Some research...
Fluke 287/289 are using RedBoot/eCos:
eCos and RedBoot based products showcase
Industrial and Automotive
Fluke 289 and 287 True-RMS Multimeters. Fluke's "The Most Advanced Multimeters, Ever", data logging & graphing multimeters.
https://lists.ecoscentric.com/ecos/examples.shtmlSo I have been reading alot about RedBoot and found this:
Accessing RedBoot
After all connections have been made, start the serial terminal application and apply power to the board. Press Ctrl+C several times on the serial terminal until you see the RedBoot> prompt. If the kernel begins to boot, reset the board and try again (the standard timeout before booting the kernel is one second). On most versions of RedBoot, you will see either a '+' or a message from RedBoot before it boots the kernel, but some configurations have this disabled.
http://wiki.emacinc.com/wiki/Loading_Images_with_RedBootSo the reason that I could not write to console is that I was trying to do it after the kernel has already booted.
So I'll try sending in Ctrl+C every half a second and then power up the Fluke 287. Hopefully I'll be able to access console this way...
9V TO PADS, IN AC V MODE, ALL READINGS RELATIVE TO NEG PAD.
TP
1 0.005
2 3.11
3 4.99
4 3.11
5 3.09
6 3.09
7 0.00
8 9.00
9 2.30
10 0.00
11 0.158
12 0.00
13 3.06
14 0.00
15 2.94
16 2.909
17 3.11
18 1.82
19 2.94
20 2.94
21 2.94
22 2.94
23 2.94
28 0.00
30 0.00
31 0.00
32 3.11
33 3.11
34 0.22
Off state showed only residual and dropping V readings.
Your pic answers.
tp3 4.99
x1 0.00
x2 0.903
x3 2.941
x4 0.910
x5 1.820
More to follow.
Tants
61 17.55
58 1.245
56 2.493
59 20.03
62 18.79
60 8.99
57 9.00
53 8.69
51 9.00
44 4.98
32 2.50
26 2.50
20 4.98
89 8.99
80 1.82
68 1.82
79 2.94
67 2.94
68 1.82
41 2.50
42 3.11
35 3.11
Peter
Wow thank you. You are the best!
I'm sure that many (including me of course) will find your effort realy helpful while trying to fix faulty Fluke 287/289.
You're welcome Frenky.
Does Tadaaaa mean you've fixed her?
You're welcome Frenky.
Does Tadaaaa mean you've fixed her?
No sadly not. But it is a progress. Next I'll try to load a data image from firmware update into flash memory.
Sent from my SM-N9005 using Tapatalk
Tnx.
I'm digging trough debug console...
RedBoot> fconfig -l
Run script at boot: false
Use BOOTP for network configuration: false
Gateway IP address: 0.0.0.0
Local IP address: 192.168.9.133
Local IP address mask: 255.255.0.0
Default server IP address: 192.168.100.100
Console baud rate: 115200
DNS server IP address: 0.0.0.0
Set eth0 network hardware address [MAC]: true
eth0 network hardware address [MAC]: 0x00:0x80:0x40:0x00:0x22:0x85
GDB connection port: 9000
Force console for special debug messages: false
Network debug at boot time: false
RedBoot>fis list
Name FLASH addr Mem addr Length Entry point
RedBoot 0x10000000 0x10000000 0x00040000 0x00000000
fs 0x10040000 0x00000000 0x007A0000 0xFFFFFFFF
FIS directory 0x107E0000 0x107E0000 0x0001F000 0x00000000
RedBoot config 0x107FF000 0x107FF000 0x00001000 0x00000000
RedBoot>fs info
Filesystems available:
devfs
jffs2
Devices available:
/dev/flash/
RedBoot>fs list
