Fluke / Philips PM3394A Combiscope preventive maintenance - Page 1
Forum section: electronics / repair

author: shakalnokturn
author_rank: Super Contributor
timestamp: July 17, 2020, 11:24:37 am
content: I recently got a bargain on a PM3394A Combiscope that I expect to be holding onto for some time and use as an excuse to thin the herd a little.The graticule illumination is dead I'll see how I can fit some LED's there, the memory backup battery is going to get some form of Lithium replacement as I hate the mess batteries and their holders finish in these days.Are there any common problems that I should look into such as recapping, checking heatsinks and others while it is open?I'm mostly bothered about things that could cause cascade failures leading to PCB damage or destroyed ASICs.I read somewhere that these scopes had software issues (bugs?) what is the latest/most stable software around?What are the main differences other than esthetics between the 3394 / 3394A / 3394B models?What's available as software/hardware options?

author: srb1954
author_rank: Super Contributor
timestamp: July 24, 2020, 07:48:45 am
content: I have PM3394 and have had very little trouble with it in the 25 yrs I have owned it. It is a very nice scope and is still the main scope I use for day-to-day fault-finding work. It is only on rare occasions that the PM3394 can't handle the job and I have to pull out one of my big Tektronix 7000 scopes for the more tricky scope measurements.The S/W seems generally solid. The only aspect of the S/W that I don't like is the velocity acceleration on the rotary controls. This starts out very slow and accelerates very, very rapidly making it difficult to quickly and smoothly adjust the settings.After 25 years use the only H/W failures I have seen are:1. Erratic operation on one of the front panel push-buttons. Probably needs cleaning or replacement of the carbon button on the keyboard diaphragm.2. Failure of the probe sense contact ring on one of the original scope probese. This is due to a spring in the probe retention collar losing pressure. The scope itself is fine.I wouldn't bother upgrading the batteries; just check them periodically. I am still on the original set of batteries after 25 yrs. There is no sign of leakage and they still read more than 1.5V.Options listed in the catalog are:1. IEEE488 (GPIB) interface in place of the RS-232 interface.2. Extended memory3. Math Plus S/W (includes FFT and other mathematical operations4. Aux ouput and external trigger.All options were factory fitted and were not retrofittable. However, if you are prepared to do some soldering/desoldering on the processor and interface boards you could probably implement the upgrades yourself. This would require you to have copies of the appropriate EPROMs containing the necessary S/W.

author: shakalnokturn
author_rank: Super Contributor
timestamp: July 25, 2020, 09:52:26 am
content: Thanks for the input.The Math Plus would be interesting to have, I don't care that much for FFT itself but like to have a little more available than just add/sub operations between channels.Here's what my 3394A reports for options as well as having GPIB and RS232 on the rear. (So as for HW options it looks good...)Any idea on how to get hold of Math Plus? I've checked KO4BB's site there are no FW images there.

author: srb1954
author_rank: Super Contributor
timestamp: July 25, 2020, 11:07:09 am
content: Can't provide any suggestions for getting the S/W upgraded. The flash memory seems to require loading of different version of S/W for each option.The service manual says the unit has to be returned to the service centre for getting the S/W reloaded when a new memory chip is installed. The service manual also states that the reloading process is done under control of a program running on a PC so I assume there is no built-in provision within the PM3394 S/W or H/W for firmware updates.The math plus option provides: add, subtract, multiply, filter, integrate, differentiate, FFT, histogram, enhanced probe scaling, pass/fail testing, measurement statistics, enhanced cursor measurements and multiple single-shot captures

author: HighVoltage
author_rank: Super Contributor
timestamp: July 25, 2020, 12:24:52 pm
content: I have about 20 of these scope around and they can be really good workhorses, even these days.These old Philips / FLUKE scopes have a few befits that you don't have on modern scopes.Make sure to press the CAL button often for autocalibration, before the CAL would run too far awayand it would require hardware repair.A new set of batteries easily last 10 years.Keep the dust out of the system. I open my used scopes of this series once a year and blow them out.The light is a simple light bulb, but hard to get these days.Remove the front blue protection screen from time to time and wipe it cleanNot much else.The original software to download images and control the scope still works over RS232It worked best on the 3394B but also works on the A VersionIf you don't have the full software, let me know and I can send it to you.These were amazing scopes at the time, only appreciated by those who used them.I bought my first brand new one of these in 1996

