Old Philips Fluke 97 / 96B (maybe others?)

[stj]

are you using 4 individual battery's?
the meter wont charge those, the proper packs have an extra contact so the meter knows they are re-chargeable.

btw, bad news.
i found my scopemeter & the yellow outer case broke up like it was sponge cake!!
looks like the "rubber" used has a limited life! 

[joeqsmith]

The one scope on the left had the better display of the two.  The one on the right had such poor contrast it was near impossible to read.  Polarizer was shot.  Rather than try to strip it, I bought a filter that I cut to fit after finding the highest contrast.  The EL power supply on both scopes was not working.  After repairs, this scope on the rights EL was very weak.  I finally got around to picking up one of those cheap white ELs.  It was pretty much a perfect fit after trimming back the connector with the X-acto and soldering some fine wire to it with some tape. 

Links to the lens and EL I used are below.   

https://www.amazon.com/dp/B009P8B548/ref=cm_cr_ryp_prd_ttl_sol_10

https://www.amazon.com/gp/product/B00IMXE2G0/ref=oh_aui_detailpage_o01_s00?ie=UTF8&psc=1

[joeqsmith]

I've been playing around attempting to remove some scratches on a few of my meters.   The new EL came in for the better of the two Fluke 97s and while it was apart decided to work on the lens a bit.

Scratches on this were deep to the point you could snag your finger nail in the groves.  I started with 1000 grit and then finished with some 1500.  This was with water.   Then used the PlastX to polish it.   Installed the new EL.  Looks much better. 

[Scottjd]

Wow, are you sure your didn't replace it? 😏
Usually I don't care for those so called plastic restorers, but I've been trusting meguiars wax for almost all my life on my cars. I didn't know they made a plastic restorer polish.
I have a scratch in my fluke 289, you want to have a go at it if your bored, lol.
As it stands my Fluke 96B has a better screen currently, I don't know hiw I did it. But it's just one deep long scratch. Probably used it on a car for something before I bought a smaller cheaper meter.
Scott

[joeqsmith]

I had no idea about that PlastX polish as well.  Just walked around the auto parts store and found it.  This is the forth meter I have used it on now.  Check out the before and after of that Fluke 189 I am playing with.  It takes some effort but I can't argue with the results.   I am also using an iPad screen protector that I am cutting down to size to protect the lenses.  I will do the same to this scope.  That stuff also gets my vote. Easy to work with, sticks and comes off without residue.  The LENS6 has the protective film installed. 

Down side is for deep scratches afraid it is sand paper time.  Even 1000 grit took a while to pull some of the bad scratches in the 97.  It would have gone better to go from 1000 to 1500 to 2000 before starting to polish.   I just wet sanded this one in the sink. 

Too bad you can't get new plastic and rubber replacement parts for these scopes. 

[joeqsmith]

The second scope is back together.  Picture showing with the protective cover.  There are two small dents in the upper right corner that I decided not to go after.  Fuzzy dot below them is not real.   

Not too bad for a couple of garage kept meters. 

[Scottjd]

The second scope is back together.  Picture showing with the protective cover.  There are two small dents in the upper right corner that I decided not to go after.  Fuzzy dot below them is not real.   

Not too bad for a couple of garage kept meters.

Both looking good.

[transistor12]

Yes , limited life of the body case. Mine too..

[lyonsk]

I have one that is slightly different than what was posted here already.
It is branded on the front as Fluke 97 Scopemeter / Philips on the back. Serial number DM547XXX.

The main difference between modes is in the flash memories. According to fluke website (if the link does not work go to manuals -> search for: 97):
https://dam-assets.fluke.com/s3fs-public/93_95_97mveng0000.pdf?_ga=2.14758966.1275149489.1535696131-345369494.1535440239

Document says:

Model:
Fluke 93, 95, 97, 97/AUTO
Product Name:
ScopeMeter Series I Test Tool
Instrument Description:
The Fluke ScopeMeter Series I test tools provide an up to 50 MHz handheld
oscilloscope combined with a 3½ digit DMM.