fs: No filesystems mounted
RedBoot> fs mount -d /dev/flash/ -t jffs2 /hmm1
fs mount: mount(/dev/flash/,/hmm1,jffs2) failed 2
RedBoot> fs mount -d /dev/flash/ -t devfs /hmm1
RedBoot> fs info
Filesystems available:
devfs
jffs2
Devices available:
/dev/flash/
Mounted filesystems:
Device Filesystem Mounted on
/dev/flash/ devfs /hmm1
RedBoot> fs list
fs list: no such directory /
So I dumped contents of "RedBoot config" and got this out:
d -b 0x107FF000 -l 0x00001000
107FF000: 00 10 00 00 CE FA AD 0B 01 0C 01 00 62 6F 6F 74 |............boot|
107FF010: 5F 73 63 72 69 70 74 00 00 00 00 00 04 11 01 0C |_script.........|
107FF020: 62 6F 6F 74 5F 73 63 72 69 70 74 5F 64 61 74 61 |boot_script_data|
107FF030: 00 62 6F 6F 74 5F 73 63 72 69 70 74 00 66 69 73 |.boot_script.fis|
107FF040: 20 75 6E 6C 6F 63 6B 20 66 73 0A 66 73 20 6D 6F | unlock fs.fs mo|
107FF050: 75 6E 74 20 2D 64 20 2F 64 65 76 2F 66 6C 61 73 |unt -d /dev/flas|
107FF060: 68 2F 66 69 73 2F 66 73 20 2D 74 20 6A 66 66 73 |h/fis/fs -t jffs|
107FF070: 32 20 2F 0A 6C 6F 61 64 20 2D 6D 20 66 69 6C 65 |2 /.load -m file|
107FF080: 20 2F 73 79 73 74 65 6D 2F 61 70 70 73 2F 63 6C | /system/apps/cl|
107FF090: 65 6D 2E 69 6D 67 0A 66 73 20 75 6D 6F 75 6E 74 |em.img.fs umount|
107FF0A0: 20 2F 0A 67 6F 20 2D 63 20 2D 6E 0A 0A 00 00 00 | /.go -c -n.....|
107FF0B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
107FF0C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
107FF0D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
107FF0E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
107FF0F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
107FF100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
107FF110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
107FF120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
107FF130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
107FF140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
107FF150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
107FF160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
107FF170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
107FF180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
107FF190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
107FF1A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
107FF1B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
107FF1C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
107FF1D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
107FF1E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
107FF1F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
107FF200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
107FF210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
107FF220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
107FF230: 00 00 00 00 00 00 00 00 00 00 00 00 00 02 14 01 |................|
107FF240: 0C 62 6F 6F 74 5F 73 63 72 69 70 74 5F 74 69 6D |.boot_script_tim|
107FF250: 65 6F 75 74 00 62 6F 6F 74 5F 73 63 72 69 70 74 |eout.boot_script|
107FF260: 00 01 00 00 00 01 06 01 00 62 6F 6F 74 70 00 00 |.........bootp..|