author: EHT
author_rank: Frequent Contributor
timestamp: August 03, 2020, 10:08:37 pm
content: Just got my PM3394 in relativelygood order. My points on this topic:- I replaced C1001 X Capacitor to avoid it exploding (can't recall if it was originally a RIFA foil type or not)- I guess the line filter should also be replaced for the same reason in case it has foil X/Y caps in it BUT the cable operated on/off switch is integral... I can't see any useful markings on it to identify the brand and the part number doesn't come up with anything in Google.Anyone replaced it or know if it is safe to leave?It could be bodged with one having the same panel dims, sacrificing the front panel power sw.- I need to replace the illumination lamp. I can see few 28V ones which look similar labelled "T1 3/4 midget" with types flange/wedge/groove...- As mentioned in above posts it would be good to have the remote terminal software to manage the calibration data stored in flash over RS232. I'd at least like to know how cals are left (maybe it says before saving?). I believe the same annoying system is used in the Fluke 90 series scopemeters- Ideally I'd like to have the ROM version that supports GPIB & Math

author: HighVoltage
author_rank: Super Contributor
timestamp: August 04, 2020, 11:25:58 am
content: I think I still have a light bulb from year ago when I bought a few before they became unubtanium.Is yours a "A" or "B" version?The hardware has changed from the "A" to the "B" Version and ROM images are not compatible.The later "B" versions were the best with the latest software from 1998-05-04This is a screen picture of a 3394B, with all options and latest FW.

author: EHT
author_rank: Frequent Contributor
timestamp: August 04, 2020, 02:25:22 pm
content: Hi, I see a few small 28V bulbs on Farnell so maybe one type is right? I should take it apart again and see...Mine is an A which has had quite a number of hardware mods applied. It does have the GPIB connector but the ROM image is not the original due to a previous ROM failure.

author: Vince
author_rank: Super Contributor
timestamp: January 30, 2021, 10:38:46 pm
content: Great topic ! Love these scopes, thanks all for the informationShakal, have a (Philips branded) 3394A too, though yours is much more recent, FW is over a year and half younger than mine.Also have a 3384B (Fluke branded).I love these "hybrid" scopes, great general purpose scopes that work fine for 99% of the stuff.My fancier digital scope don't need to be fired up that often. The combiscope is quieter, less power hungry, starts faster, and has that analog capability when you want it.I used to use a Tek 2232 but it didn't like the house move and has developed an issue with the focus.. the control now only let's me choose between a trace/readout of thickness between 5 to 10mm !Not very usable... will get round to fixing the 2232 of course, but too busy working on the house. So in the meantime I switched to using the Combiscope. I can then compare the 2, and appreciate the good in each of them.Generally speaking I prefer the Fluke / Combiscope because it's 5 years younger in design, and it shows. Less " temperamental ", more sophisticated features and user interface, a bit more memory.. and 4 channels instead of two.The 2232 however wins (for me at least), in the user interface department. I find the controls and menus so much more intuitive to use. It's a breeze. The Combiscope here and there, is a pain. Some menus baffle me and I have to think 10 times to figure out what button or knob to use, and in what direction to turn it, in order to get the desired result. Also, as has been already mentioned, and I agree 100%... the acceleration of the rotary knobs leaves a lot to be desired. Either too slow or too fast, no middle ground. Drives me a bit nuts and wastes time.Also too many push buttons.. I keep having to stick my nose on the front panel to read all the button labels to find the button I want. My brain just can't build a "map" of what button does what. Again waste of time.Also, the sampling rate on the combiscope is not great. It's even lower than the 2232 even though it's years more modern. 250MS/s for the 2232, on each channel, and only 200MSps for the Fluke and I fear it's multiplexed ?! So since it's a 4 channel scope, that means possibly only 50MSps per channel vs 250 for the Tek. I have a copy of the original paper manual for the Combiscope, and could not find clear information stating whether or not the 200MS were shared / multiplexed.But other than sometimes questionable user interface decisions, overall the Combiscope is my favorite. Also, big advantage of course is the combiscope offers automatic measurements, and math functions. 2232 does not.Both my A and my B have the FFT / Math package it appears.As for the differences between the A and the B : I stacked them on top of one another, fed them with the same signal, and then entered each and every menu and sub-menu, to hunt for differences. Could hardly find any.. same exact menu items everywhere, same memory depth, same everything. Only difference I found are :- The 3394A (200MHz) has a 50ohms option which the 3384B (100MHz) does not.- The 'B' has a lot more driver options for plotters and printers.So I use the older 'A' scope because of its 200MHz B/W and 50ohms option, but at some point I will want to use the plotter and printer output, as I would love that to document my work. I am tired of taking crappy pictures of the screen with my camera. It never looks nice.Since I understand from above comments that the A is not compatible with the B F/W... I am out of luck.... unless your 'A' which has a much more recent F/W than mine... would happen to have the plethora of printer drivers that my B does. I could reflash my scope with your F/W !As for calibration needing to be done regularly... I notice that my scope takes care of that himself : it interrupts me regularly to run a calibration whether I like it or not !As for batteries, RTC is still holding up after 27 years !So good batteries they must be ! I guess I should none the less open the scopes to make sure they are not starting to leak...I have to say I got lucky and both my scopes somehow were working 100% fine, so I didn't need to open them up ! Don't even know what they look like inside, shame on me !I am used to old Tek scopes, but I have no idea about the guts of these Combiscopes...@HighVoltage : might it possible that you send me a copy of the computer S/W for these scopes ? That would allow me to take care of them... and let ShakalNokturn read his F/W, so he can send it to me and then I can reflash my scope to get the extra printer drivers ! That would be awsomeAnyway, was great to see a topîc on these scopes, I have grown quite fond of them, might buy some more of them if I ever come across cheap broken ones. A 3394B would be good.

