Author Topic: Fluke 289 not quite sorted. (Read 57865 times)

frenky · « **Reply #50 on:** January 05, 2018, 10:07:31 am »

Some research...

Fluke 287/289 are using RedBoot/eCos:

Quote

eCos and RedBoot based products showcase
Industrial and Automotive
Fluke 289 and 287 True-RMS Multimeters. Fluke's "The Most Advanced Multimeters, Ever", data logging & graphing multimeters.

https://lists.ecoscentric.com/ecos/examples.shtml

So I have been reading alot about RedBoot and found this:

Quote

Accessing RedBoot
After all connections have been made, start the serial terminal application and apply power to the board. Press Ctrl+C several times on the serial terminal until you see the RedBoot> prompt. If the kernel begins to boot, reset the board and try again (the standard timeout before booting the kernel is one second). On most versions of RedBoot, you will see either a '+' or a message from RedBoot before it boots the kernel, but some configurations have this disabled.

http://wiki.emacinc.com/wiki/Loading_Images_with_RedBoot

So the reason that I could not write to console is that I was trying to do it after the kernel has already booted.
So I'll try sending in Ctrl+C every half a second and then power up the Fluke 287. Hopefully I'll be able to access console this way...

purpose · « **Reply #51 on:** January 06, 2018, 12:19:25 pm »

Incoming.

purpose · « **Reply #52 on:** January 06, 2018, 12:30:04 pm »

9V TO PADS, IN AC V MODE, ALL READINGS RELATIVE TO NEG PAD.

TP
1 0.005
2 3.11
3 4.99
4 3.11
5 3.09
6 3.09
7 0.00
8 9.00
9 2.30
10 0.00
11 0.158
12 0.00
13 3.06
14 0.00
15 2.94
16 2.909
17 3.11
18 1.82
19 2.94
20 2.94
21 2.94
22 2.94
23 2.94

28 0.00
30 0.00
31 0.00
32 3.11
33 3.11
34 0.22

Off state showed only residual and dropping V readings.

Your pic answers.
tp3 4.99
x1 0.00
x2 0.903
x3 2.941
x4 0.910
x5 1.820

More to follow.

purpose · « **Reply #53 on:** January 06, 2018, 12:35:47 pm »

Tants

61 17.55
58 1.245
56 2.493
59 20.03
62 18.79
60 8.99
57 9.00
53 8.69
51 9.00
44 4.98
32 2.50
26 2.50
20 4.98
89 8.99
80 1.82
68 1.82
79 2.94
67 2.94
68 1.82
41 2.50
42 3.11
35 3.11

Peter

frenky · « **Reply #54 on:** January 07, 2018, 07:24:25 am »

Wow thank you. You are the best!

I'm sure that many (including me of course) will find your effort realy helpful while trying to fix faulty Fluke 287/289.

frenky · « **Reply #55 on:** January 07, 2018, 02:15:23 pm »

Tadaaaa:

Code: [Select]

RedBoot> ^C
RedBoot> help
Manage aliases kept in FLASH memory
   alias name [value]
Set/Query the system console baud rate
   baudrate [-b <rate>]
Manage machine caches
   cache [ON | OFF]
Display/switch console channel
   channel [<channel number>]
Compute a 32bit checksum [POSIX algorithm] for a range of memory
   cksum -b <location> -l <length>
Test clock accuracy
   clock 
Display (hex dump) a range of memory
   dump -b <location> [-l <length>] [-s] [-1|-2|-4]
Execute an image - with MMU off
   exec [-w timeout] [-b <load addr> [-l <length>]]
        [-r <ramdisk addr> [-s <ramdisk length>]]
        [-c "kernel command line"] [-t <target> ] [<entry_point>]
Manage FLASH images
   fis {cmds}
Manage configuration kept in FLASH memory
   fconfig [-i] [-l] [-n] [-f] [-d] | [-d] nickname [value]
Manage Filesystem files
   fs {cmds}
Execute code at a location
   go [-w <timeout>] [-c] [-n] [entry]
Help about help?
   help [<topic>]
Display command history
   history 
Set/change IP addresses
   ip_address [-b] [-l <local_ip_address>[/<mask_len>]] [-h <server_address>] [-d <dns_server_address]
Load a file
   load [-r] [-v] [-d] [-h <host>] [-p <TCP port>][-m <varies>] [-c <channel_number>] 
        [-b <base_address>] <file_name>
Compare two blocks of memory
   mcmp -s <location> -d <location> -l <length> [-1|-2|-4]
Copy memory from one address to another
   mcopy -s <location> -d <location> -l <length> [-1|-2|-4]
Fill a block of memory with a pattern
   mfill -b <location> -l <length> -p <pattern> [-1|-2|-4]
Network connectivity test
   ping [-v] [-n <count>] [-l <length>] [-t <timeout>] [-r <rate>]
        [-i <IP_addr>] -h <IP_addr>
Reset the system
   reset 
Display RedBoot version information
   version 
Display (hex dump) a range of memory
   x -b <location> [-l <length>] [-s] [-1|-2|-4]

