: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF590: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF5A0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF5B0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF5C0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF5D0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF5E0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF5F0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF600: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF610: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF620: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF630: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF640: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF650: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF660: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF670: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF680: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF690: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF6A0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF6B0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF6C0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF6D0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF6E0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF6F0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF700: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF710: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF720: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF730: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF740: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF750: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF760: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF770: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF780: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF790: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF7A0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF7B0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF7C0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF7D0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF7E0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF7F0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF800: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF810: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF820: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF830: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF840: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF850: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF860: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF870: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF880: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF890: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF8A0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF8B0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF8C0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF8D0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF8E0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF8F0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF900: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF910: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF920: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF930: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF940: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF950: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF960: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF970: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF980: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF990: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF9A0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF9B0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF9C0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF9D0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF9E0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FF9F0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFA00: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFA10: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFA20: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFA30: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFA40: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFA50: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFA60: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFA70: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFA80: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFA90: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFAA0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFAB0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFAC0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFAD0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFAE0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFAF0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFB00: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFB10: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFB20: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFB30: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFB40: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFB50: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFB60: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFB70: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFB80: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFB90: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFBA0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFBB0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFBC0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFBD0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFBE0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFBF0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFC00: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFC10: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFC20: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFC30: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFC40: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFC50: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFC60: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFC70: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFC80: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFC90: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFCA0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFCB0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFCC0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFCD0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFCE0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFCF0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFD00: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFD10: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFD20: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFD30: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFD40: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFD50: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFD60: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFD70: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFD80: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFD90: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFDA0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFDB0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFDC0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFDD0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFDE0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFDF0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFE00: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFE10: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFE20: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFE30: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFE40: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFE50: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFE60: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFE70: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFE80: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFE90: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFEA0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFEB0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFEC0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFED0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFEE0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFEF0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFF00: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFF10: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFF20: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFF30: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFF40: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFF50: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFF60: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFF70: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFF80: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFF90: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFFA0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFFB0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFFC0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFFD0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFFE0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

107FFFF0: 00 00 00 00 00 00 00 00  AD DE AD DE C2 D7 ED EA  |................|

The script from RedBoot Config

Code: [Select]

fis unlock fs
fs mount -d /dev/flash/fis/fs -t jffs2 /
load -m file /system/apps/clem.img
fs umount /
go -c -n

runs with no errors and brings me to the same result, entry point...

Is there a way to check the RAM? I only found flash operation commands but nothing related to RAM.

[kjk24]

Hi MihaiV,

the ram is usable at redboot see older post,
there are some ram commands avail
like
w4   0x00221000   0xa2120200
mem32 0x8000000,1
J-Link>w4 0x221000,0x80000000
Writing 80000000 -> 00221000
J-Link>mem32 0x8000000,10
08000000 = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
08000010 = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
08000020 = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
08000030 = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
J-Link>w4 0x221000,0x80010000
Writing 80010000 -> 00221000

--------------------
bootscript :

4. fconfig -l show config

5. fconfig -i
Initialize non-volatile configuration - continue (y/n)? y
Run script at boot: true
Boot script:
Enter script, terminate with empty line
>> fis unlock fs
>> fs mount -d /dev/flash/fis/fs -t jffs2 /
>> load -m file /system/apps/clem.img
>> fs umount /
>> go -c -n -w 10000
>>
Boot script timeout (1000ms resolution): 10
Use BOOTP for network configuration: false
Gateway IP address: 0.0.0.0
Local IP address: 192.168.9.133
Local IP address mask: 255.255.0.0
Default server IP address: 192.168.100.100
Console baud rate: 115200
DNS server IP address: 0.0.0.0
Set eth0 network hardware address [MAC]: true
eth0 network hardware address [MAC]: 0x00:0x80:0x40:0x00:0x22:0x85
GDB connection port: 9000
Force console for special debug messages: true
Console number for special debug messages: 0
Network debug at boot time: false
Update RedBoot non-volatile configuration - continue (y/n)? y

@ cristaux66
you need jtag to the msp and MSPFlasher, the hex file for it.
and flash it.

[MihaiV]

Hello kjk24,

We are lucky enough to have a J-link Pro at work! Unfortunately I suck at programming, so I will certainly need more help on setup, commands and such.
I understand that I must install J-MEM and J-Flash from Segger.
I see a file at post 163, (MC9328MXS_1.jflash), with some "steps" inside it (various write and read commands) . Is it a script that runs RAM tests or just a configuration file?

I ran the boot script in redboot step by step and it runs without errors. It loads the clem.img, it mounts it and after the "go -c -n" it prints a "+" and "Entry point ..." and the green led turns off. I see something more at the "go" command, the -w and 10000 that is not in the boot script inside my meter. I'll try it again.

The meter is a 287/NUC (whatever NUC means).
My PCB is marked as REV 015, but there is also a sticker on the PCB with "287 R.020 AJ764496". So i guess it has REV 20 on it, as R277, R125 and R121 are populated (so assembled ModellA, ID0). Also, VR1, VR2, VR3, VR4 and other parts are not populated.