Memory Description for instruments with software versions below
V5.xx:
The Fluke 9x has the following memory devices:
1. D1207 (N28F256-A200, 256 kB or N28F010-200P1C4, 1 MB) and D1208
(N28F512-200P1C4) flash EEPROM for instrument firmware and calibration
constants.
2. D1204 (HM62256, 32kx8 SRAM) and D1206 (HM62256, 32kx8 SRAM) for
saved test tool settings (Fluke 97 and 97/AUTO), saved screens and
waveforms (Fluke 97 and 97/AUTO), LCD bit plane data and measurement
data.

Memory Description for instruments with software versions V5.xx and
higher:
The Fluke 9x has the following memory devices:
1. D1221 (E28F010-120, 1 MB) flash EEPROM for instrument firmware and
calibration constants.
2. D1232 (M5M5256BRV, 32kx8 SRAM) for saved test tool settings (Fluke 97
and 97/AUTO), saved screens and waveforms (Fluke 97 and 97/AUTO).
3. D1218 (M5M5256BRV, 32kx8 SRAM) for LCD bit plane data and
measurement data.


It looks like those with memories N28F* are older and those with E28F* are newer. According to the pictures posted in this thread and over the web also series II uses E28F* memories.

I see that Joeqsmith has one unit with single N28F* memory and the other with single E28F*.
https://www.eevblog.com/forum/testgear/old-philips-fluke-97/msg1063314/#msg1063314

My unit has two N28F* flash chips: 512kB + 256kB


Why I'm doing this brain exercise you say? This is the interesting part from the Fluke document I already mentioned abowe:

Memory Cleaning Instructions for instruments with software versions
below V5.xx:
1. The operating code (instrument firmware) stored in D1207 and D1208 can be
read using special remote interface commands. The instrument firmware can
be loaded using a dedicated Fluke software program. Calibration constants stored in in D1207 and D1208 can be read using
special remote interface commands. The calibration constants are generated
when the meter is sent through its calibration process and are fundamental to
the test tool operation.

These scopmeters can hold just 3 calibrations (one of them is probably done already in factory) and then memory is full and you need to bring it to Fluke where they will blank the memories by reuploading firmware. Maintenance manual excerpt attached.

There is also interesting part that mentions Kernel restore procedure - see attachment.

User's manual also mentions that firmware from V4 up adds new functions which I dont have in my unit. For example: Duty cycle, timestamps during min/max recording, 30ohm range...

My questions are:
1.) Is there anyone out there having the firmware for one of these?  (preferably from unit with two N28F* flash chips)

2.) Anyone did some hacking using serial cable to get something out? Firmware or calibration data? Any hidden instructions to be send to the scope?

If nothing then I hope that at least this post can serve as the starting point for someone more skilled then me.

Regards,
Tomas

[lyonsk]

Probably no.

According to this post sending command "ID" should get the firmware version. I myself don't have the cable yet but I have ordered the parts already.
https://www.eevblog.com/forum/testgear/philips-pm93/msg967424/#msg967424

I know only how to check how many calibration slots left... you've got to enter calibration mode and then press Escape not to store anything... (attached instructions).

For me it is 2 free slots so my unit was probably never calibrated after it left the factory. Meter mode is mostly on the lower limit of tolerance when comparing to my BM 869S. I don't have anything acurate enough to check the scope performance.

[lyonsk]

I read almost the whole Service manual and it mentions the way how to display firmware version without serial cable.

It was hidden under the Error messages and the cause of the firmware version "error" message is:
Turn the Scopemeter on and then press first and last softkey at the same time (the buttons in the first row under the display)

Mine is V3.15 from year 91. Serial number of my unit is DM54 XXXX.

Anyone wants to share his version?

[lamello]

Mine is V4.05 93-05-24


Verstuurd vanaf mijn SM-T800 met Tapatalk

[lyonsk]

Hi Lamello,

What are the first two digits of your serial number? DM??XXXX

I'm just trying to figure out if the new fimware with version above 4.0 was ever installed in my hardware version.