Correct pinout:

purpose · « **Reply #56 on:** January 07, 2018, 04:10:31 pm »

You're welcome Frenky.
Does Tadaaaa mean you've fixed her?

frenky · « **Reply #57 on:** January 07, 2018, 06:19:13 pm »

Quote from: purpose on January 07, 2018, 04:10:31 pm

You're welcome Frenky.
Does Tadaaaa mean you've fixed her?

No sadly not. But it is a progress. Next I'll try to load a data image from firmware update into flash memory.

Sent from my SM-N9005 using Tapatalk

purpose · « **Reply #58 on:** January 07, 2018, 06:46:59 pm »

Good luck.

frenky · « **Reply #59 on:** January 08, 2018, 08:03:16 pm »

Tnx.

I'm digging trough debug console...

RedBoot> fconfig -l

Code: [Select]

Run script at boot: false
Use BOOTP for network configuration: false
Gateway IP address: 0.0.0.0
Local IP address: 192.168.9.133
Local IP address mask: 255.255.0.0
Default server IP address: 192.168.100.100
Console baud rate: 115200
DNS server IP address: 0.0.0.0
Set eth0 network hardware address [MAC]: true
eth0 network hardware address [MAC]: 0x00:0x80:0x40:0x00:0x22:0x85
GDB connection port: 9000
Force console for special debug messages: false
Network debug at boot time: false

RedBoot>fis list

Code: [Select]

Name              FLASH addr  Mem addr    Length      Entry point
RedBoot           0x10000000  0x10000000  0x00040000  0x00000000
fs                0x10040000  0x00000000  0x007A0000  0xFFFFFFFF
FIS directory     0x107E0000  0x107E0000  0x0001F000  0x00000000
RedBoot config    0x107FF000  0x107FF000  0x00001000  0x00000000

RedBoot>fs info

Code: [Select]

Filesystems available:
devfs
jffs2

Devices available:
/dev/flash/

RedBoot>fs list

Code: [Select]

fs: No filesystems mounted
RedBoot> fs mount -d /dev/flash/ -t jffs2 /hmm1

Code: [Select]

fs mount: mount(/dev/flash/,/hmm1,jffs2) failed 2
RedBoot> fs mount -d /dev/flash/ -t devfs /hmm1
RedBoot> fs info

Code: [Select]

Filesystems available:
devfs
jffs2

Devices available:
/dev/flash/

Mounted filesystems:
            Device               Filesystem Mounted on
                     /dev/flash/      devfs /hmm1

RedBoot> fs list

Code: [Select]

fs list: no such directory /

frenky · « **Reply #60 on:** January 09, 2018, 08:29:55 pm »

So I dumped contents of "RedBoot config" and got this out:

d -b 0x107FF000 -l 0x00001000

Code: [Select]

