Dim OLED Screen replacement for Agilent Keysight U1253A U1253B U1273A U1273AX

[onesystem]

Yes my meter is dead at the moment. After loading firmware it turned off and did not turn back on. To load its proper firmware i have to power on the meter. So I need to work it out, hopefully I did not kill it completely! Maybe I need to flash the chip direcly with unreversed byted firmware (since it "unreverses it" while loading into meter). But I still have to work that out - i.e. what equipment to buy for that and how to load it onto the chip.

[DavidAlfa]

What did you do to? How did you manage to brick it?
Even if the screen doesn't come out, it might be going into failsafe / update mode - try connecting it to the computer and running the updater!

In the worst case, yes, the reversed firmware should restore it.
Here's something: https://github.com/mnh-jansson/78k0-flash-utility/

[onesystem]

Do you think I can accomplish it with this?:

https://www.ebay.com/itm/151229761950?chn=ps&norover=1&mkrid=711-117182-37290-0&mkscid=101&itemid=151229761950&targetid=1493511181865&device=c&mktype=pla&googleloc=9014964&poi=&campaignid=19851828444&mkgroupid=145880009014&rlsatarget=pla-1493511181865&abcId=9307249&merchantid=8561194

I have never done work with MCUs birectly before, this is going to be my first time!

[onesystem]

And here is another page with what seems to be some good information.

Can I use it?:

http://elm-chan.org/works/sp78k/report_e.html

[DavidAlfa]

You're not answering any of my questions!

I can't help unless you said what you did. Did you force-loaded the 1253A/B firmware into the 1273AX?


Must be 78K0, AFAIK 78K0S is completely different.

I was checking the bootloader to see if there was any failsafe mode.
This is what it does:

Code: [Select]

sub_060e:                                       ; From reset vector and basic init
    di                      ;060e  7b 1e   
    push hl                 ;0610  b7     
    mov a,#0x00             ;0611  a1 00   
    mov !mem_e2a7,a         ;0613  9e a7 e2
    mov BANK,#0x05          ;0616  13 f3 05     ; Set flash bank 5
    movw ax,!0xbffc         ;0619  02 fc bf     ; Get data at flash address 0x1FFFC
    cmpw ax,#0xfafa         ;061c  ea fa fa     ; If not 0xFAFA
    bnz lab_062c            ;061f  bd 0b        ; Enter updade mode
    mov BANK,#0x00          ;0621  13 f3 00
    call !sub_040c          ;0624  9a 0c 04
    call !sub_7f00          ;0627  9a 00 7f     ; Otherwise continue booting (Call app)
    br lab_063d             ;062a  fa 11        ; Return from app, enter updade mode

So there isn't any failsafe procedure in the bootloader itself!
Agilent wasn't very nice here, all the firmwares have 0xFAFA there, should have used different values/addresses or additional checks to prevent such stupid bricking.
Their thinking probably was "As the entire flash is erased before updating, if the last bytes are ok, the rest will be too".

[onesystem]

Sorry!

What I did is using the regular firmware uploader v3.01, uploaded the file "U1253B_V304_1123a.AG" after renaming it to the "U1273AX_V301.AG". Loading progress went all the way to the end, and meter went dead during the reboot which loader automatically forces it to go through at the end of loading of the firmware.

I tried to take out batteries and then placing them back in, pressing various buttons at different lengths of time, turning the lever to various positions. All while loader is connected via optical cable - no response from meter or the loader - it does not see  the meter, meaning that one is not turning on and not communicating via it's optical interface.

[DavidAlfa]

* U1273 and 1253 are completely uncompatible, don't try cross-flashing! *

[onesystem]

I know! It was totally my fault - I had a wild idea that all I will test is screen formatting and then I will load proper firmware back. I learned the hard way! Now I will have to load the right firmware using some kind of progammer which I still have to find and then connect to that chip hopefully without needing to remove it from board.

[DavidAlfa]

I think there's still some hope! We only need to mess those 0xFAFA bytes to force it into update mode.

