FLUKE 192/ 196 / 199 FW Upgrade - Page 1
Forum section: electronics / testgear

author: Maxis
author_rank: Contributor
timestamp: November 03, 2019, 05:23:40 pm
content: Dear forum members,I have FLUKE 196 FW 1.24 (OLD). This FW has a very basic functionality, where there is neither X/Y display nor the trace mathematics present. It's totally silly since even FLUKE 97 model is fully loaded with all these functions. Since FLUKE 196 has isolated channels and I work on the advanced motor control, I badly need the X/Y display functionality.Recently I have discovered, that the last FW version (version 4.0) released by FLUKE in year 2000 does indeed include A vs B display (X/Y display) and also the trace mathematics:http://web.archive.org/web/20050209043312/http://www.fluke.com/scopemeter/firmware.asp?AGID=29&SID=210In order to use the aforementioned SW package I need to already have the version 3.0. But I do have 1.24.How to upgrade to version 3.0?1. I found in the service manual schematics, that there is the FW/HW version identification resistor:And this resistor must be changed from 0 Ohm to 17.8K in order to correctly validate the HW if FW version 3.0 and greater is installed.2. Also at the same time the signal path compensation must be updated (RC network connected connected to the PIN19 of the both channel C-ASICs).Now here is THE QUESTION:Can anyone please share with me the upgrade software package to move from the FW version 1.xx to the version 3.0?I know the odds and the dangers of turning my FLUKE 196 into a brick (pumpkin)by running the upgrade.Thank you!

author: Maxis
author_rank: Contributor
timestamp: November 04, 2019, 05:42:43 pm
content: More info:by looking inside FlashTool_V408.exe there are different files.- FlashTool.exe is the programmer- data.bin is the actual FW image- *.lng are the message files- FlashTool.ini has several encryption keys (the exact functionality to be understood)Since FlashTool refuses to flash my Fluke 196 due to the FW version mismatch there is a possibility to patch a bit the thing to let it skip this test.However, here is the potential risk:- The content of the data.bin file suggests that theactual flash image is fragmented.For example:by looking at the headers there are some different record types:LOADFILE VERSIONSOFTWARE DESCRIPTIONEXTENSION DATA <starting address in HEX>, <length in HEX>, <length in DEC> data0, data1, ...., data NDATA BLOCK <,# 6 bytes starting address in HEX>, <,# 4 bytes length in HEX>, <length in DEC + 1> data0, data1, ...., data NEXTENSION COMMAND TABLE- CF:GO00401780- EO:GO0040170C- FC:GO00401652- FP:GO004006CA- PF:GO00400C72- QF:GO00400AB2- TI:GO00400A7CNow, it seems that even the command language/syntax between the test tool and the programmer.exe can be re-defined. Actually this is very smart since there were many ROM mask versions of the boot loaders.The real risk is that when flashing 1.24 FW with 4.08 FW maybe some common modules coming from 3.0 FW are completely missing and wouldn't be updated.Have anyone already tried to dive inside this?Greetings..

author: Black Phoenix
author_rank: Super Contributor
timestamp: November 05, 2019, 12:50:53 am
content: I've been looking online and no reference of a firmware lower than the 4.08V that you currently have. Yes currently on the Fluke Page they ask you to contact support:https://www.fluke.com/en/support/software-downloads/fluke-190-series-non-b-c-modelsIt was lucky that the Wayback Machine catch a screenshot of the page plus some links as the downloadable installer. Although the installer is still present know on the Fluke servers on this link:http://assets.fluke.com/download/scopemeter/FlashTool_V408.exeMy thought is since it was an upgrade that needed to have some components swapped on the PCB plus a calibration, there aren't any file to be downloaded since it was never provided to the end user. I even tried to search on xDevs.com, a website from a member here called TiN but I can't access the Docs part of the website, it always return a nginx error.With other kinds of equipment normally the latest firmware contains the previous code released in older firmwares, say for example you have a equipment that have a 1.1V firmware, a 1.5V and a 2.1V. Normally you don't need to go 1.1V then 1.5V and 2.1V. You can update directly to the 2.1V and both 1.1V and 1.5V code are present in. In this case since they explicitly say that you can't update directly is because or the code is not present, or is related with the PCB component changes needed and the calibration. I can't tell you for sure, It's up to you if you want to take the risk, change the components and try to flash it, and or you get a functional up to date equipment (needing calibration, mind it) or a door stopper.