I'll get to the J-link after 5th January. Until then I'll read some more about the J-link tools and check the RAM lines with the scope. Play with hardware 'til i get to the software.

By the way, the Micron part marking decoder indicates that PW755 is for Micron MT45W2MW16BGB-701 IT, and it appears to fit the footprint (at least the VCC and VSS pins do). Is this the one? I saw in your photos a part number marked ISSI, but the photo was not clear enough to see hte code itself.

Thank you,
MihaiV.

[kjk24]

Hello kjk24,

We are lucky enough to have a J-link Pro at work! Unfortunately I suck at programming, so I will certainly need more help on setup, commands and such.
I understand that I must install J-MEM and J-Flash from Segger.
I see a file at post 163, (MC9328MXS_1.jflash), with some "steps" inside it (various write and read commands) . Is it a script that runs RAM tests or just a configuration file?

Not sure what you mean, the bootscript execute and the device is booting without ram tests.

I ran the boot script in redboot step by step and it runs without errors. It loads the clem.img, it mounts it and after the "go -c -n" it prints a "+" and "Entry point ..." and the green led turns off. I see something more at the "go" command, the -w and 10000 that is not in the boot script inside my meter. I'll try it again.

W is wait, see documentation for redboot.
+ is from the chip bootloader (press somthing and you are in....) after that redboot is loading....

The meter is a 287/NUC (whatever NUC means).
My PCB is marked as REV 015, but there is also a sticker on the PCB with "287 R.020 AJ764496". So i guess it has REV 20 on it, as R277, R125 and R121 are populated (so assembled ModellA, ID0). Also, VR1, VR2, VR3, VR4 and other parts are not populated.

I'll get to the J-link after 5th January. Until then I'll read some more about the J-link tools and check the RAM lines with the scope. Play with hardware 'til i get to the software.

By the way, the Micron part marking decoder indicates that PW755 is for Micron MT45W2MW16BGB-701 IT, and it appears to fit the footprint (at least the VCC and VSS pins do). Is this the one? I saw in your photos a part number marked ISSI, but the photo was not clear enough to see hte code itself.
i have pdfs i dont remamber exactly. i have parts left and a hole DMM without display to sell
MT45W2MW16BGB-708-WT-TR
MT45W4MW16BCGB-701-IT-Micron

Thank you,
MihaiV.

[MihaiV]

Hello kjk24,

I checked the fs_info.txt and I found the same things inside my DMM with few exceptions.
My clem.img has a different size (3594744). Yours has 3593752.
In my health directory are two files, one named SysHealthLog (size 35750) and a BackupSysHealthLog (size 4096). Yours has only the SysHealthLog (size 3933).
The contents of fs is listed below:

Code: [Select]