As I posted earlier, this tool should be able to do it:
https://github.com/mnh-jansson/78k0-flash-utility/

The serial connection is already there, you only need to follow the procedure stated in the programming manual to boot into flash mode:
- Power off.
- FLMD0 conected to VDD.
- Power on
- Wait at least ~5ms.
- Flash mode enabled.

Install python 3 (It's in the Microsoft store, or here), then install pyserial by opening a command prompt and typing:

Code: [Select]

pip install pyserial

Download flash-util.py.

Flash blocks are arranged in 1KB sectors, so last sector is 127, this is the one to erase. (Adjust COM port as required)

Code: [Select]

python flash-util.py -e -b 127 -p COM3

I sniffed the serial port output, this is what it sent, so it seems to work properly!

Code: [Select]

00 00                               <-- ?? I guess to flush any data? Not specified in the prog. manual?
01 01 00 FF 03                      <-- Reset
01 07 22 01 FC 00 01 FF FF DB 03    <-- Erase block from 0x01FC00 to 0x01FFFF

If everything goes well, this will force the bootloader into update mode!

[onesystem]

Okay!

I am not sure how to get this meter to respond at all though - to do any adjustments on that chip I have to communicate to it somehow...

I found this application note from Renesas about building a programmer for this chip:
https://www.renesas.com/us/en/document/apn/78k0kx2-flash-memory-programming-programmer
Worst case scenario I can always build my own programmer for it.

[onesystem]

Powershell output:
===================================================
PS C:\gits\78k0-flash-utility\flash-util> python flash-util.py -e -b 127 -p COM4
specified block:  127
setting port to:  COM4
NEC Programmer v1.0
written by Martin Jansson


Requesting serial port and resetting chip...
Response:  Processing in progress (BUSY)

Erasing block 127 ...

Sending erase block command..
Response:  Processing in progress (BUSY)
error: Did not receive ACK, returning...
===================================================

So I must be doing someething wrong...

How exactly do I accomplish this?:

"

The serial connection is already there, you only need to follow the procedure stated in the programming manual to boot into flash mode:
- Power off.
- RST=GND, FLMD0=GND.
- Power on, wait at least 1ms.
- FLMD0=VDD, wait at least 2ms.
- RST=VDD
- Flash mode enabled.

All I did is toggle meter handle from off to on position and that was all. Maybe I need to do something on the circuit board itself?

[onesystem]

Interesting!
When meter is off the output of powershell is different! So there is some kind of communication happening...
===============================================
PS C:\gits\78k0-flash-utility\flash-util> python flash-util.py -e -b 127 -p COM4
specified block:  127
setting port to:  COM4
NEC Programmer v1.0
written by Martin Jansson


Requesting serial port and resetting chip...
error: Length less than 2

Erasing block 127 ...

Sending erase block command..
error: Length less than 2
error: Did not receive ACK, returning...
===============================================

[DavidAlfa]

You almost said "I did nothing of that, but it's not working, did I made something wrong?"  .
Well, everything, you're not putting the mcu into flash mode so how is it going to work?

meaning that one is not turning on and not communicating via it's optical interface.

Ah, forgot about the isolation, then it might not work at all?
Maybe 9600bps is too fast for the optical interface, or the mcu has to enable it?
You might need to directly interface the RX/TX pins in the mcu.

But for sure it won't magically work by simply powering it on, the flash mode enabling procedure must be followed.

[onesystem]

Ok. I will solder in wires to the legs of the chip, put meter back together and perform the booting into flash mode sequence. The way this meter is built, I cannot power it on with case opened.
I will post pics of the process in case anyone finds it useful.

And in terms of optical comm - if it will not work with that, I will use direct comm with the chip.

[DavidAlfa]

Check JP2, seems like a programming header? Is it connected to pins 10 (RST), 13 (FLMD0), 50 (RxD6) and 51 (TxD6) ?

[onesystem]

JP2 pinout:
(top to bottom)

1. pin   50    P14/RxD6

2. pin   51    P13/TxD6

3. pins   18    EVSS,
            60    AVSS

4. pins   16    REGC,
            19    VDD,
            20    EVDD

5. pin   10    RESET (via 1K resistor)

6. pin   13    FLMD0

Can these be used or should I solder?