author: Maxis
author_rank: Contributor
timestamp: November 05, 2019, 08:54:03 am
content: Hello,Right, I had the same thoughts about the integrity of 4.08 upgrade. I've opened up the FlashTool_408.exe, extracted data.bin and checked the continuity of the image. There are chunks of data 4096 bytes each. But there are also some chunks which are shorter than 4096 bytes but still starting at the 0x1000 boundary, suggesting that the FW image isn't continuous, but rather fragmented.I've also checked the WEB to see if someone already dumped the FLASH of the scopemeter, but found NOP.It's possible to link the partitions together and run the check on the code. BTW, extracted one code section, thrown into the cross platform disassm and just discovered, that the code is Motorola 68K instruction setHow interesting.... So, the FLUKE D-ASIC has Motorola 68K inside, not ColdFire core but real 68000. Also I remember, that Philips co-developed their Magnavox CD-I chipset together with Motorola, around mid 90s. So, that was also a 68000 with some fast DMA, LCD controller etc built in.It would be awesome if someone could help me in getting the FLASH DUMP for version 3.0 and greater. This way it's possible to check the integrity of the upgrade image (see if all the parts are present).One more thing coming from the DATA.BIN scan - unfortunately there is no exception table or anything like that in the provided image suggesting that the vital part of it is sitting in the D-ASIC on-chip mask ROM. Likely mask ROM has all the initialization and exception processing table which after some tests is relocated to the SRAM.One more option would be to unsolder the FLASH, back it up and only then start fiddling with the FLASHTOOL loader. There are no other IC apart from FLASH ROMwhere the information can be stored.BTW, does anyone have a FLASH dump of their 192/196 or 199 without a letter?Thank you

author: Maxis
author_rank: Contributor
timestamp: November 06, 2019, 10:56:42 am
content: More information:The built in CPU is indeed the bare bone 68000! No instruction set extensions common for 010-060 are identified.The flash ROM starts at the physical address 0x680000in the D-ASIC address space.The first 512K are empty (at least in rev 4.00 and 4.08). The actual code content starts at 0x700000