author: HighVoltage
author_rank: Super Contributor
timestamp: January 31, 2021, 12:17:42 am
content: Quote from: Vince on January 30, 2021, 10:38:46 pmI think I posted it it some threadLet me look for it and I will post it again

author: Runco990
author_rank: Frequent Contributor
timestamp: January 31, 2021, 01:08:52 am
content: The Combi scopes are pretty cool. I actually sold mine recently because I just moved "up" in scopes. I liked it. But I strongly dis-agree on the batteries.Check them often and for GOD'S sake, don't use DURACELLS!!Batteries used to NOT leak years ago. These days... I see them leaking still in the pack!I use Energizer lithium AA's in all these applications now. So far, (knock on wood) no leaking.Just FYI.

author: HighVoltage
author_rank: Super Contributor
timestamp: January 31, 2021, 11:46:23 am
content: The original Philips AA batteries are so good, that even after 30 years, I have not seen one leak.Attached is the original Software to download images from the scope and to control the scope over RS232Instructions are enclosed.Unzip, UnrarInstall the demo software and then apply the original update.It runs best in Windows XP but you can get to run under Windows 7 in XP compatibility mode

author: Vince
author_rank: Super Contributor
timestamp: January 31, 2021, 12:15:19 pm
content: Quote from: HighVoltage on January 31, 2021, 11:46:23 amThanks a bunchThe only Windows I have is XP in a virtual machine under Linux. Might have to spend some time to get the virtual machine to work with the serial port.. never tried it.If that fails I have an old Pentium / Windows 95 machine which would be period correct for this '90s software / scope, so I guess it would work fine as well on that machine. Will see !

author: kripton2035
author_rank: Super Contributor
timestamp: January 31, 2021, 12:42:57 pm
content: Quotethanks but the archive asks for a password to open it ?!?!?unzip is ok but unrar ask for a password

author: mc172
author_rank: Frequent Contributor
timestamp: January 31, 2021, 12:58:43 pm
content: Not sure if this helps but I've got a similar-looking PM3082 and I heard the fan gradually loading up, slow down and ultimately stall one day whilst messing around with some broken kit I had to fix, so I turned it off and used my Rigol until a new fan came in the post. It was quite a slow process, not a sudden slowing down. The bearings in the old fan had gone really high friction. If I hadn't been there to hear it slow down I doubt I would have noticed.

