Products > Test Equipment
Fluke/Tektronix Bushealth Code: 192C/196C/199C/215C/225C/190 (I & II) THS3000
(1/8) > >>
patpat:
FlukeBushealth v1.0 2024

 Provided the Scope SN it creates the Bushealth Code
 It works on Fluke and Tektronix* Scopes with bushealth capable firmware
  Fluke 192C/196C/199C/215C/225C
  Fluke 190 - 062/102/104/202/204/502/504 (Series I & II)
  Tektronix THS3014/3024

 Reaching the Bushealth Install screen:
  Fluke: USER -> VERSION & CAL -> F1
  Tektronix: TBD*


Usage:
        FlukeBushealth -s SerialNumber

        Examples:
        FlukeBushealth -s DM9010124


Options:
-h, --help     Get help
-s, --Serial   Scopemeter Serial


Tektronix uses the same firmware than 190-XXX II and includes bushealth support but at the moment I couldn't find
how to trigger the "Install Bushealth Option" screen




VirusTotal again gives positives,
https://www.virustotal.com/gui/file/c715fce191c28dc591854ebf0ec94f0f14ce8349f69e217ec8a177640f40f713
but this just came out from my Microsoft VS

I tested on my 199C USA w/ firmware 8.04 and it worked w/o issues,
if it does not work for you just let me know model, firmware and serial.
Pat
 
squadchannel:
hi pat.
I hope it works on THS, but I can't find the hidden menu.

I was messing around with commands from serial yesterday and found some data dumped by the qc command.
It outputs an undocumented command list.

qc mean "quality control"? hmm... :-//


--- Code: ---Universal Host Mask software; UHM V3.0��0123456789ABCDEF����BaudregRead     : BR<cr>
BaudregWrite    : BW<dddd><cr>
EXtension cmd   : EX<exnr>,<...>
Fill Mem Byte   : FM<hexAddr>','<hexLen>','<bb><cr>
Fill Mem Long   : FL<hexAddr>','<hexLen>','<llllllll><cr>
Fill Mem Word   : FW<hexAddr>','<hexLen>','<wwww><cr>
Call program    : GO<hexAddr><cr>
Get Binary Byte : GB<hexAddr>','<hexLen><cr>
Get Binary Long : GL<hexAddr>','<hexLen><cr>
Get Binary Word : GW<hexAddr>','<hexLen><cr>
IDentity        : ID<cr>
Put Binary Byte : PB<hexAddr>','<hexLen><cr><B...B><cr>
Put Binary Long : PL<hexAddr>','<hexLen><cr><LLLL...LLLL><cr>
Put Binary Word : PW<hexAddr>','<hexLen><cr><WW...WW><cr>
Reset Instrument: RI<cr>
Read hex Byte   : RB<hexAddr>','<hexLen><cr>
Read hex Long   : RL<hexAddr>','<hexLen><cr>
Read hex Word   : RW<hexAddr>','<hexLen><cr>
Write hex Byte  : WB<hexAddr>','<hexLen>','<bb...bb><cr>
Write hex Long  : WL<hexAddr>','<hexLen>','<llllllll...llllllll><cr>
Write hex Word  : WW<hexAddr>','<hexLen>','<wwww...wwww><cr>
��HOI (c) Rob van de Schepop

--- End code ---

The dumped data is attached.

I also tried to see if I could read the contents of the flash that should have been assigned to $4000 0000 using the RB command, and sure enough, there was data, but not the data I expected.
It seems to be different from the contents of the flash. I am not too familiar with CL-PS7111 or arm.

MOD:
overflowing.



enter GO40000000 on UHM, boot from flash. No doubt $4000 0000 would be flash.
patpat:
Hi squadchannel,

FlukeBushealth v1.0 has been tested on my Fluke 199C USA and it worked as intended.

Looking at the firmware I inferred it should also work on the Fluke 190 and Tektronix THS3000 lines.

As you see Tektronix serials are longer numbers and  FlukeBushealth 1.0 as-is has a sign issue in this case.
I need to see the code a bit more to fix this but first I want to reach Tektronix Bushealth install screen (if possible) but I'm also stuck not finding the way.

Regarding serial communication, the codes you found seem they might run in Mask Mode?
I tried in regular mode the RB (Read Byte ) command on my THS3024 and it always return error 1.
I booted my THS3024 in Mask Mode (Power-on the unit holding the up and right arrows and hearing a soft beep)
but then I couldn't establish the serial connection with the scope, are you able to communicate in Mask Mode with your THS3024?