107FF000: 00 10 00 00 CE FA AD 0B  01 0C 01 00 62 6F 6F 74  |............boot|
107FF010: 5F 73 63 72 69 70 74 00  00 00 00 00 04 11 01 0C  |_script.........|
107FF020: 62 6F 6F 74 5F 73 63 72  69 70 74 5F 64 61 74 61  |boot_script_data|
107FF030: 00 62 6F 6F 74 5F 73 63  72 69 70 74 00 66 69 73  |.boot_script.fis|
107FF040: 20 75 6E 6C 6F 63 6B 20  66 73 0A 66 73 20 6D 6F  | unlock fs.fs mo|
107FF050: 75 6E 74 20 2D 64 20 2F  64 65 76 2F 66 6C 61 73  |unt -d /dev/flas|
107FF060: 68 2F 66 69 73 2F 66 73  20 2D 74 20 6A 66 66 73  |h/fis/fs -t jffs|
107FF070: 32 20 2F 0A 6C 6F 61 64  20 2D 6D 20 66 69 6C 65  |2 /.load -m file|
107FF080: 20 2F 73 79 73 74 65 6D  2F 61 70 70 73 2F 63 6C  | /system/apps/cl|
107FF090: 65 6D 2E 69 6D 67 0A 66  73 20 75 6D 6F 75 6E 74  |em.img.fs umount|
107FF0A0: 20 2F 0A 67 6F 20 2D 63  20 2D 6E 0A 0A 00 00 00  | /.go -c -n.....|
107FF0B0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF0C0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF0D0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF0E0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF0F0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF100: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF110: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF120: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF130: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF140: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF150: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF160: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF170: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF180: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF190: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF1A0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF1B0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF1C0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF1D0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF1E0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF1F0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF200: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF210: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF220: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF230: 00 00 00 00 00 00 00 00  00 00 00 00 00 02 14 01  |................|
107FF240: 0C 62 6F 6F 74 5F 73 63  72 69 70 74 5F 74 69 6D  |.boot_script_tim|
107FF250: 65 6F 75 74 00 62 6F 6F  74 5F 73 63 72 69 70 74  |eout.boot_script|
107FF260: 00 01 00 00 00 01 06 01  00 62 6F 6F 74 70 00 00  |.........bootp..|
107FF270: 00 00 00 05 14 00 06 62  6F 6F 74 70 5F 6D 79 5F  |.......bootp_my_|
107FF280: 67 61 74 65 77 61 79 5F  69 70 00 62 6F 6F 74 70  |gateway_ip.bootp|
107FF290: 00 00 00 00 00 05 0C 00  06 62 6F 6F 74 70 5F 6D  |.........bootp_m|
107FF2A0: 79 5F 69 70 00 62 6F 6F  74 70 00 C0 A8 09 85 05  |y_ip.bootp......|
107FF2B0: 11 00 06 62 6F 6F 74 70  5F 6D 79 5F 69 70 5F 6D  |...bootp_my_ip_m|
107FF2C0: 61 73 6B 00 62 6F 6F 74  70 00 FF FF 00 00 05 10  |ask.bootp.......|
107FF2D0: 01 00 62 6F 6F 74 70 5F  73 65 72 76 65 72 5F 69  |..bootp_server_i|
107FF2E0: 70 00 C0 A8 64 64 02 12  01 00 63 6F 6E 73 6F 6C  |p...dd....consol|
107FF2F0: 65 5F 62 61 75 64 5F 72  61 74 65 00 00 C2 01 00  |e_baud_rate.....|
107FF300: 05 07 01 00 64 6E 73 5F  69 70 00 00 00 00 00 01  |....dns_ip......|
107FF310: 09 01 00 65 74 68 30 5F  65 73 61 00 01 00 00 00  |...eth0_esa.....|
107FF320: 06 0E 01 09 65 74 68 30  5F 65 73 61 5F 64 61 74  |....eth0_esa_dat|
107FF330: 61 00 65 74 68 30 5F 65  73 61 00 00 80 40 00 22  |a.eth0_esa...@."|
107FF340: 85 00 00 02 09 01 00 67  64 62 5F 70 6F 72 74 00  |.......gdb_port.|
107FF350: 28 23 00 00 01 13 01 00  69 6E 66 6F 5F 63 6F 6E  |(#......info_con|
107FF360: 73 6F 6C 65 5F 66 6F 72  63 65 00 01 00 00 00 02  |sole_force......|
107FF370: 14 01 13 69 6E 66 6F 5F  63 6F 6E 73 6F 6C 65 5F  |...info_console_|
107FF380: 6E 75 6D 62 65 72 00 69  6E 66 6F 5F 63 6F 6E 73  |number.info_cons|
107FF390: 6F 6C 65 5F 66 6F 72 63  65 00 00 00 00 00 01 0A  |ole_force.......|
107FF3A0: 01 00 6E 65 74 5F 64 65  62 75 67 00 00 00 00 00  |..net_debug.....|
107FF3B0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
107FF3C0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