RedBoot> fis unlock fs
RedBoot> fs mount -d /dev/flash/fis/fs -t jffs2 /
RedBoot> fs list
   1 drwxr-xr-x  1 size      0 .
   1 drwxr-xr-x  1 size      0 ..
   4 drwxr-xr-x  1 size      0 tmp
   5 drwxr-xr-x  1 size      0 user
   3 drwxr-xr-x  1 size      0 system
   2 drwxr-xr-x  1 size      0 checkpoint
RedBoot> fs cd tmp
RedBoot> fs list
   4 drwxr-xr-x  1 size      0 .
   1 drwxr-xr-x  1 size      0 ..
RedBoot> fs cd ./
RedBoot> fs list
   1 drwxr-xr-x  1 size      0 .
   1 drwxr-xr-x  1 size      0 ..
   4 drwxr-xr-x  1 size      0 tmp
   5 drwxr-xr-x  1 size      0 user
   3 drwxr-xr-x  1 size      0 system
   2 drwxr-xr-x  1 size      0 checkpoint
RedBoot> fs cd user
RedBoot> fs list
   5 drwxr-xr-x  1 size      0 .
   1 drwxr-xr-x  1 size      0 ..
  10 drwxr-xr-x  1 size      0 setup
  11 drwxr-xr-x  1 size      0 stored
   9 drwxr-xr-x  1 size      0 calibration
RedBoot> fs cd setup
RedBoot> fs list
  10 drwxr-xr-x  1 size      0 .
   5 drwxr-xr-x  1 size      0 ..
1051 -rwxr-xr-x  1 size    371 BackupSetupResetData
1052 -rwxr-xr-x  1 size     44 SetupNonResetData
1053 -rwxr-xr-x  1 size    371 SetupResetData
1050 -rwxr-xr-x  1 size     44 BackupSetupNonResetData
RedBoot> fs cd ..
RedBoot> fs list
   5 drwxr-xr-x  1 size      0 .
   1 drwxr-xr-x  1 size      0 ..
  10 drwxr-xr-x  1 size      0 setup
  11 drwxr-xr-x  1 size      0 stored
   9 drwxr-xr-x  1 size      0 calibration
RedBoot> fs cd stored
RedBoot> fs list
  11 drwxr-xr-x  1 size      0 .
   5 drwxr-xr-x  1 size      0 ..
  12 drwxr-xr-x  1 size      0 meas
  14 drwxr-xr-x  1 size      0 peak
  13 drwxr-xr-x  1 size      0 minmax
  15 drwxr-xr-x  1 size      0 recording
  16 drwxr-xr-x  1 size      0 records
RedBoot> fs cd ..
RedBoot> fs list
   5 drwxr-xr-x  1 size      0 .
   1 drwxr-xr-x  1 size      0 ..
  10 drwxr-xr-x  1 size      0 setup
  11 drwxr-xr-x  1 size      0 stored
   9 drwxr-xr-x  1 size      0 calibration
RedBoot> fs cd calibration
RedBoot> fs list
   9 drwxr-xr-x  1 size      0 .
   5 drwxr-xr-x  1 size      0 ..
  28 -rwxr-xr-x  1 size   1098 CalConstant
RedBoot> fs cd ./
RedBoot> fs list
   5 drwxr-xr-x  1 size      0 .
   1 drwxr-xr-x  1 size      0 ..
  10 drwxr-xr-x  1 size      0 setup
  11 drwxr-xr-x  1 size      0 stored
   9 drwxr-xr-x  1 size      0 calibration
RedBoot> fs cd ./ !!!!!!!! nu merge
RedBoot> fs list
   1 drwxr-xr-x  1 size      0 .
   1 drwxr-xr-x  1 size      0 ..
   4 drwxr-xr-x  1 size      0 tmp
   5 drwxr-xr-x  1 size      0 user
   3 drwxr-xr-x  1 size      0 system
   2 drwxr-xr-x  1 size      0 checkpoint
RedBoot> fs cd system
RedBoot> fs list
   3 drwxr-xr-x  1 size      0 .
   1 drwxr-xr-x  1 size      0 ..
   6 drwxr-xr-x  1 size      0 apps
   7 drwxr-xr-x  1 size      0 health
RedBoot> fs cd apps
RedBoot> fs list
   6 drwxr-xr-x  1 size      0 .
   3 drwxr-xr-x  1 size      0 ..
   8 -rw-r--r--  1 size 3594744 clem.img // different size
RedBoot> fs cd ..
RedBoot> fs list
   3 drwxr-xr-x  1 size      0 .
   1 drwxr-xr-x  1 size      0 ..
   6 drwxr-xr-x  1 size      0 apps
   7 drwxr-xr-x  1 size      0 health
RedBoot> fs cd health
RedBoot> fs list
   7 drwxr-xr-x  1 size      0 .
   3 drwxr-xr-x  1 size      0 ..
 904 -rwxr-xr-x  1 size  35750 SysHealthLog // different size
  41 -rwxr-xr-x  1 size   4096 BackupSysHealthLog // new file
RedBoot> fs cd ./
RedBoot> fs list
   1 drwxr-xr-x  1 size      0 .
   1 drwxr-xr-x  1 size      0 ..
   4 drwxr-xr-x  1 size      0 tmp
   5 drwxr-xr-x  1 size      0 user
   3 drwxr-xr-x  1 size      0 system
   2 drwxr-xr-x  1 size      0 checkpoint
 
RedBoot> fs cd checkpoint
RedBoot> fs list
   2 drwxr-xr-x  1 size      0 .
   1 drwxr-xr-x  1 size      0 ..
  40 -rwxr-xr-x  1 size      4 uid
  17 -rwxr-xr-x  1 size      4 sysFilesBytes

Next, I updated the bootscript with the one from the redboot info.txt file you attached.
I introduced the exact instructions, keeping the MAC address:

Code: [Select]

RedBoot> fconfig -i
Initialize non-volatile configuration - continue (y/n)? y
Run script at boot: true
Boot script:
Enter script, terminate with empty line
>> fis unlock fs
>> fs mount -d /dev/flash/fis/fs -t jffs2 /
>> load -m file /system/apps/clem.img
>> fs umount /
>> go -c -n -w 10000
>>
Boot script timeout (1000ms resolution): 10
Use BOOTP for network configuration: false
Gateway IP address: 0.0.0.0
Local IP address: 192.168.9.133
Local IP address mask: 255.255.0.0
Default server IP address: 192.168.100.100
Console baud rate: 115200
DNS server IP address: 0.0.0.0
Set eth0 network hardware address [MAC]: true
eth0 network hardware address [MAC]: 0x0E:0x00:0x00:0xEA:0x18:0xF0
GDB connection port: 9000
Force console for special debug messages: true
Console number for special debug messages: 0
Network debug at boot time: false
Update RedBoot non-volatile configuration - continue (y/n)? y
RedBoot> reset
... Resetting.