author: Maxis
author_rank: Contributor
timestamp: November 08, 2019, 11:26:47 am
content: Here are more updates:The partition which is loaded into the instrument RAM at the address 0x40000 is the Programmer Client. It has all the facilities to download from the HOST, erase and program the built-in FLASH memory. Its dynamic run-time code is combined from EXTENSION DATA sections in data.bin file at the start of the flashtool. The code to be flashed (the actual content of the FLASH ROM at the end of the DFU exercise), however, is usually limited to 4KBytes chunks and has a different header -> DATA BLOCK.The EXTENSION COMMAND TABLE supplies the entry points inside Programmer Client sitting in the scopemeter RAM during the instrument update. It's interesting to find that not only Intel and Mitsubishi, but also AMD flash chips (not mentioned in the Service Manual) are supported.These are the entry points:- CF:GO00401780- EO:GO0040170C- FC:GO00401652- FP:GO004006CA- PF:GO00400C72- QF:GO00400AB2- TI:GO00400A7CGO is the directive followed by 32 bit addressThese entry point functions are yet unknown. At some point they are all called as functions in the single function one after another, which is a bit perplexing. Could this correspond to the DFU order of things? If so, then the "command master" is not the HOST, but the scopemeter itself requesting commanding the host.The code is well structured, but not hand written in assembly.It uses the mask ROM of the D-ASIC extensively (likely for optical interface COMM, LCD output etc) but entry points are to be analyzed.Here is a little fragment of the sector erase as it resides inside the Programmer Client00401C4C ; --------------------------------------------------------------------------------------00401C4C ; D4 holds the Flash IC type: 1 - Intel 28F160, 2 - AMD 29LV160, 3 - Mitsubishi, 4 - Intel00401C4C BlkEraseFLASH: ; CODE XREF: sub_0_401A94+8E00401C4C lea $5E(a5),a100401C50 move.w #$FF,d300401C54 cmpi.b #2,d400401C58 bne.s BlkErase_CHK100401C5A00401C5A BlkEraseI28F160:00401C5A moveq #-2,d100401C5C move.l d6,d000401C5E add.l d5,d000401C60 and.l d0,d100401C62 move.l d1,(a1)00401C64 movea.l (a1),a400401C66 move.w d3,(a4)00401C68 movea.l (a1),a400401C6A move.w d3,(a4)00401C6C movea.l (a1),a400401C6E move.w #$50,(a4) ; Clear status register00401C72 movea.l (a1),a400401C74 move.w #$20,(a4) ; Erase setup00401C78 movea.l (a1),a400401C7A move.w #$D0,(a4) ; Erase confirm00401C7E lea $6A(a5),a200401C8200401C82 loc_0_401C82: ; CODE XREF: sub_0_401A94+1F8j00401C82 movea.l (a1),a400401C84 move.b 1(a4),(a2)00401C88 btst #7,(a2)00401C8C beq.s loc_0_401C82 ; Erase not finished00401C8E movea.l (a1),a400401C90 move.w d3,(a4)00401C92 movea.l (a1),a400401C94 move.w d3,(a4)00401C96 move.b (a2),d200401C98 btst #3,d200401C9C bne.s loc_0_401CB4 ; VPP range error00401C9E btst #6,d200401CA2 bne.s loc_0_401CB400401CA4 btst #5,d200401CA8 bne.s loc_0_401CB4 ; Block erase error00401CAA clr.l d100401CAC move.b d2,d100401CAE btst #4,d100401CB2 beq.s loc_0_401CB800401CB400401CB4 loc_0_401CB4: ; CODE XREF: sub_0_401A94+20800401CB4 ; sub_0_401A94+20E ...00401CB4 moveq #1,d100401CB6 bra.s loc_0_401CBA ; Return error code D1=100401CB8 ; --------------------------------------------------------------------------------------00401CB800401CB8 loc_0_401CB8: ; CODE XREF: sub_0_401A94+21E00401CB8 clr.l d1 ; Erased successfully D1=000401CBA00401CBA loc_0_401CBA: ; CODE XREF: sub_0_401A94+22200401CBA move.l d1,d000401CBC bra.w loc_0_401BE2 ; Transfer the error code to D000401CC0 ; --------------------------------------------------------------------------------------00401CC000401CC0 BlkErase_CHK1: ; CODE XREF: sub_0_401A94+1C400401CC0 move.l #-$10000,d200401CC6 cmpi.b #3,d400401CCA bne.s BlkErase_CHK200401CCC00401CCC BlkErase29LV160:00401CCC moveq #-2,d1

author: memeruiz
author_rank: Contributor
timestamp: February 10, 2020, 04:13:53 am
content: I also have a 196 v1.24 fluke scope in case you are into upgrading the flash also.Maybe I can help. I recently saw in fluke webpage a mention of GPL for some version of this scope. I wonder if the firmware on ours are some embedded linux build.

author: clod22
author_rank: Newbie
timestamp: March 03, 2020, 09:27:39 am
content: Hi all,Please helpppp, I bot an old fluke 199 fromEbay, but unfortunately the flash rom is missing from main board, the question is i have any possibilities to find somewhere a new chip with original software, thank .

author: asis
author_rank: Frequent Contributor
timestamp: May 04, 2020, 09:18:15 am
content: Hi,MaxisJudging by your descriptions, you came closest to the truth.About a year ago, I was able to reverse engineer the A201 Fluke199c module (V08.04) and read using LabTool-48UXP its contents without solder the Flash SST39LF800 chips.A dump of a functioning appliance.Now I see at what addresses and in which chips the serial number of the device is located, which is very important when checking the ASIC mask.If you are still interested, let me know.Vladimir.

author: crazy
author_rank: Newbie
timestamp: May 05, 2020, 07:10:32 pm
content: HiI wander if someone has ca fluke 190 memory dump ?And share all the schematic ?Thank you.

