Phillips PM3394 Combiscope firmware wanted. - Page 1
Forum section: electronics / repair

author: grumpydoc
author_rank: Super Contributor
timestamp: May 28, 2017, 10:47:17 am
content: So, I have EHT's CPU card from his Phillips 'scope which won't boot -Fluke PM3394 Microprocessor FaultTurns out the problem is corrupt/faulty flash ROMS, if I put the ROMs from one of my spare CPU cards into his it boots just fine. Move his ROMs into my 'scope and it doesn't.I can re-flash new ROMs for himbutI don't have the right firmware image - his originally had the extra maths package and I don't have a 3394 with that option. I have a 3394A and 3394B with extra maths but the firmware from those 'scopes won't do because a) they switched to SMD flash chips and the only way to read them would be to unsolder them - which I'd prefer not to do and b) even if I got the code it probably won't run on a 3394 CPU card because the hardware is different.Does anyone have a 3394 and the ability to dump the two 28F020 flash chips - if so would they be willing to do so and send me the images, or the ROMs themselves and I can copy them.The corrupt image is dated 1993-06-12 but I don't think that it has to be exactly that version, mine (which lack the extra maths stuff but boot) is dated 1992-04-12It would be much appreciated by EHT, I am sure

author: grumpydoc
author_rank: Super Contributor
timestamp: May 30, 2017, 02:12:18 pm
content: No one?

author: HighVoltage
author_rank: Super Contributor
timestamp: May 30, 2017, 02:55:22 pm
content: Sorry to say, I have only PM3394Bleft in my lab. All the older models are gone.

author: grumpydoc
author_rank: Super Contributor
timestamp: May 30, 2017, 03:25:02 pm
content: I thought that might be the case.Given that even the B models are now more than 20 years old we are starting to get into the territory of worrying about flash endurance, especially as the inside of the 'scoope is warm if not exactly hot. It might be a good idea to start thinking about making backups of the firmware. Sadly they changed the design significantly for the "A" switching to SMD parts and allowing for up to 4x 28F020 (the most I have mounted on a board is 2x 28F020 and 1x28F010).Thankfully I do have a copy of the basic firmware to flash so with luck EHT should be able to get the 'scope up and running.I'm beginning to think buying one of thesehttp://www.ebay.co.uk/itm/Enplas-TSOP32-TO-DIP32-A-IC-Programmer-Adapter-for-TSOP32-TSSOP32-package-/282227617550and carefully desoldering the chips might be the best long term plan.

author: HighVoltage
author_rank: Super Contributor
timestamp: May 30, 2017, 04:23:52 pm
content: One of my customers might still have an original PM3394 in use. I will have a look when I am visiting him in about a month time and if so, give him a 3394B loaner. I will keep you updated, if I am successful.

author: grumpydoc
author_rank: Super Contributor
timestamp: May 30, 2017, 09:43:28 pm
content: Quote from: HighVoltage on May 30, 2017, 04:23:52 pmVery kind, sir - definitely above & beyond. Let me know if you have any luck.

author: EHT
author_rank: Frequent Contributor
timestamp: May 30, 2017, 11:09:38 pm
content: Yes, much appreciated! Thank you both very much for your efforts.I can see keeping a backup of the flash memory for these models would be beneficial for the user community. Btw, I notice the scope I have acquired didn't have the batteries installed; perhaps the flash can get corrupted powering the scope off without the battery backup...

author: grumpydoc
author_rank: Super Contributor
timestamp: May 31, 2017, 06:12:31 am
content: Quote from: EHT on May 30, 2017, 11:09:38 pmShouldn't do - the 5V backup just preserves the RTC and SRAM for the current 'scope settings.