107FF270: 00 00 00 05 14 00 06 62 6F 6F 74 70 5F 6D 79 5F |.......bootp_my_|
107FF280: 67 61 74 65 77 61 79 5F 69 70 00 62 6F 6F 74 70 |gateway_ip.bootp|
107FF290: 00 00 00 00 00 05 0C 00 06 62 6F 6F 74 70 5F 6D |.........bootp_m|
107FF2A0: 79 5F 69 70 00 62 6F 6F 74 70 00 C0 A8 09 85 05 |y_ip.bootp......|
107FF2B0: 11 00 06 62 6F 6F 74 70 5F 6D 79 5F 69 70 5F 6D |...bootp_my_ip_m|
107FF2C0: 61 73 6B 00 62 6F 6F 74 70 00 FF FF 00 00 05 10 |ask.bootp.......|
107FF2D0: 01 00 62 6F 6F 74 70 5F 73 65 72 76 65 72 5F 69 |..bootp_server_i|
107FF2E0: 70 00 C0 A8 64 64 02 12 01 00 63 6F 6E 73 6F 6C |p...dd....consol|
107FF2F0: 65 5F 62 61 75 64 5F 72 61 74 65 00 00 C2 01 00 |e_baud_rate.....|
107FF300: 05 07 01 00 64 6E 73 5F 69 70 00 00 00 00 00 01 |....dns_ip......|
107FF310: 09 01 00 65 74 68 30 5F 65 73 61 00 01 00 00 00 |...eth0_esa.....|
107FF320: 06 0E 01 09 65 74 68 30 5F 65 73 61 5F 64 61 74 |....eth0_esa_dat|
107FF330: 61 00 65 74 68 30 5F 65 73 61 00 00 80 40 00 22 |a.eth0_esa...@."|
107FF340: 85 00 00 02 09 01 00 67 64 62 5F 70 6F 72 74 00 |.......gdb_port.|
107FF350: 28 23 00 00 01 13 01 00 69 6E 66 6F 5F 63 6F 6E |(#......info_con|
107FF360: 73 6F 6C 65 5F 66 6F 72 63 65 00 01 00 00 00 02 |sole_force......|
107FF370: 14 01 13 69 6E 66 6F 5F 63 6F 6E 73 6F 6C 65 5F |...info_console_|
107FF380: 6E 75 6D 62 65 72 00 69 6E 66 6F 5F 63 6F 6E 73 |number.info_cons|
107FF390: 6F 6C 65 5F 66 6F 72 63 65 00 00 00 00 00 01 0A |ole_force.......|
107FF3A0: 01 00 6E 65 74 5F 64 65 62 75 67 00 00 00 00 00 |..net_debug.....|
107FF3B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
107FF3C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
Made it readable and run found commands manually:
fis unlock fs
fs mount -d /dev/flash/fis/fs -t jffs2 /
load -m file /system/apps/clem.img
fs umount /
go -c -n
RedBoot>
fis unlock fs.fs
fis unlock fs.fs
No image 'fs.fs' found
RedBoot>
fis unlock fs
fis unlock fs
RedBoot>
fs mount -d /dev/flash/fis/fs -t jffs2 /
fs mount -d /dev/flash/fis/fs -t jffs2 /
RedBoot>
load -m file /system/apps/clem.img.fs
load -m file /system/apps/clem.img.fs
fs: Open failed, error 2
Can't load '/system/apps/clem.img.fs': error 0
RedBoot>
fs list
fs list
1 drwxr-xr-x 1 size 0 .
1 drwxr-xr-x 1 size 0 ..
4 drwxr-xr-x 1 size 0 tmp
5 drwxr-xr-x 1 size 0 user
3 drwxr-xr-x 1 size 0 system
2 drwxr-xr-x 1 size 0 checkpoint
RedBoot>
fs list tmp
fs list tmp
4 drwxr-xr-x 1 size 0 .
1 drwxr-xr-x 1 size 0 ..
RedBoot>
fs list user
fs list user
5 drwxr-xr-x 1 size 0 .
1 drwxr-xr-x 1 size 0 ..
10 drwxr-xr-x 1 size 0 setup
11 drwxr-xr-x 1 size 0 stored
9 drwxr-xr-x 1 size 0 calibration
RedBoot>
fs list system
fs list system
3 drwxr-xr-x 1 size 0 .
1 drwxr-xr-x 1 size 0 ..
6 drwxr-xr-x 1 size 0 apps
7 drwxr-xr-x 1 size 0 health
RedBoot>
fs list system/apps
fs list system/apps
6 drwxr-xr-x 1 size 0 .
3 drwxr-xr-x 1 size 0 ..
jffs2_read_inode() failed
Unable to stat file system/apps/clem.img
So I get the error "Unable to stat file system/apps/clem.img".
Perhaps this image is somehow corrupted?
But now I'm pretty sure that I'll be able to load image into flash via xmodem.