Thanks!

[stj]

is anybody intending to dump the flash's to create a repository somewhere??

[lyonsk]

Well, in the end I would like to update my unit to the latest 4.X version firmware and also have the posibility to do more then 2 remaining calibrations (which also requires the re-flashing of firmware).

I don't see a way to make it happen at the moment. Perhaps desoldering the flash memories and backing them up would be a good start. Then someone much smarter then me would need to analyse the content and come up with the secret Fluke commands to download the FW via serial cable. If we have the commands, someone with a good will and the new unit could download the FW and share...

Anyone with the programmer, soldering station and a steady hand willing to risk it? 

[lamello]

Sorry, there is no serial on the device.

I think it's a philips machine and it was not working when i got it.

The previous owner(s) had done some modifications to the device.

Greetings lamello

Verstuurd vanaf mijn SM-T800 met Tapatalk

[stj]

if you get several dumps with the same version then we could diff them to find out where the cal data is stored.
that leads to the possibility of upgrading the firmware and keeping the old cal data.

[lyonsk]

Another piece of infomation found:

Microprocessor in (my) Fluke 97 is Intel 83C196KB. According to the service manual it has onboard ROM containing boot loader and everything needed for serial communication and the main Firmware upload/download.

That narrows down the options to these two:

1.) desolder external Flash ROMs, make backup via programmer, put them back preferably using the sockets -> now we have the option to start over with the same firmware and the current remaining number of calibrations

2.) desolder the microprocessor and dump the internal ROM via custom built jig, then reverse-engineer boot loader to get the secret serial commands for upload/download of the main Firmware -> now we have the option that anyone with serial cable can upload/download the main Firmware and hopefully share it with us less fortunate with the old FW versions and also get the chance to do more then 2 calibrations


This is what the Intel's users guide says about the ROM dump:

For the 83C196KB,
the ROM Dump Mode is entered by placing EA at a
TTL high, holding ALE low and holding INST and
RD high on the rising edge of RESET. The device first
verifies the security key. If the security keys do not
match, the device puts itself into an endless loop of
internal execution. If the keys match, the device dumps
internal locations 2000H-3FFFH to external locations
4000H – 5FFFH

My guess is that the ROM is read protected and the custom jig must be bulit with the memory attached on the mentioned addresses and the jig must have the capability to automatically restart microprocessor so the brute-force attack can be made.

Option two is obviously better but is far beyound what I can do with my equipment and especially my spare time.

[stj]

or if the bootloader does not hash-check the main flash, you insert a routine into the main code to dump the address-space to the uart.
even if it does, it may be a safety, rather than security thing with some simple check like CRC32 with the result at the end of the flash.

[harrimansat]

Yes, I have two 97, one with old hardware, and other with new version

I have one that is slightly different than what was posted here already.
It is branded on the front as Fluke 97 Scopemeter / Philips on the back. Serial number DM547XXX.

The main difference between modes is in the flash memories. According to fluke website (if the link does not work go to manuals -> search for: 97):
https://dam-assets.fluke.com/s3fs-public/93_95_97mveng0000.pdf?_ga=2.14758966.1275149489.1535696131-345369494.1535440239

Document says:

Model:
Fluke 93, 95, 97, 97/AUTO
Product Name:
ScopeMeter Series I Test Tool
Instrument Description:
The Fluke ScopeMeter Series I test tools provide an up to 50 MHz handheld
oscilloscope combined with a 3½ digit DMM.

Memory Description for instruments with software versions below
V5.xx:
The Fluke 9x has the following memory devices:
1. D1207 (N28F256-A200, 256 kB or N28F010-200P1C4, 1 MB) and D1208
(N28F512-200P1C4) flash EEPROM for instrument firmware and calibration
constants.
2. D1204 (HM62256, 32kx8 SRAM) and D1206 (HM62256, 32kx8 SRAM) for
saved test tool settings (Fluke 97 and 97/AUTO), saved screens and
waveforms (Fluke 97 and 97/AUTO), LCD bit plane data and measurement
data.