author: EHT
author_rank: Frequent Contributor
timestamp: May 31, 2017, 10:23:17 pm
content: I found the attached PDF doc via a search, and also looked at the svc manual (snippet attached).It describes Philips programming the scopes externally via RS232, including from empty. That would make sense especially for the models with the chips soldered in: "Embedded software and calibration data can be loaded/exchanged with dedicated PC software that is exclusively available in manufacturing and service.". Pretty rubbish that the flash fills up after saving 10 cals and needs to be reflashed by Philips! Another reason backup would be useful. If we knew how to program via RS232, then it would make a much easier process for others to backup/restore.As you say, Grumpydoc, the battery is only protecting the session state in RAM. I suggest that means the CPU could corrupt the flash if it is turned off while writing, theoretically at least (e.g. enterprise grade SSDs & RAID controllers have protection against this).

author: grumpydoc
author_rank: Super Contributor
timestamp: May 31, 2017, 10:46:20 pm
content: Quote from: EHT on May 31, 2017, 10:23:17 pmI have previously looked for the mysterious PC program but I think that it was never released outside Philips, looking at the firmware I can see that as well as the documented commands there appear to be "CF", "DW", "EM", "EO", "EX", "PF", "QC" and "QF" but what they do or what parameters they might take is anybody's guess.

author: HighVoltage
author_rank: Super Contributor
timestamp: June 01, 2017, 07:01:38 am
content: Quote from: grumpydoc on May 31, 2017, 10:46:20 pmI know a guy who has the software but is very tight about it and will not make a copy, although these instruments are now 20+ years old. He was the chosen one that continued the official service for "PM" instruments, when Philips stepped out of it. May be one of these days I will convince him to make a copy and hand me the manual.

author: CJay
author_rank: Super Contributor
timestamp: June 01, 2017, 08:01:24 am
content: Quote from: grumpydoc on May 31, 2017, 10:46:20 pmI wonder if the Phillips FTP server still exists...It used to hold all sorts of gems like alignment software for high end computer monitors that was 'restricted' to service agents

author: grumpydoc
author_rank: Super Contributor
timestamp: June 01, 2017, 08:20:35 am
content: Quote from: HighVoltage on June 01, 2017, 07:01:38 amGiven that I've been looking at the CPU card & firmware on these 'scopes again and also have been playing with a cheap USB LA (one of the 8ch 24MHz saleae clones) I find my myself motivated to look at reverse engineering the firmware once more.The 8ch LA is not really enough but it piqued my interest enough to get a better USB LA - this time a 16Ch 400Mhz DSLogic Pro (probably a clone given the price) which is plenty to start by mapping the address decode PAL.The PAL is arranged with 10 inputs A14and A15from the CPU, 4 lines from CPU port 1 labelled SELA15- SELA18, two further bits from port 1 labelled PROGENLT and TEXTENLT, the CPU INST output and EAIt generates chip selects for the RAM and two ROMs, address bits 15-17 for the ROMs (A0through A14for both the ROM & RAM come from the CPU), and some further select signals (IOCS and TXTCS).This the basic scheme would seem to be to split the 64k CPU address map into 4 16k chunks and to expand the ROM address space to 20 bits. However as the ROM & RAM chips see A0- A14direct from the CPU they are probably mapped in 32k chunks. However as "INST" is an input so RAM could be mapped at the same address as ROM, or they could use that to map I/O space over ROM.1024 input combinations was always going to be too much to map by hand but a 16ch LA would be fine to cover most of the inputs (only really need the clock and the final carry out so I know when the count rolls over to all bits 0) and 8 outputs - all I need then is a clock signal and a few 74xx191's (which I know I have in the parts bin) to generate the inputs.I'll see if I can do that this weekend (if the new LA turns up).The "A" and "B" boards are completely different - a PLS 173 is used, the address inputs go from A12to A15so potentially there is much finer grained control over the memory map (though the ROM & RAM still have to be 32k contiguous) and the outputs do not include the expanded address lines for the ROM, just various chip selects.