And reset. Here is the output:

Code: [Select]

+Aborted RBINIT
No network interfaces found

RedBoot(tm) bootstrap and debug environment [ROMRAM]
Non-certified release, version v2_0_74 - built 15:56:18, Sep 27 2007

Platform: Fluke Clem (ARM9)
Copyright (C) 2000, 2001, 2002, 2003, 2004 Red Hat, Inc.
Copyright (C) 2003, 2004, 2005, 2006, 2007 eCosCentric Limited

RAM: 0x00000000-0x007fb500, [0x0004dcb0-0x005d8500] available
FLASH: 0x10000000-0x107fffff, 63 x 0x20000 blocks, 4 x 0x8000 blocks
== Executing boot script in 10.000 seconds - enter ^C to abort
RedBoot> fis unlock fs
RedBoot> fs mount -d /dev/flash/fis/fs -t jffs2 /
RedBoot> load -m file /system/apps/clem.img
Entry point: 0x00060040, address range: 0x00060000-0x003bef68
RedBoot> fs umount /
RedBoot> go -c -n -w 5
About to start execution at 0x00060040 - abort with ^C within 5 seconds

It start execution in 5s because I wanted to see what happens after: nothing different, the green led turns off and the same gray screen appears.

Here is what I don't understand (please correct where I am wrong):
- the clem.img is the application that manages everything and is stored in Flash.
- At boot, the script mounts the JFFS2 partition that contains the clem.img
- Next, we load the clem.img itself. This means it is now loaded in RAM, right?
- Next, the go command initiates execution.

Now about the the redboot_info.txt (also correct me where I am wrong):
- The " fis create fs -n -f 0x10040000 -l 0x007A0000 " command will create in FLASH a new file system, starting at address 0x10040000, with length 0x007A0000. The -n will not alter the flash contents, so there is no danger to overwrite important stuff, right?
- The next instructions load the newly created file system in RAM, starting at the lowest free RAM address and write the clem.img in RAM, correct?:

Code: [Select]


load fs -r -b %{FREEMEMLO} -m ymodem
fis unlock fs
fis create fs

load clem.img -r -b 0x00050000 -m ymodem
fs write -b 0x00050000 -l 0x003bd617 clem.img

RedBoot>fis list

Name              FLASH addr  Mem addr    Length      Entry point
RedBoot           0x10000000  0x10000000  0x00040000  0x00000000
fs                0x10040000  0x00000000  0x007A0000  0xFFFFFFFF
FIS directory     0x107E0000  0x107E0000  0x0001F000  0x00000000
RedBoot config    0x107FF000  0x107FF000  0x00001000  0x00000000

- Next, we run "by hand" the boot script:

Code: [Select]

RedBoot config:
fis unlock fs
fs mount -d /dev/flash/fis/fs -t jffs2 /
load -m file /system/apps/clem.img
fs umount /
go -c -n -w 10000

- The "fis init" command appears to format the FLASH. Won't I loose the clem.img and everything in flash?
- The "copy files to device" commands at the end of the file appear to duplicate the clem.img and save it to BackupClem.img. Where do I get the "new" clem.img and how do I ulopad it? What exactly happens here?

Code: [Select]

copy file to device:

boot to redboot
fis unlock fs
fs mount -d /dev/flash/fis/fs -t jffs2 /
fs cd /system/apps/
fs list
fs move clem.img BackupClem.img
load clem.img -r -b 0x00050000 -m ymodem
fs write -b 0x00050000 -l 0x003bd617 clem.img
RedBoot> fs list
   6 drwxr-xr-x  1 size      0 .
   3 drwxr-xr-x  1 size      0 ..
 621 -rwxr-xr-x  1 size 3921431 clem.img
 596 -rwxr-xr-x  1 size 3922423 BackupClem.img
RedBoot> reset

Sorry for my lack of computer knowledge, they were overwritten long ago.
Thank you for your time and patience,
MihaiV.

[booyeah]

For the clem.img:
https://www.fluke.com/en-ie/support/software-downloads/fluke-287-and-289-multimeter-firmware-update
The downloaded 287 update exe creates a folder containing clem_1_16.img.gz which contains the clem.img

Note it also says "Version 1.16 does not apply for units labeled 287/TPWS or 287/NUC." so might want to check which meter you have.

My 287, 289 and the downloaded clem.img are all version 1.6 so have a size of 3593752.

Not sure how you'd check which version you have, but as per kjk24s posts you could create a backup copy of the existing clem.img first.

[MihaiV]

Damn  ! It's a NUC!


I don't now what software version I have though. I'm only getting the redboot version, not the application version. I don't have even the DMM's serial number (or I'm looking in the wrong places).

I also do not have an IR189USB cable, but I found some homebrew ones here: https://www.eevblog.com/forum/buysellwanted/w-t-b-fluke-ir189-usb-usb-cable-280180-series/msg1436629/#msg1436629
I'll  try the transistor one first. I already have a FTDI USB-TTL converter and the rest is peanuts.

How can I check if the optical interface works? I guess it should respond to commands (such as ID) or be detected by the update software.
I doubt it would respond at QM  .