Regarding Fluke options alternatively I found the sequence of Serial commands that would enable the following 3 features
* Medical 
* Bushealth          
* Medical + Bushealth

The command sequence is contained in the file cpl.bin within the firmware updater with Bushealth enabled, once decrypted with FlukeFlashTool2txt 
https://www.eevblog.com/forum/microcontrollers/fluke-19xbcii-tektronix-ths30143024-flashtool-ini-cpl-bin-deobfuscator
it gives


--- Code: ---EM
MAINTENANCE
CI 12,0
CI 13,confix
CI 14,0
CI 17,110195
CI 18,y
CI 320,N
RC
EO
--- End code ---

The line:

CI 17,110195   => Enables Bushealth
but also
CI 17,271267   => Enables Medical 
CI 17,161027   => Enables Medical + Bushealth

Note: It is good to mention that enabling the Medical "software" features on a unit will not improve
any electrical feature like CAT Safety Ratings, AFAIK the medical units have higher CAT ratings.

CI (Configure Instrument?) is a multi function command, the first number is the function number, followed by a single parameter.
The number 17 deals with the scope software options.
So far I do not know the rest of commands.

This data comes just from looking at the code, I haven't tried myself, sure the CI 17,xxx command might need one or more commands in the sequence to work,
I know the code is identical in Tektronix then it could potentially work with the THS3024.

Best
Pat
mahi:
Just tested on a 2009 Fluke 196C with firmware 8.04 and it worked great! The Bushealth feature is now available under the Recorder menu.

Thank you!
squadchannel:
hi patpat.

can communicate with THS in mask mode by pressing the up button, right button and power button as in fluke, listening for a weak beep, and entering many “X ” at the terminal.

trying the commands for several hours.
What we know so far is,


--- Code: ---EM = Engeneering Mode
FLUKEUHM = reboot UHM (after EM command)
MAINTENANCE = entry calibration mode (after EM command)
CI = change instruments? rewrite the value of the QI command.
RC = rewrite calibration?
EO = ? calibraion menu closes.? engeneering mode closes?

--- End code ---

CI commands can be used after the EM and MAINTENANCE commands have been executed.
RC command is supposed to override the calibration, and EO closes the calibration menu.

after entering the EM and MAINTENANCE commands (while entry the calibration menu), the QC command seems to output the calibration data inside flash. but, there is a slight difference compare flash data.

CI 17,110195 command, does not change on the THS.
although I can indeed see the number change at QI 17.


THS3024:
CI/QI 10 is model name
CI/QI 11 is serial number
CI/QI 12 is serial number(same #11)
CI/QI 13 is board serial number
CI/QI 14 is CI and QI command not allowed.
CI/QI 17 ?
CI/QI 18 ?
CI/QI 320 ?

these commands only work UHM mode.

--- Quote ---Universal Host Mask software; UHM V3.0��0123456789ABCDEF����BaudregRead     : BR<cr>
BaudregWrite    : BW<dddd><cr>
EXtension cmd   : EX<exnr>,<...>
Fill Mem Byte   : FM<hexAddr>','<hexLen>','<bb><cr>
Fill Mem Long   : FL<hexAddr>','<hexLen>','<llllllll><cr>
Fill Mem Word   : FW<hexAddr>','<hexLen>','<wwww><cr>
Call program    : GO<hexAddr><cr>
Get Binary Byte : GB<hexAddr>','<hexLen><cr>
Get Binary Long : GL<hexAddr>','<hexLen><cr>
Get Binary Word : GW<hexAddr>','<hexLen><cr>
IDentity        : ID<cr>
Put Binary Byte : PB<hexAddr>','<hexLen><cr><B...B><cr>
Put Binary Long : PL<hexAddr>','<hexLen><cr><LLLL...LLLL><cr>
Put Binary Word : PW<hexAddr>','<hexLen><cr><WW...WW><cr>
Reset Instrument: RI<cr>
Read hex Byte   : RB<hexAddr>','<hexLen><cr>
Read hex Long   : RL<hexAddr>','<hexLen><cr>
Read hex Word   : RW<hexAddr>','<hexLen><cr>
Write hex Byte  : WB<hexAddr>','<hexLen>','<bb...bb><cr>
Write hex Long  : WL<hexAddr>','<hexLen>','<llllllll...llllllll><cr>
Write hex Word  : WW<hexAddr>','<hexLen>','<wwww...wwww><cr>
��HOI (c) Rob van de Schepop

--- End quote ---

RB commands, for example
RB40000000,100
reads 100 bytes from $4000 0000.
Navigation
Message Index
Next page
There was an error while thanking
Thanking...

Go to full version
Powered by SMFPacks Advanced Attachments Uploader Mod