author: grumpydoc
author_rank: Super Contributor
timestamp: June 01, 2017, 09:56:02 am
content: Quote from: CJay on June 01, 2017, 08:01:24 amIf it was ftp.philips.com then there is an IP address but no FTP serverftp.fluke.com answers but does not allow anonymous log in.

author: EHT
author_rank: Frequent Contributor
timestamp: June 01, 2017, 11:04:06 am
content: Quote from: HighVoltage on June 01, 2017, 07:01:38 amThat is tantalizingly close. The firmware which supports this must be in the Microcontroller's ROM given that it would appear than blank Flash ROMs can be programmed. As such, it must be pretty simple. I guess there is a front-panel key combination that puts it into RS232 programming mode, then some simple terminal commands to allow upload, download and verification of the Flash ROM firmware. Rather than seeking the original software, if we could find out how to enter the programming mode and what the commands to be sent on RS232 are that would do the trick.

author: CJay
author_rank: Super Contributor
timestamp: June 01, 2017, 11:15:28 am
content: I'd be tempted to try and read the 80C196 EPROM to decipher the bootloader if it's unprotected, I don't *think* it's possible to do the 805x EA trick on the 'C196 if it's been read protected (BICBW) which is a shame.

author: grumpydoc
author_rank: Super Contributor
timestamp: June 01, 2017, 12:04:22 pm
content: Quote from: CJay on June 01, 2017, 11:15:28 amMight not be that easy without being willing to sacrifice the CPU board.I just realised that the CPU only samples EA at reset so it isn't that easy to jump in and out of the mask ROM code - it presumably sets up the memory map then toggles EA and probably then executes a RST instruction - so, at that point, there must be ROM mapped at address 2080HMy plan, once the new LA arrives was to snoop the address bus to find out where execution starts - might not need that if I know where the entry vector is and how the address mapping works.

author: grumpydoc
author_rank: Super Contributor
timestamp: June 03, 2017, 04:04:45 pm
content: OK, well, my new LA has not turned up so am annoyed about that. However managed to pull the programming from the address decode PAL in the 3394 usng the little 8ch Saleae clone and multiple captures.The memory map is notquiteas I anticipated but for anyone who might be working on these 'scopes in the future here it is for reference.Philips/Fluke PM33xx Combiscope memory map:0000H-3FFFHROM bank 0 1st 16k4000H-7FFFHNormal operation (EA=0)Data reads & writes (INST = 0)RAMInstruction fetches (INST = 1)ROM bank 0 2nd 16kMask ROM operation (EA=1)RAM8000H-BFFFHData reads & writes (INST = 0)PROGENLT=0 - ROM (1st 16k of current bank)PROGENLT=1 - RAMInstruction fetches (INST = 1)Banked ROM (1st 16k of current bank)C000H-FFFFHData reads & writes (INST = 0)PROGENLT=0 - ROM (1st 16k of current bank)TEXTENLT=0 - CURCON memory (?)Neither of above - I/OInstruction fetches (INST = 1)Banked ROM (2nd 16k of current bank)SMF does not appear to do nested tables terribly wellPort 1 bits 0-3 (SELA15-SELA18) select the bank address - SELA18 just switches between the two ROMS. The bank address is not passed through for any access in the first 32k of the processor address space.RAM physical addresses are swapped - the 16k mapped from 4000H-7FFFH is the top 16k of the RAM and the area mapped from 8000H-BFFFH is the bottom 16k of the RAM.The I/O space is further decoded by the 74LS183 D1016 which produces various write strobes and by a couple of OR gates for the UFO read strobe and OPTCSLT (wherever that goes).The raw CSV for the PAL truth table is attached in case anyone either needs to program a new part or check the above.http://www.wild-pc.co.uk/docs/3394-addr-decode-pal-csv.csvAt some point I'll look at the 3394A/B PALS.