In case the optical path is not working, can a Jlink be used to replace the entire content of the flash with a copy from another (working) meter?

MihaiV.

[Arhigos]

Damn  ! It's a NUC!
(Attachment Link)

I don't now what software version I have though. I'm only getting the redboot version, not the application version. I don't have even the DMM's serial number (or I'm looking in the wrong places).

I also do not have an IR189USB cable, but I found some homebrew ones here: https://www.eevblog.com/forum/buysellwanted/w-t-b-fluke-ir189-usb-usb-cable-280180-series/msg1436629/#msg1436629
I'll  try the transistor one first. I already have a FTDI USB-TTL converter and the rest is peanuts.

How can I check if the optical interface works? I guess it should respond to commands (such as ID) or be detected by the update software.
I doubt it would respond at QM  .

In case the optical path is not working, can a Jlink be used to replace the entire content of the flash with a copy from another (working) meter?

MihaiV.

287/nuc is a special version of multimeter for french nuclear power plants and it has different firmware, different hardware and even different shield design. Even if you somehow upload flash from regular model 287 it will not work properly.

To check remote interface use 115200 Baud, no parity, 8 bits, 1 stop bit and it should respond to ID command with model and serial number. Viewforms software will also autodetect and autoconnect to the meter

[MihaiV]

Hello Arhigos,

Indeed I got the dmm from a French seller.

It doesn't appear to have much shielding, in fact there is none at all, on the enclosure or PCB. I attached some photos with it.
As for the hardware, in the placed I looked I couldn't find differences from the meters in this thread. Perhaps they are more subtle or in other places. Could you please point out some of them? Where should I look?

I must mention that the meter was opened before it got to me. The screw heads on the input jacks were slightly damaged, like an unsuitably large screwdriver was used to tighten them. So someone played in there before.

I will return with the result on the optical path. I don't have the Fluke View Forms software, so I'll try it with a serial terminal.

[MihaiV]

And the next attachments.

[MihaiV]

.

[Arhigos]

Board looks different from other nuc that i saw, but could be just a different revision. Or you could have a board from regular fluke 287 swapped inside the nuc case. The one i saw had a big resistors under resistor network and shield was different so that modified PCB can fit inside the meter.

Also, maybe i missing that, but what was the current draw when meter turns on? Also, it seems like you missing beeper for some reason. Did you just removed beeper?

[MihaiV]

Hello,

Thanks for the details. Maybe only the LCD bezel with the NUC inscription is changed.

I removed the beeper to be able to apply heat from under the MXS. Being plastic, I figured it could get some damage.

The back-up capacitor had a trace of corrosion so I removed it before anything else.

F1 fuse was missing from the beginning. Only F2 was installed.

I also changed the MXS crystal, as the original one was not oscillating at all. But the boot splash screen displayed without it. I used a low capacitance probe for it. With the new one it is strong and stable.

The current draw is each phase is:
- in sleep (9V applied, meter off): 36uA;
- during boot (while green led is on): 44mA
- after boot (led off, screen gray): 15.2mA

Boot appears to be divided in two: for ~1s it draws 7mA, then for 0.5s it draws 10mA and after this the led turns on and it jumps to 44mA.
After the power on button is pressed the beeper makes a very short beep (barely audible, 10us) and the same thing just before the screen goes gray.

I must mention that the 5V rail for the analog side is not enabled, the MSP keeps the regulator disabled, so those 15mA are only for the digital side.

[Arhigos]

- after boot (led off, screen gray): 15.2mA

I must mention that the 5V rail for the analog side is not enabled, the MSP keeps the regulator disabled, so those 15mA are only for the digital side.

Yeah that sounds little bit low. It should be somewhere over 20mA.
Have you checked l1 and l2 inductors?

[MihaiV]

L1 and L2 are ok, and so are all regulators. I have 1.805V at TP18, 2.950 at E35, 21.174V at E41 and 3.055 at TP32.
U17 is also OK, meaning it provides 5V for a moment, but is quickly disabled by the MSP430.
Yesterday I breadboarded and validated a IR serial link using a FTDI and I'm building it on proto-board.
I configured the link in loopback (IR led looking straight at the phototransistor) and I started the FlukeView. With a port sniffer I observed several identifications commands sent by Forms: ID, ~ID, *IDN?  with 115200 and 9600 baud.

Just to make sure, the IR receiver is CR13, the component with the dark package, right?

[MihaiV]

Hello,

I made a optical USB adapter (as in reply nr. 2 here: https://www.eevblog.com/forum/buysellwanted/w-t-b-fluke-ir189-usb-usb-cable-280180-series/msg1436629/#msg1436629). I built the one without comparators and tested it in optical loopback mode at 115200 baud.

Stuck it in the meter's "eyes" and no response. I traced the signal through the photodiode, R150 to U23 (an OPA364). Also tried it with TX inverted, but in both cases there was no response on the IR led. The signal looks good, even at 57600 max baud coming from the FlukeView forms software. Interesting fact that the negative supply of U23 comes through a diode in CR12. Perhaps to keep the inputs/output in proper operating range (even though it is RRIO).