[DavidAlfa]

Ah! There's a second UART in 50 (TxD6) and 51(RxD6).
In fact, that's the one used, check the manual pages 732 and 733.
The mcu reads any incoming pulses in FLMD0 after entering flash mode to set the comunication mode, 0 pulses sets UART6.

So you have easy access after all .

1. RX (To cable TX)
2. TX (To cable RX)
3. GND
4. VDD
5. RESET
6. FLMD0

[onesystem]

So to make sure I do it right:

1. Connect Rx and TX to PC using a USB to UART

2. Make sure meter is off, then short RESET and FLMD0 to ground for a moment, disconnect, then

2. Turn on meter

3. Short FLMD0 to VDD, then disconnect

4. Connect RESET to VDD, keep connected

5. Run the 78k0-flash-utility

[DavidAlfa]

Measure reset and FLMD0 voltages after powering the meter.
Likely, reset=VDD and fldm0=gnd.

1. Connect Rx and TX to the adapter, but don't connect it to the PC yet (Might cause voltage going to the mcu, powering it up).

2. Make sure meter is off. Short FLMD0 to VDD, better through a 100R-1K resistor (Just in case).

3. Turn on meter. Optional: Connect RESET to gnd for a fraction of a second to force a reset, leave unconnected. Shouldn't be necessary as the mcu has just been powered up.

4. Connect to PC.

5. Run the 78k0-flash-utility

[onesystem]

Back alive!!!!
Once I erased the block, screen started showid "D...." without an hour glass when I turned meter back on again. It took several tries with uploader - kept telling me meter has to be powered off and on again, and then finally it started loading firmware. Meter is now working without problems again!

Thank you DavidAlfa!!!

[DavidAlfa]

Great job! Now we have the proof that the meter is unbrickable! 

I guess we could make a fail-safe mode too!
If there's any bug in the modded firmware crashing the firmware, read a button at power-on before the main app starts executing, and start the update mode.
But for that, button mapping must be done!
Which buttons are directly connected to the mcu?
What is their idle and switched levels?

[voltsandjolts]

Nice. Perhaps someone could attach the 78k0-flash-utility here, to ensure future availability?

[DavidAlfa]

IMHO relying in the forum storage is the least reliable way, but attached anyways  .

[onesystem]

Great job! Now we have the proof that the meter is unbrickable! 

I guess we could make a fail-safe mode too!
If there's any bug in the modded firmware crashing the firmware, read a button at power-on before the main app starts executing, and start the update mode.
But for that, button mapping must be done!
Which buttons are directly connected to the mcu?
What is their idle and switched levels?

Pin 30 button [Dual/Exit] and [Setup] and all of the buttons to the right of them
Pin 31 all of the buttons to the left of [Dual/Exit] and [Setup] not including the [Dual/Exit] and [Setup]
Pin 34 (connected via Diode), buttons [Null/Scale] and [brightness/Setup]
Pin 35 (connected via Diode), buttons [MaxMin/Peak] and [Hz % ms/Log]
Pin 36 (connected via Diode), buttons [Trig/Auto Hold] and [Range/Auto]
Pin 37 (connected via Diode), buttons [Dual/Exit] and [Esc Shift/View]

Switched/unswitched levels are difficult to measure without soldering wires to the thing..

[msquared]

Unfortunately the modded flash appears to have bricked my U1253A. I haven't upgraded the display yet so I don't know if anything is being on the displayed but...

Before flashing the meter beeped when powered On and the update software reported "Link".

After flashing the meter no longer beeps when powered On and the updated software can no longer find the meter, reporting "No Link".

The update ran to completion with no problems reported during flashing so I don't suspect any issues with the flashing procedure.

The meter was running 1.20 of the official firmware before attempting to flash with the modded firmware.

I briefly read that there is a method to "unbrick" a meter I need to go back and read the details of that procedure I may give it a try I just wanted to report that at least for the U1253A there might be some issues.

Please let me know if there is any more information I can provide to help the creators troubleshoot the potential problem.