author: grumpydoc
author_rank: Super Contributor
timestamp: June 04, 2017, 10:59:42 am
content: Quote from: CJay on June 01, 2017, 11:15:28 amThe (probably) bad news is that the chip configuration word in the ROM image sets the protection bits to prevent the on-board ROM being read or written. A bit academic since we really need to know what is coded into the CCB in the mask ROM but I'll bet it is the same value.What's the 805x EA trick?

author: CJay
author_rank: Super Contributor
timestamp: June 04, 2017, 05:00:58 pm
content: You could, on a lot of the older 805x chips, persuade the chip to copy internal ROM out from a 'protected' chip by diddling with the EA pin to between external and internal, from a quick read of the 80C196 it appears you can only alter the state at reset which would prevent that.

author: grumpydoc
author_rank: Super Contributor
timestamp: June 04, 2017, 06:12:38 pm
content: Quote from: CJay on June 04, 2017, 05:00:58 pmThat would be too easy!Anyway given that we know the memory map and it should be possible to guess at what hardware initialisation is being done so I "just" need to reverse engineer the code. Sensibly it is probably not worth it but the task has got under my skin. However I'm sure there are still a decent number of these 'scopes in the wild as a steady trickle turn up on ebay.All I need now is an 80C196 assembler & disassembler.I have an assembler - well it compiles so we'll see whether it runs OK in a while.But I can't find a decent open source disassembler - just some (rather expensive) commercial offerings. Radare2 has some support for mcs96 but it is very bare bones - it just prints the instructions without even any decoding of the operands.Mame can emulate the 80C196 but it is hardly general purpose and it doesn't have hooks to print disassembled listings. However between its CPU definition, the Radare2 header listing the instructions and the users guide there is a reasonable amount of information about the machine code.I've started to write one but I'd rather not have to do that to be honest.Anyone know of an available disassembler (needs to be open source and compilable on Linux)?

author: EHT
author_rank: Frequent Contributor
timestamp: June 06, 2017, 12:59:59 pm
content: How about this one: IDA -https://www.hex-rays.com/index.shtmlCross-platform and they have a free non-commercial version. It appears the free one supports 80196:https://www.hex-rays.com/products/ida/processors.shtmlhttps://www.hex-rays.com/products/ida/gallery/80196.shtmlGood luck!

author: grumpydoc
author_rank: Super Contributor
timestamp: June 06, 2017, 01:56:42 pm
content: Quote from: EHT on June 06, 2017, 12:59:59 pmYes, I loked there.It seems I missed the freeware but I finally spotted the link, thanks.However it looks to be a very old windows only version - I tend to prefer Linux as a development environment.I've started writing one now, coming along nicely.

author: EHT
author_rank: Frequent Contributor
timestamp: June 06, 2017, 02:16:24 pm
content: Oh. It said elsewhere that they build Linux, OSX & Windows versions.Also it says "INTEL 80196 (comes with source code)".Maybe you would need to download the code and compile it, if not at least you should have some useful code for the 80196 instructions there?

author: grumpydoc
author_rank: Super Contributor
timestamp: June 06, 2017, 02:43:35 pm
content: Quote from: EHT on June 06, 2017, 02:16:24 pmI can only find a windows exe for the freeware version. I probablywilldownload it when I get home and see if any useful info can be harvested.There is also an evaluation copy but TBH it won't be much use - it only does x86 and arm and only "structured" binaries such as ELF.I doubt that the "source code" is any more than a few extensions and/or plugins but I didn't see the claim that the 80196 version came with any - do you have the link to the page?

author: grumpydoc
author_rank: Super Contributor
timestamp: June 06, 2017, 05:19:33 pm
content: Nope - freeware version only does x86 and ARM, some bits of files for other architectures (but not 80C196) are lying around in the install but it did not offer me those processors when I asked it to disassemble the ROM image.The demo has had everything except arm/x86 stripped out.