author: asis
author_rank: Frequent Contributor
timestamp: May 13, 2020, 09:36:40 am
content: Hi,I do not yet have a dump on devices of older versions of Fluke 192,196,199 (without the letter B, C).There the MS TE28F160B3xxxxx 16MB Flash or M5M29FB160AVP-80 is installed and, probably, dump substitution is hardly possible.There OTP ROM D-ASIC checks the serial number of your device, which is located on the back of your device.Look at the algorithm and try to use the rollback procedure.Not the fact that the devices purchased at the auction are not rearranged from one case to another.Keep that in mind.Vladimir.

author: mojoe
author_rank: Frequent Contributor
timestamp: May 14, 2020, 09:46:10 am
content: My understanding is that the early Scopemeters with 1.xx firmware won't take the later firmware. It would be nice if you prove this incorrect.

author: lostking2008
author_rank: Contributor
timestamp: August 13, 2020, 02:06:39 pm
content: Hi There, I need a memory module for Fluke 199C, but it has been discontinued by Fluke back in 2017. Unfortunately, the service manual doesn't come with the circuit drawing of the Flash/SRAM module (80 contacts in two rows, 0.8mm pitch) itself. Does anyone happen to have a schematic drawing of the memory module?Thanks,Ken

author: vishaldotgupta
author_rank: Regular Contributor
timestamp: October 31, 2021, 04:51:58 pm
content: hican anyone share flash file bin / hex file for Fluke 199c

author: asis
author_rank: Frequent Contributor
timestamp: November 01, 2021, 07:22:06 am
content: https://www.eevblog.com/forum/repair/fluke-199c-scopemeter-repair/25/

author: harrimansat
author_rank: Regular Contributor
timestamp: February 27, 2022, 09:19:36 pm
content: FLUKE 199 (not C) dump

author: smaultre
author_rank: Regular Contributor
timestamp: June 18, 2022, 07:02:55 am
content: Anybody have a FlashTool_F190BC_V702.exe ??

author: msquared
author_rank: Regular Contributor
timestamp: June 18, 2022, 02:22:43 pm
content: If you're just trying to upgrade a scope I think 7.06 was the last version released.Hopefully this will work for you.

author: smaultre
author_rank: Regular Contributor
timestamp: June 19, 2022, 01:36:17 pm
content: ha-ha its not worked too, upgrade the 6.15 to 7.xx . Who know the way?

author: memeruiz
author_rank: Contributor
timestamp: October 03, 2022, 05:55:14 am
content: These guys are offering the complete service. This _apparently_ is possible.https://www.ebay.com/itm/234220465665Not cheap, though

author: coromonadalix
author_rank: Super Contributor
timestamp: October 03, 2022, 02:43:15 pm
content: Must be themhttp://scopemeterrepair.com/

author: Victor jose teixeira
author_rank: Newbie
timestamp: April 29, 2023, 06:49:06 pm
content: Good afternoon,I have several FLUKE devices, multimeters and oscilloscopes.I recently bought a FLUKE 199 on Ebay in excellent condition and with calibrations, it already had firmware version V04.08 (last), the multimeter measurement works. But the functions OSCILLOSCOPE channel A and B do not measure, the lines of channels A and B do not appear.I've tried several configurations and nothing, the tips are fine, the problem is really in the oscilloscope. Someone can help me? Any idea what the problem is?

author: Victor jose teixeira
author_rank: Newbie
timestamp: April 29, 2023, 07:00:18 pm
content: Quote from: Victor jose teixeira on April 29, 2023, 06:49:06 pm

author: eb4fbz
author_rank: Regular Contributor
timestamp: December 09, 2023, 07:09:09 pm
content: Quote from: Maxis on November 06, 2019, 10:56:42 amAre you sure? Fluke Spider D-ASIC (HS353063) is supposed to use an ARM 720 core.

author: smaultre
author_rank: Regular Contributor
timestamp: December 10, 2023, 07:04:20 am
content: Looks like bad input asic (or problems with it powering) You can try the pre-calibration diagnostic procedure.