Made it readable and run found commands manually:

fis unlock fs
fs mount -d /dev/flash/fis/fs -t jffs2 /
load -m file /system/apps/clem.img
fs umount /
go -c -n

Code: [Select]

RedBoot> 
fis unlock fs.fs 
fis unlock fs.fs 
No image 'fs.fs' found
RedBoot> 
fis unlock fs
fis unlock fs
RedBoot> 
fs mount -d /dev/flash/fis/fs -t jffs2 / 
fs mount -d /dev/flash/fis/fs -t jffs2 / 
RedBoot> 
load -m file /system/apps/clem.img.fs
load -m file /system/apps/clem.img.fs
fs: Open failed, error 2
Can't load '/system/apps/clem.img.fs': error 0
RedBoot> 
fs list
fs list
   1 drwxr-xr-x  1 size      0 .
   1 drwxr-xr-x  1 size      0 ..
   4 drwxr-xr-x  1 size      0 tmp
   5 drwxr-xr-x  1 size      0 user
   3 drwxr-xr-x  1 size      0 system
   2 drwxr-xr-x  1 size      0 checkpoint
RedBoot> 
fs list tmp
fs list tmp
   4 drwxr-xr-x  1 size      0 .
   1 drwxr-xr-x  1 size      0 ..
RedBoot> 
fs list user
fs list user
   5 drwxr-xr-x  1 size      0 .
   1 drwxr-xr-x  1 size      0 ..
  10 drwxr-xr-x  1 size      0 setup
  11 drwxr-xr-x  1 size      0 stored
   9 drwxr-xr-x  1 size      0 calibration
RedBoot> 
fs list system
fs list system
   3 drwxr-xr-x  1 size      0 .
   1 drwxr-xr-x  1 size      0 ..
   6 drwxr-xr-x  1 size      0 apps
   7 drwxr-xr-x  1 size      0 health
RedBoot> 
fs list system/apps
fs list system/apps
   6 drwxr-xr-x  1 size      0 .
   3 drwxr-xr-x  1 size      0 ..
jffs2_read_inode() failed
Unable to stat file system/apps/clem.img

So I get the error "Unable to stat file system/apps/clem.img".
Perhaps this image is somehow corrupted?

But now I'm pretty sure that I'll be able to load image into flash via xmodem.

purpose · « **Reply #61 on:** January 09, 2018, 09:50:39 pm »

frenky · « **Reply #62 on:** January 18, 2018, 06:43:46 am »

With ExtraPuTTY I was able to load clem.img into mcu's memory:

load -m xmodem
go -c -n

But When I run "go -c -n" nothing happened so I'm a bit lost here...

Anyway I went into another path of finding all jtag intefaces...

First of ARM9 MC9328MXS mcu. I overlaid pinout from datasheet on the back of pcb to see were are jtag bga pads:

Then I measured resistance to the header on the side of pcb, to find out which signal goes where:

trst tms tdo tck tdi
e37 e36 e34 tp19 tp21

Then used jtagenum to confirm that pins are correct:

ntrst:DIG_6 tck:DIG_3 tms:DIG_5 tdo:DIG_4 tdi:DIG_2 IR length: 4

Starting scan for IDCODE...
ntrst:DIG_6 tck:DIG_3 tms:DIG_5 tdo:DIG_4 tdi:DIG_2 devices: 1
0x1092001D

And yes this is correct id according to this: https://github.com/MonsieurV/msk/blob/master/apf9328flash.cfg

# The CPU - mc9328mxl
set _CHIPNAME mc9328mxl
set _ENDIAN little

# There is only one TAP
set _CPUTAPID 0x1092001d

Terry01 · « **Reply #63 on:** February 23, 2018, 12:37:06 pm »

Frenky.