author: Vince
author_rank: Super Contributor
timestamp: January 31, 2021, 01:16:14 pm
content: Quote from: kripton2035 on January 31, 2021, 12:42:57 pmOops yes, just tried it, same problem. ZIP is OK but RAR asks for a password...

author: HighVoltage
author_rank: Super Contributor
timestamp: January 31, 2021, 04:15:06 pm
content: Sorry, here is a more detailed install instructionsPassword is my eevblog user name: "HighVoltage"DownloadDownload the two zip files:- FlukeView_Software-1.zip- FlukeView_Software-2.zipUnpack each ZIP file seperatelyYou will end up with 2 RAR file:FlukeView_Software.part1.rarFlukeView_Software.part2.rarUnpackUse WinRAR to unpack both filesuse password: "HighVoltage"You will end up with 1 ZIP file:FlukeView_Software.zipunpack this ZIP file and you will get two folder:- FLUKE- Fluke Ver 2 updateINSTALLCopy the folder "FLUKE" to to C:\Ending up with:C:\FLUKEStart the SETUP.EXE in the "Fluke Ver 2 update" folderIt will search for the FV33WIN.EXE in the "C:\FLUKE" folder and then update to v2 full versionDone!

author: Vince
author_rank: Super Contributor
timestamp: January 31, 2021, 04:31:35 pm
content: Thanks for taking the time to detail this procedure HighVoltage... install is now successful, S/W starts up just fine, yeah !Now just need to search for a null modem cable in my boxes full of cables !Can't wait to connect to my scopes and play with them, thanks a bunch !

author: srb1954
author_rank: Super Contributor
timestamp: January 31, 2021, 08:48:43 pm
content: Quote from: HighVoltage on January 31, 2021, 11:46:23 amI have had the same experience with the Philips AA batteries in my Combiscope: more than 26 years, no leaks and still reading more than 1.5V per cell.These cells are marked "Made in Belgium" so in the past someone in Belgium knew how to make a quality battery. I wonder if that person can be found and brought out of retirement because all of the current battery manufacturers have forgotten how to make a decent battery.

author: shakalnokturn
author_rank: Super Contributor
timestamp: January 31, 2021, 09:14:21 pm
content: Vince:I've been planning on dumping the firmware from my PM3394A since the beginning of this topic, now if you're actually in need of it that may get me moving (hopefully the containers are socketed).I'm still interested in trying out the Math Plus if I can get hold of that.Any chance you'd go to the trouble of doing a dump too?I'll update the topic one evening when my scope is open with a bit of luck we'll be able to swap and experiment at the same time.

author: Vince
author_rank: Super Contributor
timestamp: January 31, 2021, 09:36:55 pm
content: Shakal, of course I don't mind doing whatever that may help you ! ... but I don't have an EPROM programmer just yet... house construction is my priority for now (just finished painting the bedroom this evening, making progress !). However I could just ship the EPROM to you in the mail, no worries.But I just realized one big problem, stupid me : if I reflash my scope with your F/W, I will benefit from the extra printer drivers, most likely, but... I would also in the process lose the Math package !Can't afford that.And the other way around too... with my F/W you would get the Math package but lose most of the printer drivers...We need to find a way to add the math package to your F/W before I reflash my scope with it !Or maybe HighVoltage or someone else here, has one of his ' A ' scopes with a recent F/W which features both the extra drivers and the Math package ?! That would be the easiest way...

author: kripton2035
author_rank: Super Contributor
timestamp: January 31, 2021, 09:46:59 pm
content: funny to see french people talking in english on an australian forum hosted in the USA ...

author: 2N3055
author_rank: Super Contributor
timestamp: January 31, 2021, 09:55:37 pm
content: Quote from: kripton2035 on January 31, 2021, 09:46:59 pm

author: Vince
author_rank: Super Contributor
timestamp: January 31, 2021, 09:59:23 pm
content: Kripton, that's globalization in action !I quite like it.. the good side of the world "economy", bringing people together...What's much more perplexing is seeing French people in France not being capable to speak proper French anymore, and instead spit out random English words like condiments, thinking that will make them look trendy or smart.. but in fact their English is just as atrocious as their French.. but you can't tell them because well, it's so wide spread in French society these days that it's become the norm. How sad is that...Shakal, here the list of drivers I have in my scope, so you can compare with yours. Do you have more than these ?Printers :- HP 2225- FX80- LQ1500- HPLaser (series II & III only)The first 3 are dot matrix printers as I understand it. LaserJet is cool as I have one but... I have a more modern 6 series, not 2 or 3...Plotters :- HP 7440- HP 7550- HP 7475A- HP 7470A- HPGL- PM8277- PM8278