I have one more lead with the Jlink, to check RAM operation as kjk24 instructed above, but after that I'm out of ideas.

[Arhigos]

At this point i think you probably have bad bga flash chip or corrupted flash, or dead cpu.

You will not get ir communication until arm processor is fully boot up.  You have 2 ethernet connectors for that kind of debug, but I don't know how to use them.

[maximalcho]

Hi MihaiV
did you try to connect fluke with J-Link because I fail. I try to connect it according to J-Link pinout without success.
 
I have another jtag programmer  with which I manage to connect to MXS but I do not have access to flash memory or maybe flash is dead.

[MihaiV]

Hi maximalcho,

I was away for the week so I didn't have a chance to try it.
Will try something this weekend and posts results (if any) here.

[maximalcho]

i fixed my multimeter.I changed flash ic and program with one of dumps from here.The multimeter is now fully functional.

[MihaiV]

Congratulations, hope you enjoy the meter for a long time!
May I ask what flash contents and what component part number you used? You used the Jlink or another programmer?
Thanks,
Mihai V.

[maximalcho]

First I used dump from kjk24 (thank you kjk24) reply #153  and program last dump from archive (_ok_0x10000000-0x101E0010).Multimeter start but not fully load (my multimeter was fully dead) then i program dump from AnJu (Спасибо AnJu ) reply #83 and thadaaa the multimeter came back to life.And because the АnJu dump is from 287 and mine is 289, I made an official update for 289 via the Ir port just in case.I used the jlink programmer and I ordered the flash ic from digikey https://www.digikey.bg/en/products/detail/alliance-memory-inc/PC28F640P30TF65A/13543373.

PS:To make connection with Jlink LCD must be connected ! Оtherwise mxs is in sleep mode and no connection can be made.

[maximalcho]

One more thing.First when i program dump from kjk24 my multimeter stuck at the same screen like yours from reply #166.You can try to program with jlink a dump from AnJu and if you are lucky the multimeter will come to life.

[MihaiV]

Hello,

Thank you!
I tried today something. Here goes:

I managed to connect to the target using Jflash and the configuration file from post #163, from kaiser. The log output is:

Code: [Select]

Connecting ...
 - Connecting via USB to probe/ programmer device 0
 - Probe/ Programmer firmware: J-Link Pro V4 compiled Sep 24 2021 16:41:59
 - Device "ARM7" selected.
 - Target interface speed: 30 kHz (Fixed)
 - VTarget = 3.071V
 - TotalIRLen = 4, IRPrint = 0x01
 - JTAG chain detection found 1 devices:
 -  #0 Id: 0x1092001D, IRLen: 04, ARM920T Core
 - Identified core does not match configuration. (Found: ARM9, Configured: ARM7)
 - CP15.0.0: 0x41129200: ARM, Architecture 4T
 - CP15.0.1: 0x0D172172: ICache: 16kB (64*8*32), DCache: 16kB (64*8*32)
 - Cache type: Separate, Write-back, Format A
 - Executing init sequence ...
  - Initialized successfully
 - Adaptive clocking not supported for selected CPU core. Only supported for -S cores.
 - Auto JTAG speed: 8000 kHz
 - Target interface speed: 8000 kHz (Auto)
 - Found 1 JTAG device. Core ID: 0x1092001D (None)
 - Connected successfully

Next, I tried to read the flash contents: Target>Manual Programming>Read back>Entire chip.
The response is:

Code: [Select]

Reading selected sectors ...
 - 67 of 67 sectors selected, 1 range, 0x10000000 - 0x107FFFFF
 - Start of determining flash info (Bank 0 @ 0x10000000)
 - End of determining flash info
 - Flash bank info:
 - 63 * 128 KB @ 0x10000000
 - 4 * 32 KB @ 0x107E0000
 - Start of preparing flash programming
 - ERROR: Failed to read back RAMCode for verification.
 - ERROR: Failed to prepare for programming.
Failed to download RAMCode!
 - End of preparing flash programming
 - Start of restoring
 - End of restoring
 - ERROR: Failed to read back target memory
Disconnecting ...
 - Disconnected

And a warning message (photo 3).


Next, I tried to connect using the command line (JLink commander). Connected ok and saved the entire contents of the flash using savebin command, starting from address 0x10000000.
And it worked, i have a copy of the flash contents, from 0x10000000 to 0x107FFFFF. This means that the flash chip and the connections to it are ok.

I attached it below.
I checked its contents with the dump from AnJu, as indicated by maximalcho (Thansks!). They are very similar.

I tried to check the RAM, as indicated by kjk24 in post 201, using the w4 and mem32 commands.
However, there is no response. I tried with single bytes and I do not get an output. See photo 2.

Reading works using the mem8 command on flash (see photo 1). The output fits with the contents i got using the savebin command.



