| Electronics > Repair |
| [Solved!]Looking for firmware dump for Tek THS3024.(How to repair firmware) |
| << < (8/8) |
| patpat:
Awesome job. To understand the memory map of these scopes I found useful the "Instrument Security Procedures" documentation from https://www.fluke.com/en-us/support/instrument-security I'm uploading here the ones for models: Fluke 192B, 196B, 199B, 192C, 196C, 199C, 215C, 225C & Fluke 190-062, 190-102, 190-104, 190-202,190-204, 190-502, 190-504 (Series II) These documents also say things like: --- Quote ---Fluke 192B, 196B, 199B, 192C, 196C, 199C, 215C, 225C Security Summary: The operating code (instrument firmware) stored in D101-D102 on the A201 module can be read using special remote interface commands. The instrument firmware can be loaded using a dedicated Fluke software program. Calibration constants stored in D101-D102 on the A201 module can be read using special remote interface commands. The calibration constants are generated when the meter is sent through its calibration process and are fundamental to the test tool operation. Fluke 190-062, 190-102, 190-104, 190-202,190-204, 190-502, 190-504 (Series II Memory Cleaning Instructions: The operating code (instrument firmware) stored in D5000, D5002 can be read with dedicated remote interface commands (only available for use by Product Development). The instrument firmware can be loaded selectively with firmware downloads that are distributed through the Fluke website. Fluke Service Centers can load firmware and configure the instrument with Service tools. Caution: The upgrade tool will erase all saved screens and instruments setups. Calibration constants stored in D5000, D5002 can be read with special remote interface commands (only available for use by Fluke Product Development or Fluke Service Centers). The calibration constants are generated when the test tool is sent through its calibration process and are fundamental to the test tool operation. --- End quote --- Off course these commands are still undocumented but looking at the Fluke/Tektronix 190-204 Firmware Upgrade it could be one of: --- Quote ---AS - AUTO SETUP - AS<cr> AT - ARM TRIGGER - AT<cr> BA ---> BATTERY?? CI CL CM - CLEAR MEMORY - CM<cr> CV - CPL VERSION QUERY - CV<cr> DS - DEFAULT SETUP - DS<cr> EM EO EX FM GD - GET DOWN - GD<cr> GL - GO TO LOCAL - GL<cr> GR - GO TO REMOTE - GL<cr> ID - IDENTIFICATION - ID<cr> IS - INSTRUMENT STATUS - IS<cr> PC - PROGRAM COMMUNICATIONS - PC <baudrate> <cr> PS - PROGRAM SETUP - PS [<saved_setup_no>]<cr> QC ---> QUERY CALIBRATION?? QF ---> QUERY FLASH?? QI QM - QUERY MEASUREMENT - QM<cr> QP - QUERY PRINT - QP[ <screen_number>,<output_format>[,<block_transfer>]]<cr> QS - QUERY SETUP - QS [<setup_no>]<cr> QW- QUERY WAVEFORM - QW <trace_no>[,V|S] <cr> RB ---> READ BATTERY?? RC ---> READ CALIBRATION?? RD - READ DATE - RD<cr> RI - RESET INSTRUMENT - RI<cr> RS - RECALL SETUP - RS <setup_reg><cr> RT - READ TIME - RT<cr> RW SO - SWITCH ON - SO<cr> SS - SAVE SETUP - SS <setup_reg><cr> ST - STATUS QUERY - ST<cr> TA - TRIGGER ACQUISITION - TA<cr> VE WB WC ---> WRITE CALIBRATION?? WD - WRITE DATE - WD <date><cr> WT - WRITE TIME - WT <time><cr> WW RN HO - HOLD - HO<cr> CD DT RP - REPLAY - RP<cr> IM CN PW CC ---> COPY CALIBRATION?? KY PV QV IP IV --- End quote --- Best, Pat |
| feedback.loop:
--- Quote from: squadchannel on June 14, 2024, 04:43:38 pm ---... We call them Upper/Lower with the BNC input on top. Both can be dumped using the TL866 and an adapter. ... For correct recognition, there is a checksum at the end of each block. The checksum values must be matched correctly. There are two types of checksums, The result of adding the bytes from $0000 to $1FF7 (in the binary range of the block) goes into $1FF8, The result of XORing the bytes from $0000 to $1FFB (in the binary range of the block) (including the result of the addition) is placed in $1FFC. --- End quote --- Thank you very much, squadchannel! This helped me to fix a Fluke 190-202 scopemeter. You call the chips upper and lower, which may be a bit misleading. I would call them according to low (least significant) and high (most significant) 16 bits of the 32-bit data bus. The upper in your terminology holds the low 2 bytes. How do you know about the checksums and XORs? I would love to understand how that should be done correctly. Even better would be to get Fluke flash utility, so we wouldn't have to desolder the chips. |
| fzabkar:
--- Quote from: feedback.loop on November 27, 2024, 11:56:15 pm ---How do you know about the checksums and XORs? I would love to understand how that should be done correctly. --- End quote --- Actually, I was the one who uncovered the checksum algorithms. Firstly, I noticed that there were several blocks of code which were damaged in such a way that they could be reconstructed by merging two halves. I had already written a tool for this purpose. Next I noticed that each block had a lonely byte at the end, and this led me to suspect that these were checksum bytes. I then ran my CHECKSUM.EXE tool against these blocks. This tool tests a block of data using several checksum algorithms. It found a simple 8-bit sum plus an 8-bit XOR. You should find these tools attached to one or more of my posts. If you have any blocks of code or data with an unknown checksum, I'll see if I can help you locate it. It would probably be best to start your own thread, though. |
| squadchannel:
Yes, thanks to fzabkar. :-+ currently coding a utility tool for Scopemeter. It will take some time yet. :phew: |
| asis:
Hi, [/quote] You call the chips upper and lower, which may be a bit misleading. I would call them according to low (least significant) and high (most significant) 16 bits of the 32-bit data bus. The upper in your terminology holds the low 2 bytes. [/quote] @feedback.loop The error was made in document 190BC___mveng0000. I offer my representation of the A201 module circuit. - The circuit is very similar to the THS3024. |
| Navigation |
| Message Index |
| Previous page |