author: HighVoltage
author_rank: Super Contributor
timestamp: February 01, 2021, 05:01:30 pm
content: Quote from: Vince on January 31, 2021, 04:31:35 pmIn the scope menu for the RS232 setup, you can select between a 3 wire or 7 wire connection.In my experience, all you need is a 3 wire null modem cable and you can go full turbo speed on the PM3394Bbut on the PM3394A you have to use reduced speed to get a stable transfer.

author: Vince
author_rank: Super Contributor
timestamp: February 01, 2021, 05:38:48 pm
content: Oh, so you mean even though I can select 38400 baud on my 'A', it doesn't work reliably ? No point offering it thenA problem due to the F/W ? Or maybe the H/W is different ? Different line drivers on the 'B' ? Who knows... I guess we don't even have schematics for these scope, do we...

author: grumpydoc
author_rank: Super Contributor
timestamp: February 01, 2021, 05:57:04 pm
content: Quote from: Vince on February 01, 2021, 05:38:48 pmYes, they are online.

author: Vince
author_rank: Super Contributor
timestamp: February 01, 2021, 06:05:08 pm
content: Oh that's great !Going to download the A and B schematics immmmmmediately !

author: shakalnokturn
author_rank: Super Contributor
timestamp: February 01, 2021, 06:19:10 pm
content: Quote from: kripton2035 on January 31, 2021, 09:46:59 pmIt does read "Made in Holland" on my Fluke branded Philips hardware, global averaging must be enabled...Quote from: Vince on January 31, 2021, 09:59:23 pmJe voi pa lé ou le blème tank on voi kesske je dis...(I'm aware I should be banned for that)I'll check on the printer list.

author: shakalnokturn
author_rank: Super Contributor
timestamp: February 02, 2021, 11:50:16 pm
content: So on mine...Printers:HP2225FX80LQ1500HPLASER (L.Jet I/II)HP540Plotters:HP7440HP7550HP7475AHP7470AHPGLPM8277PM8278dump-m1

author: edavid
author_rank: Super Contributor
timestamp: February 03, 2021, 12:44:44 am
content: Quote from: Vince on January 30, 2021, 10:38:46 pmActually, the Tek 2232 and PM3394x each have 2X 100MSPS ADCs. The 2232 always samples at 100MSPS, where the PM3394x samples at 50-200MSPS depending on which channels are enabled.

author: shakalnokturn
author_rank: Super Contributor
timestamp: February 03, 2021, 03:25:58 am
content: I've just finished closing my PM3394A.Impressions are that the layout is quite good , however if the interface and firmware PCBs could be swapped it would make access easier.The interface / F.W. PCB where absolutely nothing gets hot is in the airflow with the PSU while the digital acquisition which does run hot is left out of the wind.In terms of preventive maintenance I found it was worth the peep to sweep some dust off the high voltage end of the PSU.I also noticed a hot spot on the output stages of the X/Y amplifier PCB so I removed the CRT side of the heatsink to gain access to the few weak solders on both SMD /TH components, clean the dry thermal paste and replace it with a modern pink substitute.It turned out to be a quite long and unpleasant task...As for the firmware it's stored in 3 TSOP flash IC's so unless there's software around to read it out over RS232 or GPIB I'm afraid it's going to stay secret until I pick up more courage.I'll get a couple of photos up later.

author: shakalnokturn
author_rank: Super Contributor
timestamp: February 03, 2021, 10:32:15 am
content: Photos...