Does it mean i have a bad ram, or with bad connections?
Is itpossible to brick the meter if I upload the contents from AnJu ("2.fs 0x10040000.bin" starting from address 0x10040000 and "3.FIS directory 0x107E0000.bin" from address 0x107E0000) and having a bad ram?

Especially if using "Use target ram" option enabled?

Thank you,
MihaiV.

[maximalcho]

Once you have a full dump on your flash chip I don't think you can brick the multimeter.If the ram is really damaged when trying to program flash it will probably give an error in the worst case the device will stop but when you change the ram you will be able to restore it.If you try to program flash and it doesn't work you may have tried to reball the memory or just to reflow.Try to change the core type in the configuration file because it is not correct at the moment, but keep in mind that when you change it you have to reconfigure the type of flash memory and its address.

[MihaiV]

Correct, the configuration file from post 163 is set with an ARM7 core, while the MXS datasheet says it uses an ARM9. But won't the setting be the same (base address, size, organization)? (I have a 287, by the way).

[maximalcho]

Yes the flash settings are the same but when you change core type they return by default and you have to set them again.Maybe changing core type from arm7 to arm9 doesn't matter but i changed it just in case.
My English is not very good I hope you understand what I mean.

[MihaiV]

Your English is good, I understood with no problems!
I switched to ARM9 too, re-configured the flash settings.
Here is a fun fact though: I tried reading again the entire chip and got the same error with ramCode and all, and after that it struck me to try it without using the target ram. I unticked the setting and now I can read the chip, without any command-line magic! And fairly quick too, only 23 seconds.

I also tried to program it with AnJu's file but the chip is locked. I get a "Block lock-bit detected!". I guess i have to erase the entire chip to unsecure it, right?

[MihaiV]

I must have done something really wrong here...
I erased the entire flash yesterday and then I was able to program the first part of AnJu's binary (2.fs 0x10040000.bin).
Without using target RAM it only took 14592 seconds, but it completed successfully (in attachment). Today I tried to upload the remaining part ( 3.FIS directory 0x107E0000.bin ) but I couldn't! I got the same "Block lock-bit detected!" message on the J-Flash.

Prepairing for another 4h of uploading, I erased the flash again to "unlock" it, to flash the FIS directory and after that the rest of the fs. But I couldn't do any of it! The flash is empty, I can read it back, but I can't even write the initial content!

Is there a way to erase those lock-bits? Did I brick it?

[ehobby]

Hopefully just a quick question...  Has anyone come across a datasheet or app note for the LTC939CS regulator used in the 289?  I have not been able to find anything on the web except the fact that lots of third parties stock it.

Thanks

[MihaiV]

Hi,

If it is U10 you are refering to, it is a LTC2415-1, and it is a sigma-delta ADC, 24 bit.
The second row contains the actual part number.
Datasheet in attachement.

MihaiV.

[ehobby]

MihaiV,
Thanks for responding and providing the datasheet for the LTC2415-1.

I actually was looking for the datasheet for the LTC939CS which seems to be near impossible to find. Been hunting this for quite a while. Have looked in Linear databooks from around 2000 and all over the web, including the Linear/Analog website.

Thanks

[maximalcho]

Hi MihaiV,
You can try what i did,First try to flash dump from kjk24 then from AnJu but from AnJu dumps i use only one file but I don't remember which of the two files I used fs or fis.There is also a high probability that the flash chip has bad blocks.Why waste your time and not order a new ram memory and a new flash chip according to what you describe your problem is in one of them or both.Did you try to reflow ram ic ?

[kaiser]

I must have done something really wrong here...
I erased the entire flash yesterday and then I was able to program the first part of AnJu's binary (2.fs 0x10040000.bin).
Without using target RAM it only took 14592 seconds, but it completed successfully (in attachment). Today I tried to upload the remaining part ( 3.FIS directory 0x107E0000.bin ) but I couldn't! I got the same "Block lock-bit detected!" message on the J-Flash.

Prepairing for another 4h of uploading, I erased the flash again to "unlock" it, to flash the FIS directory and after that the rest of the fs. But I couldn't do any of it! The flash is empty, I can read it back, but I can't even write the initial content!

Is there a way to erase those lock-bits? Did I brick it?

Try shorting J4 jumper at power up to put into boot mode and try and read flash with J-Flash and the init script and use target ram ticked..  Hopefully you won't get any errors..  If no errors, then you should be able to write...


K..

[MihaiV]

Hello everyone,

Here is what I did:
- Thank you Kaiser for the J4 tip: shorting it during power-up (and removing it after 2s) allowed me to use the target ram setting in Jflash. I am now able to upload binaries in the flash.
- The chip being blank, I uploaded first the "3.FIS directory 0x107E0000.bin" from post 83, followed by "2.fs 0x10040000.bin". After a re-power, nothing happened. The splash screen that used to appear before my gray screen did not come up and the green led remained constantly on.
- I erased the flash again and uploaded my initial flash contents (with application and bootloader). Now it was doing the splash screen and the gray screen after it. The led turns off, so I am back to my initial state.
- I attempted to upload only the fs ("2.fs 0x10040000.bin") and to keep my initial bootloader, but I couldn't write those sectors because (maybe?) they were not blank. So I erased only the sectors that would be occupied by the fs, starting from 0x10040000 until 0x107DFFFF.
- After erasing the selected sectors, I uploaded the "2.fs 0x10040000.bin".
- Repower and ... IT BOOTS!!!
- It went past the splash screen, greeting me with the lost date and time message (the back-up cap being gone). The buttons work, the beeper works, I can see the meter info (photos 1 and 2) ... awww, it's awesome!!