Memory Description for instruments with software versions V5.xx and
higher:
The Fluke 9x has the following memory devices:
1. D1221 (E28F010-120, 1 MB) flash EEPROM for instrument firmware and
calibration constants.
2. D1232 (M5M5256BRV, 32kx8 SRAM) for saved test tool settings (Fluke 97
and 97/AUTO), saved screens and waveforms (Fluke 97 and 97/AUTO).
3. D1218 (M5M5256BRV, 32kx8 SRAM) for LCD bit plane data and
measurement data.


It looks like those with memories N28F* are older and those with E28F* are newer. According to the pictures posted in this thread and over the web also series II uses E28F* memories.

I see that Joeqsmith has one unit with single N28F* memory and the other with single E28F*.
https://www.eevblog.com/forum/testgear/old-philips-fluke-97/msg1063314/#msg1063314

My unit has two N28F* flash chips: 512kB + 256kB


Why I'm doing this brain exercise you say? This is the interesting part from the Fluke document I already mentioned abowe:

Memory Cleaning Instructions for instruments with software versions
below V5.xx:
1. The operating code (instrument firmware) stored in D1207 and D1208 can be
read using special remote interface commands. The instrument firmware can
be loaded using a dedicated Fluke software program. Calibration constants stored in in D1207 and D1208 can be read using
special remote interface commands. The calibration constants are generated
when the meter is sent through its calibration process and are fundamental to
the test tool operation.

These scopmeters can hold just 3 calibrations (one of them is probably done already in factory) and then memory is full and you need to bring it to Fluke where they will blank the memories by reuploading firmware. Maintenance manual excerpt attached.

There is also interesting part that mentions Kernel restore procedure - see attachment.

User's manual also mentions that firmware from V4 up adds new functions which I dont have in my unit. For example: Duty cycle, timestamps during min/max recording, 30ohm range...

My questions are:
1.) Is there anyone out there having the firmware for one of these?  (preferably from unit with two N28F* flash chips)

2.) Anyone did some hacking using serial cable to get something out? Firmware or calibration data? Any hidden instructions to be send to the scope?

If nothing then I hope that at least this post can serve as the starting point for someone more skilled then me.

Regards,
Tomas

[harrimansat]

https://www.tek.com/sso-calibration-services/fluke/97

Calibrate your instrument with Tektronix Multi-Brand Calibration Services

Tektronix offers accredited calibration services for more than 140,000 instruments from 9,000 manufacturers. Tektronix calibration labs are ISO/IEC 17025 accredited and offer NIST tracable certificates. (17025 calibration capability is determined at the time of quotation.)

We support calibration for this instrument: FLUKE - 97: SCOPEMETER; 2 CH; MM < 6.5 DIGIT; < 600 MHZ

[harrimansat]

ESTABLISHING COMMUNICATION.

10. After the seventeenth time of grounding TP217, the ScopeMeter sends an <XON> via the
RS-232 interface. Now communication is established, it is possible to reprogram the
FlashROMs. For special software contact your nearest Fluke/Philips Service Center.

1 1 . Ground testpoint TP21 6 one more time to abort the Kernel Test.

[harrimansat]

It seems that MET/CAL has some routines to calibrate this scope:


https://assets.fluke.com/metcalproc/html/fluke_93_95_97_cal_rs232_5520_sc600.html#Fluke 97 ScopeMeter: CAL ADJ RS-232 /5520+SC600

[Hairystuff]

Hi, I was wondering if anyone has a backup of the flash memory chip for the fluke/philips PM93, I'm pretty sure the data on the chip has gotten corrupted, I can include a dump of the flash chip (n28f101-200) if that is of any use.

[PA0PBZ]

The first part of your dump is empty (0000-7FFF), so that could be your problem.