author: Vince
author_rank: Super Contributor
timestamp: February 03, 2021, 06:56:37 pm
content: Quote from: edavid on February 03, 2021, 12:44:44 amOOOPS !!!Thanks for correcting me ! I do'nt know where and when I got that wrong... early Alzheimer maybe...Just looked at the service manual. Indeed the A/D are clocked at 100MHz, one on each channel. However What I don't understand is taht the "spec" section of the manual seems (to me ?) inconsistent : they say 100MSps at max sweep speed for one channel, but only 50 when in ALT/CHOP mode, ie when using the two channels, which would mean it's multiplexed... but there is an 100MHz A/D on each channel so why would it halve when displaying both channels ?! I am a bit confused.Anyway, point is made that the Combiscope unlike what I thought, is ont worse than the 2232 in this department, but actually better. 200MS/s instead of 100, on one channel. So, one more reason to favor the Combiscpe over my 2232. Other advantage of the Combiscope that I forgot to mention : the power supply is dead silent. In the 2232 and most 2000 series scope, the switch mode power supply is renown for often making a horrible high-pitch noise. How bad it does it, and for how long after power up.. depends on your particular scope. There is no know definite cure for this problem sadly. Even Tektronix back in the day had a service bulletin on this very problem, so they clearly knew about it...My particular 2232 is particularly bad in this respect. There is is no magical fix for this sadly. You cna play around with the value of some components to try and see if you can make it behave better, but that's about it. Very loud at start-up, unbearably high pitch piercing my ear drums... slowly diminishes progressively while warming up. After 10 or 15 minutes it settles to something bearable, but rarely goes away completely.The acoustic comfort of the Combiscope is therefore very appreciable, I admit...

author: Vince
author_rank: Super Contributor
timestamp: February 03, 2021, 07:16:20 pm
content: Shakal thanks for the piccies.Yor list of drivers contains only one single extra drivers compared to my old F/W. Pritner section, the HP540.Just checked my PM3384B, 1998 V4.1 F/W. ... same drivers as you !Uh..... where did get this impression that the new F/W had "lots" more drivers, please ? Wrong on th' 223é, wrong on the drivers... am I losing it recently ? Should I consult or what ?!So looks like I was wrong and I don't have much to gain at all using my 3384A instead of my 3394A....I guess it's a bit pointless printing screen now that we have the FlukeView S/W to download screens. More convenient...There is no such PC S/W for the 2232, that I know of. However ISTR some people writing home made PC S/W that read the printer output on the serial port, and convert that into a picture file. quite handy. I could investigate in that direction....So looks like I don't need you F/W after all !... but I would be happy to give you mine so you can have the Math package.Having the F/W soldered to the board and spread over these 3 SMD chips sure don't make life easy !!!..However if your programmer is able (?) to read these chips, then I guess it would be worth to spend a little time and money on making a tiny adapter PCB ? I could easily desolder my 3 F/W chips and send them to you. Then it's up to you to make the adapter ! You gotta work a but to deserve your math package eh ?!To avoid overheating my chips, it's best to not solder the chips to your adapter. Just make gold plated pad on which the chip pins will rest, apply some pressure/ clamp the device onto the board to make a good contact... should be good enough to be able to program it... seen it done before, works just fine.Anyway, whatever you decide, I am here to help, just e-mail me

author: shakalnokturn
author_rank: Super Contributor
timestamp: February 03, 2021, 11:00:12 pm
content: Thanks for the offer on the Flash IC's Vince, I do have a ZIF TSOP adapter for my universal programmer so the only hassle is having to desolder and re-solder the Flash from the scope, reading the contents is easy enough for me.I don't think I'll take up your offer though, the TSOP pitch is fine enough to put you at the risk of having a dead scope at the end of the operation.Being flash based means that there must be a way to update (and read) the Flash over software.Hopefully someone out there has a copy of that software or at least a list of commands that may help read and write.I haven't RTFM yet looking for information on the matter, maybe the pinhole top middle of the keyboard must be used to access special modes?If no one can help I may at least get some clue by sniffing the communications during a firmware refresh on my defective Fluke 123 which is from about the same era. That may at least reveal some undocumented commands.

author: grumpydoc
author_rank: Super Contributor
timestamp: February 04, 2021, 05:40:27 pm
content: Quote from: shakalnokturn on February 03, 2021, 11:00:12 pmPossibly - but if there is, it is not documented.The other thing that is not documented is how to reset the cal storage (using the save option permanently uses a "slot", I'm not even sure the manual is clear on how many "slots" there are, might check later).I vaguely looked at disassembling dumps of the earlier PROM based software but I think it will take a lot of effort.QuoteNo, that just allows you to save the current calibration to flash.