But hold on to your hats, it's not over yet!
I had the selector on VAC, and sure, it displayed 0.0000VAC (photo 3).
Check photo 4 on the mVAC: blank! Same on the VDC, Ohms A/mA and uA.
But on the mVDC it displays Ohms and on Diode/Cap it goes in uA. Lead detection works, by the way.

Continuity does not beep and Ohms measurement has a ~2.2K offset. Once eliminated with relative mode it measures resistors accurately.
This appears related to the weird voltages i measured during reverse engineering the rotary switch (in post 185).

Voltages available on pin 95 of MSP are not monotonic with rotary switching and some positions provide overlapping voltages.
Will investigate this now, starting with voltage measurement at the voltage divider input, followed by providing voltages externally, to identify the voltage range for each meter function.

I hope I don't have a swapped rotary encoder, I would be screwed! Since the meter works with a standard 287 software, is is clearly a 287 board swapped in a 287/Nuc case.

Thank you Kaiser, maximalcho and everyone for al your tips and advice, I wouldn't have don it without you!
Now, to deal with the rotary...

[MihaiV]

And the following photos...

[MihaiV]

Here is the one on VAC...

[MihaiV]

And mVAC.

[maximalcho]

I forgot about the damn jumper. Good thing at least Kaiser remembered.I'm glad you made the multimeter too.

[kaiser]

And mVAC.

Is it possible that the aligning holes on the rotary switch which mates to the rotary housing is out by 180° ?  I realise that one of the locating holes is larger than the other but possibly with enough force it will mate incorrectly..

P.S  Well done on your progress thus far..

K..

[MihaiV]

Hello,

I had to delay the repair for a while, but I'm on it again. I started troubleshooting the weird selector switch operation.
First, I checked all contacts, on PCB and the moving parts, to ensure there is no oxidation or faulty contact. No problems here.

In a previous post (nr 185) and with the help of Towlerar I focused a little on the voltage divider used for range selection, so I checked what voltage is required for what function. Also useful to see if the software does what it should.

I took a multi-turn pot (1K, the panel mount type), tied its ends to GND and the 2.5V reference and the wiper to R19, going to pin 95 of MSP.
All ranges are detected, and the results are in the table below. Measurements were made with a meter from work, set on Hi-Z. Putting 10Meg in parallel with 1Meg of R19 introduces a bit of error.

Fit the moving parts back (by the way, there is no way to assemble it wrong, maybe with the hammer, but there were no signs of brute force) and measure the output on each range (attached in the second table).

I noticed that all were a bit higher than it was needed. First, I thought that there was some flux residue under the first few resistors, so i cleaned them again, but there was no change. Using the 10Meg input also didn't change a thing. I wanted to fit a higher resistance above the first resistor in the divider, on the 2.5V side, an then it struck me to check R19. Out of the circuit, it was open!

I imagine I must have broken it myself when I desoldered it first time. Replace it with a new one and it works !!!
All functions are on their proper positions, none missing! Put the thing back together, to check the enclosure effect (meaning that things work when open and not when in their enclosure) and it works, all of it! Wow, I thought I wouldn't make it!

Big thanks to everyone that contributed to this forum and tipped me with great advice!

Here is the list of faults in my unit:
- Slightly corroded back-up capacitor. Remove and replace (don't know with what yet, but I saw a topic on it in the forum).
- Faulty solder joint under the MXS: showed the splash-screen only when pressing on it or warping the board. Reflowed the thing with liquid flux and hot air.
- Faulty MXS crystal, 32.768 KHz. Not oscillating, maybe cracked (?). Replaced with something else, and it runs. Make sure you use a low capacitance probe on it.
- Corrupted/wrong application. Fixed using the binary from AnJu, only the "2.fs 0x10040000.bin" file, I kept my own bootloader. Make sure you short JP4 at power-up. This removes the lock-bit problem when using the Jlink to write/delete the flash memory.
- Faulty resistor at the rotary switch, showing wrong voltages to the MSP430. Most likely because of me, not a fault from the beginning.

Glad to save it from the landfill!

I wanted this meter for my little brother, he got in the Polytechnic University last year, at some kind of light version of the electronics faculty, and I want him to start working with actual parts and tools, not only with paper and simulations. He saw it, but he doesn't know it's for him (he calls it "the yellow dumpster"). I can't wait to see his face when I'll give it to him! 

Thank you everyone!