With ExtraPuTTY I was able to load clem.img into mcu's memory:
load -m xmodem
go -c -n
But When I run "go -c -n" nothing happened so I'm a bit lost here...
Anyway I went into another path of finding all jtag intefaces...
First of ARM9 MC9328MXS mcu. I overlaid pinout from datasheet on the back of pcb to see were are jtag bga pads:
Then I measured resistance to the header on the side of pcb, to find out which signal goes where:
trst tms tdo tck tdi
e37 e36 e34 tp19 tp21
Then used jtagenum to confirm that pins are correct:
ntrst:DIG_6 tck:DIG_3 tms:DIG_5 tdo:DIG_4 tdi:DIG_2 IR length: 4
Starting scan for IDCODE...
ntrst:DIG_6 tck:DIG_3 tms:DIG_5 tdo:DIG_4 tdi:DIG_2 devices: 1
0x1092001D
And yes this is correct id according to this:
https://github.com/MonsieurV/msk/blob/master/apf9328flash.cfg# The CPU - mc9328mxl
set _CHIPNAME mc9328mxl
set _ENDIAN little
# There is only one TAP
set _CPUTAPID 0x1092001d
Frenky.
I have just been In my new 289 to check the cap, yours looks upside down compared to mine. Please don't shout at me for being a ***** IDIOT or anything like that. I may/probably be completely wrong. I am a complete beginner electronics wise to you guys so don't know much about these things. The cap looking upside down compared to mine jumped right out at me when I saw the picture of yours.
Hope this helps....
If you wait till tonight UK time I will be able to get a decent quality pic of mine and post it?
Yes please do take a picture.
I connected my working Fluke 287 to the debug console.
But during boot I see only:
+Entry point: 0x00060040, address range: 0x00060000-0x003beba0When I send Ctrl C Fluke 287 shutdown and I see:
$T02thread:00000001;0f:24930600;0d:64fc3b00;#f8So I can't access to the RedBoot console.
Frenky, what the firmware version on your Fluke 287?
I have seen, but it does not work for mine Fluke 287
I've come to the conclusion that access to the console is closed in the latest firmware 1.16
I found the old firmware version 1.1:
http://www.elso.sk/media/download/sw-drv/fluke/28xUpdatePkg_V1_10.exeBut it does not allow me to make downgrade.
To bypass protection, I need to calculate (MD5?) signature in the
manifest.txt or path the firmware updater
Upd28X.exe// MANIFEST SIGNATURE
!8a28a20042f8b0a4b31d041e9ccc4c18Any ideas?
Thank you Sir... sound advice... No air handy but just ordered some.
FFR: You can get air tins in Poundland. £1
I do not know about firmware version, because IR is not working.
To get to console you could try sending Ctrl+C every 100ms with a script on pc or microcontroller.
That should stop loading OS and show you redboot. In my case OS load fails so I get into redboot immediately.
Frenky, I successfully downgraded to 1.1 version but the console works the same way.
What terminal program did you use to access redboot?
Ok I will try connect with ExtraPuTTY.
Also please provide your working script too.
I do not have a script.
My fluke is faulty so on boot-up sequence it tries to load OS from ROM/Flash, but it can't find it. (Corrupted memory?)
So it stays in redboot.
But I have read, that if you send Ctrl+C early during boot it will stop booting OS and show redboot console.
Pinout J6 ENET1
1 GND
2 nCS4
3 nEB3
4 nOE
5 GND
6 nRW
7 RESET_IN
8 TIN
9 GND
10 A1
11 A2
12 A3
13 GND
14 D0
15 D1
16 D2
17 GND
18 D3
19 D4
20 GND
Pinout J7 ENET2
1 GND
2 D5
3 D5
4 D7
5 GND
6 D8
7 D9
8 D10
9 GND
10 D11
11 D12
12 D13
13 GND
14 D14
15 D15
16 GND
17 VCC
18 VCC
19 VCC
20 GND