author: Vince
author_rank: Super Contributor
timestamp: February 04, 2021, 06:10:23 pm
content: Quote from: shakalnokturn on February 03, 2021, 11:00:12 pmWhile Googling for such a thing, Google pointed me to this topic on EEVBlog :https://www.eevblog.com/forum/repair/phillips-pm3394-combiscope-firmware-wanted/msg1219438/#msg1219438It's almost 4 years old. Topic shows that Philips used the RS232 to program the Flash, which contains both the F/W and calibration data.HighVoltage said he knew a guy who does the PC S/W to read or write the flash, but that this person was.... not very open at all to the idea of sharing this precious S/W with anybody else....That was 4 years ago... maybe this chap could be persuaded now ? HighVoltage ?

author: shakalnokturn
author_rank: Super Contributor
timestamp: February 04, 2021, 06:46:46 pm
content: Enough High Voltage can persuade anyoneEdit:Thanks for the link to that informative topic, a shame it didn't get further.If there is absolutely no way to access the firmware over RS-232 I suppose it would be worth the bother doing a manual dump, it will eventually help save some of these Combiscopes.

author: HighVoltage
author_rank: Super Contributor
timestamp: February 04, 2021, 10:24:01 pm
content: I still have contact to the guy from time to time but he can not be convinced to give me a copy of the original Philips/FLUKE programming software, since it was only an internal software and he had signed a NDA at the time when he received it.Believe me, I really badly wanted this software.Who knows, maybe one day I will get successful in convincing him.

author: grumpydoc
author_rank: Super Contributor
timestamp: February 05, 2021, 08:13:25 am
content: Maybe the thing to do is just disassemble the firmware - though it will not be easy given the bank switching, the fact that the mask ROM in the CPU is protected and (I presume) the firmware for the digital capture card is a binary blob in the main f/w somewhere (so will need separate tools).It would, at least, shed light on the mysterious error codes which are produced when part of the autocal goes wrong.I have ROM images from some of the non-A/B varieties of the 'scope.

author: Vince
author_rank: Super Contributor
timestamp: February 05, 2021, 06:28:18 pm
content: Looks like hell on earth this F/W thing, but a worthwhile project none the less ?I mean these scopes are great, probably the best and most modern of the "hybrid" scopes era, and there are still a few around. Worth making an effort to preserve them, I feel !Maybe start a new long term / on-going topic that would gather all the interested people and host all the information / progress being made. A single place where any and all info on this project would go, so as to make sure no info is wasted, a piece buried in some old thread here, another piece of info in an obscure unrelated thread there...The first post in that thread could be edited as we go, to summarize the current state of the work, in a table/spreadsheet or something. "The project at a glance" tableThat would also help new comers wiling to help to quickly know the project status, what he can do to help advance our endeavor.I am not that competent F/W wise, having never disassembled anything, but I have two of these scopes, and A and a B (might buy more of them if I can find some at a reasonable price, broken or not) and will most likely get a programmer hopefully in the not too distant future. So at the least I could dump my F/W so that other people can work on it, and could do experiments on my scopes when asked.

author: grumpydoc
author_rank: Super Contributor
timestamp: February 05, 2021, 07:06:30 pm
content: Give me a few days to work on the disassembler I started to write - I just looked over the code and it needs some improvement/features added but if I can get the start of a listing it will be easier to work on than raw hex

author: shakalnokturn
author_rank: Super Contributor
timestamp: February 06, 2021, 12:11:25 pm
content: @ grumpydoc (or anyone else who has dumps):I don't have much experience in the software domain but would be interested in a copy of your dumps just to examine the structure.Searching around I came across this which could be of interest although it's for a Scopemeter:https://www.eevblog.com/forum/testgear/fluke-192-196-199-fw-upgrade/Looking at the Fluke 123 firmware updater shows similar structure, the FW image is organized into blocks.I haven't yet got round to sniffing the commands sent by The Windows SW during an update.If I go to the trouble of dumping my flash manually just in case I F*** it up messing around with undocumented commands, I'd also be curious to if the ROM bootloader outputs anything over RS-232 when flash is missing.A shame it's such a PITA to access the Flash/Communication PCB.Anyone know if the positions of acquisition and Flash PCB's can be swapped?