author: grumpydoc
author_rank: Super Contributor
timestamp: June 06, 2017, 08:37:56 pm
content: Well, Hex Rays isn't going to come up with the goods without me parting with $$.Luckily the users guide has basic information about the instruction set and opcodes and mamehttp://www.mamedev.orghas an 80196 emulator which provides very good documentation by dint of reading the source code. So after only took a couple of hacking sessions I have a basic disassembler, I have almost all the instructions/addressing modes done with the sole exception of handling the FE prefix which makes mul & div operations signed.Current output is looking like this3590 fa di3591 a1 00 01 18 ld 18, #01003595 00 01 skip 013597 a1 00 5c 18 ld 18, #5c00359b a1 00 58 34 ld 34, #5800359f a1 53 53 32 ld 32, #535335a3 c2 35 32 st 32, +35a6 89 00 5c 34 cmp 34, #5c0035aa d7 f7 jne 35a335ac a1 00 5c e8 ld e8, #5c0035b0 01 ea clr ea35b2 a1 00 5c 34 ld 34, #5c0035b6 a1 41 41 32 ld 32, #414135ba c2 35 32 st 32, +35bd 89 00 60 34 cmp 34, #600035c1 d7 f7 jne 35ba35c3 b1 16 03 ldb 03, #1635c6 11 08 clrb 0835c8 11 13 clrb 1335ca 11 09 clrb 0935cc 11 12 clrb 12The above is where the code goes on reset (the reset vector just contains a jump to 3590H). It seems to be filling from 5800H to 5BFFH with the value 53H and the area from 5C00H to 5FFFH with 41H. The 1k from 5800H to 5BFFH is obviously the stack but why initialise it? The usual reason for doing so with a known pattern is to check that you did not overflow it but that's mainly of use during development, not production.If they left stack dev/debugging code in the final image perhaps they left other useful stuff - maybe even the ability to reflash the code; one can hopeI also wonder slightly whether any of this was generated by a compiler rather than being written in assembler, for instance the sequenceclrb 08clrb 13clrb 09clrb 12does not strike me as something one would write - why do the 4 individual byte clears whenclr 08clr 12would do the same thing, even if they are used as 8 bit values later?Unfortunately just deciphering the instructions does not make a terribly useful disassembler - I need to teach it how to generate and use a symbol table and how to figure out what is likely to be code and what data (by traversing what can be reached from known entry points) and how to spot strings etc. It also need it to generate something that can be used as input to the assembler. I need to come up with some test code to make sure that the output is correct and ideally get to the point where i can do binary -> disassembler -> assembler -> binary produces the same output as input. That lot should take me at least until the weekend and my currently abandoned Z80 board project deserves a bit of time as well. Looks like I'm going to be busy even without all the c**p I need to do for work.

author: grumpydoc
author_rank: Super Contributor
timestamp: June 10, 2017, 08:23:09 pm
content: Turns out one of the copies of the firmware that I have includes the maths package after all.However it does not have the GPIB support - I'm slightly surprised that this was not done with one version of the firmware just detecting what hardware was present but it does mean that it is not possible to upgrade one of these 'scopes by installing the missing GPIB hardware unless one also installs a copy of the firmware with GPIB support.

author: HighVoltage
author_rank: Super Contributor
timestamp: June 10, 2017, 10:56:59 pm
content: Interesting.So, you think they had a separate FW for each option that was added?That must have been a lot of FW versions.