I have just been In my new 289 to check the cap, yours looks upside down compared to mine. Please don't shout at me for being a ***** IDIOT or anything like that. I may/probably be completely wrong. I am a complete beginner electronics wise to you guys so don't know much about these things. The cap looking upside down compared to mine jumped right out at me when I saw the picture of yours.

Hope this helps....

Terry01 · « **Reply #64 on:** February 23, 2018, 12:39:29 pm »

If you wait till tonight UK time I will be able to get a decent quality pic of mine and post it?

frenky · « **Reply #65 on:** February 23, 2018, 12:53:36 pm »

Yes please do take a picture.

AnJu · « **Reply #66 on:** March 04, 2018, 11:46:45 pm »

I connected my working Fluke 287 to the debug console.
But during boot I see only: +Entry point: 0x00060040, address range: 0x00060000-0x003beba0
When I send Ctrl C Fluke 287 shutdown and I see: $T02thread:00000001;0f:24930600;0d:64fc3b00;#f8
So I can't access to the RedBoot console.
Frenky, what the firmware version on your Fluke 287?

AnJu · « **Reply #67 on:** March 06, 2018, 04:35:56 pm »

I have seen, but it does not work for mine Fluke 287
I've come to the conclusion that access to the console is closed in the latest firmware 1.16
I found the old firmware version 1.1: http://www.elso.sk/media/download/sw-drv/fluke/28xUpdatePkg_V1_10.exe
But it does not allow me to make downgrade.
To bypass protection, I need to calculate (MD5?) signature in the manifest.txt or path the firmware updater Upd28X.exe

// MANIFEST SIGNATURE
!8a28a20042f8b0a4b31d041e9ccc4c18

Any ideas?

FrankE · « **Reply #68 on:** March 07, 2018, 06:04:56 am »

Quote from: purpose on November 30, 2017, 03:43:57 pm

Thank you Sir... sound advice... No air handy but just ordered some.

FFR: You can get air tins in Poundland. £1

frenky · « **Reply #69 on:** March 07, 2018, 08:14:09 am »

I do not know about firmware version, because IR is not working.
To get to console you could try sending Ctrl+C every 100ms with a script on pc or microcontroller.
That should stop loading OS and show you redboot. In my case OS load fails so I get into redboot immediately.

AnJu · « **Reply #70 on:** March 07, 2018, 10:24:30 am »

Frenky, I successfully downgraded to 1.1 version but the console works the same way.

What terminal program did you use to access redboot?

frenky · « **Reply #71 on:** March 07, 2018, 11:46:46 am »

ExtraPuTTY. http://www.extraputty.com/
So I could upload binary file with xmodem.

AnJu · « **Reply #72 on:** March 07, 2018, 01:14:20 pm »

Ok I will try connect with ExtraPuTTY.
Also please provide your working script too.

frenky · « **Reply #73 on:** March 07, 2018, 01:21:06 pm »

I do not have a script.
My fluke is faulty so on boot-up sequence it tries to load OS from ROM/Flash, but it can't find it. (Corrupted memory?)
So it stays in redboot.
But I have read, that if you send Ctrl+C early during boot it will stop booting OS and show redboot console.

AnJu · « **Reply #74 on:** March 08, 2018, 01:23:55 am »

Pinout J6 ENET1
1   GND
2   nCS4
3   nEB3
4   nOE
5   GND
6   nRW
7   RESET_IN
8   TIN
9   GND
10   A1
11   A2
12   A3
13   GND
14   D0
15   D1
16   D2
17   GND
18   D3
19   D4
20   GND

Pinout J7 ENET2
1   GND
2   D5
3   D5
4   D7
5   GND
6   D8
7   D9
8   D10
9   GND
10   D11
11   D12
12   D13
13   GND
14   D14
15   D15
16   GND
17   VCC
18   VCC
19   VCC
20   GND


EEVblog Main Site	EEVblog on Youtube	EEVblog on Twitter	EEVblog on Facebook	EEVblog on Odysee

Author Topic: Fluke 289 not quite sorted. (Read 57865 times)

Share me