author: grumpydoc
author_rank: Super Contributor
timestamp: June 11, 2017, 09:12:47 am
content: Quote from: HighVoltage on June 10, 2017, 10:56:59 pmFrom what I've seen the presence or absence of the maths package and GPIB support would lead to at least 4.Originally I thought the maths package "must" be quite large and be the reason that EHT's 'scope had the larger ROMs but, on reflection, it might be the GPIB support which, after all, needs not just the hardware drivers but also the whole SCPI interpreter as well.In the 512k ROM (GPIB + MP) about 48k is blank.In my 384k of ROM neither of which have GPIB I have 40k blank in the image without the maths package and 34k in the one with - so the extra maths stuff might only be 6k. Not implausible as it will presumably be DSP code (the DSP doesn't seem to use/have mask ROM so at present I'm assuming the main CPU copies code into the DSP program RAM at start-up).That suggests the SCPI interpreter could be just over 100k - which seems a lot, to be honest. We'll know if I ever disassemble the ROMs (however that is going to be alongterm project).I don't know how easy it was to get the service manual when these 'scopes were new but I guess Phiips would not have wanted it to be trivial to just slap the missing GPIB hardware onto the CPU board - I'll bet the cost of the option was a lot more than the parts.

author: CJay
author_rank: Super Contributor
timestamp: June 12, 2017, 09:45:47 am
content: Phillips used to try to compartmentalise their business but if you had an account you could usually get away with ordering anything you could find a part number for, most service manuals were free to Phillips account holders, you'd order it as 'first issue' and a few days later it'd turn up in the post FOC.Obtaining the part numbers for service manuals could be an art form in itself but a Viewdata account was useful as you could browse their 'catalogue' and find all sorts of wonderful things, it was also often beneficial to be able to banter with the people on the tech support lines as they'd be able to provide all sorts of 'forbidden fruit', it's how I found the I2C alignment software for monitors for instance.They were excellent at supplying parts but some things were 'modules' and you just could not get anything other than the whole, which spawned a lucrative trade in module refurbs by companies like MCES (Manchester Colour Engineering Services) who would repair TV Tuners, video heads, satellite TV LNBs etc...

author: HighVoltage
author_rank: Super Contributor
timestamp: June 12, 2017, 10:12:54 am
content: Philips was amazing in those days.When I was at the university, they had even really good engineering text books (free of charge), explaining their technology, including the basis for calculations and manufacturing. One could learn so much from those text books, because it reflected the Philips production line.Too bad they were bought by Fluke.

author: SaabFAN
author_rank: Frequent Contributor
timestamp: June 14, 2017, 01:27:49 am
content: Interestingly, for the previous scopes (PM3320-Series), the firmware did include all options but activated FFT-Functions and most likely what kind of device one was owning (PM3320, PM3320A, PM3323, PM3340) was encoded somewhere else. I haven't been able to figure out where, however. The most likely place would be one of the PAL-Chips.Btw. I constantly get the feeling the Philips T&M-Instruments were more or less an attempt to sell their in-house developed test equipment than an actual attempt at getting into the T&M-Market. And when it became cheaper to just replace than repair the market for T&M-Equipment went down enough to send that Department on the "Philips Way": Develop something, perfect it, then sell it (often enough an entire part of the company) to the highest bidder and invent the next great thing.

author: lunacyworks
author_rank: Contributor
timestamp: March 25, 2021, 04:59:02 am
content: Has anyone had any updates? This thread went dead with the finality of the matter. I ask as I will be inheriting one of these scopes this week. Was hoping to use it as a project in one of my STEM classes.It seems it would be a great concept to archive or even reserve engineer the firmware.

author: shakalnokturn
author_rank: Super Contributor
timestamp: March 25, 2021, 07:05:16 am
content: It kind of follows over here:https://www.eevblog.com/forum/repair/fluke-philips-pm3394a-combiscope-preventive-maintenance/

author: grumpydoc
author_rank: Super Contributor
timestamp: March 25, 2021, 11:04:17 am
content: The main thing from my point of view is the reverse engineering of the ROM code - but it's gone a bit back burner again.I need to tweak/beef up the handling of data symbols and tables etc, not sure how much I can do heuristically (probably not much), it's not helped by the fact that the code has alotof computed jumps so the usual heuristic of following jumps & calls from known entry points only finds a small amount of the code.I'll post the listings when I'm happy with them - but only about 75% of the way to that point at present.