author: grumpydoc
author_rank: Super Contributor
timestamp: February 06, 2021, 12:48:47 pm
content: Quote from: shakalnokturn on February 06, 2021, 12:11:25 pmWe know that the ROM FW will be split into blocks - if you follow the link to the old thread posted by Vance you can see that I partially reverse engineered the hardware address decode.The CPU on these machines is an 80C196 which has a 64k address range which can be split into separate code/data areas using the INST line. However the total ROM space on the non A/B model is 512k so some bank switching is needed.The top two address lines and 4 bits from CPU port 1 are combined with a few other signals to drive chip selects for the RAM & ROM by a PAL which results in a 16/32k bank structure.While I know it would be more interesting to do the A or B board I'll start with the non-A/non-B version as that's what I have dumps of (as the flash is socketed) and that's what I have the PAL truth table mapped out for. Once that is done, it is not going to be too difficult to do the A/B versions if we can get the code dumped. The hardware on those boards is different though with a larger PAL.The mask ROM code is going to be trickier - I'm hoping that it does little more than set up the PAL inputs correctly to start the 'scope from the main firmware.It is clear that the serial interface "CPL protocol" has undocumented commands (as I noted in the old thread - there's a table starting at 0x11e2 or so which seems to have: AS, AT, CF, CL, DS, DW, EM, EO, EX, GL, GR, ID, LL, PC, PF, PS, PT, PW, QC, QM, QS, QT, QW, RI, RS, ST, SS, TA - of these CF, DW, EM, EO, EX, PF & QC are not in the documentation that I have - even more oddly QP - "Query Print" is documented but not in the table.

author: grumpydoc
author_rank: Super Contributor
timestamp: February 09, 2021, 10:05:58 pm
content: Update:Still tinkering with my disassembler, need to teach it lots of things but in the meantime discoveredghidra(from a post on this forum) a cross-platform interactive disassembler written in Java which supports the MCS96 architecture. Sadly when fed the binary it did not make much sense of it - I suspect more set up is required.To start with the only option is to attack the PM3394 - I know the real interest is the PM3394B but I don't have ROM dumps from that, nor do I have the PAL truth table. The latter is doable without too much difficulty, the former less so.I am once again struck by the fact that deciphering the code will not be an easy task - the image that I have (which I *think* is just the vanilla version without maths or GPIB support) is 384k of machine code, doubtless including some DSP code as a blob, it is going to be quite a task to figure it all out. I don't expect quick results, even with help.Resources for the interested:Basic memory map:0000H-3FFFHROM bank 0 1st 16k4000H-7FFFHNormal operation (EA=0)Data reads & writes (INST = 0)RAMInstruction fetches (INST = 1)ROM bank 0 2nd 16kMask ROM operation (EA=1)RAM8000H-BFFFHData reads & writes (INST = 0)PROGENLT=0 - ROM (1st 16k of current bank)PROGENLT=1 - RAMInstruction fetches (INST = 1)Banked ROM (1st 16k of current bank)C000H-FFFFHData reads & writes (INST = 0)PROGENLT=0 - ROM (1st 16k of current bank)TEXTENLT=0 - CURCON memory (?)Neither of above - I/OInstruction fetches (INST = 1)Banked ROM (2nd 16k of current bank)So 0-32k is always the 1st ROM 32k bank as far as code is concerned, 32-64k is banked ROM (16 banks of 32k on the 33xx). RAM is mapped from 16k-48k, IO space above 48k but with some "complications" according to various port bits.IO is not fully decoded, and it is mostly "write only" the main blocks are decoded by a 74LS138 into:C80x = UOFOWR (front panel)C81x = BUZZERC82x = DACPENC83x = DACPWRC84x = LTCOWRC85x = ROSOPC86x = not connectedC67x = CPRSTCS (reset, presumably for the switch between mask rom & flash)IO read space is even more incompletely decoded and seems to consist mainly of the UFO interface - if I've translated the hardware correctly at C000-C3FF & C800-CFFF and whatever OPTCS is at C000-C7FF (yes, these overlap)The full ROM image can be downloadedherePM3394 service manual -FlukePhilips-4778.pdfCPU documentation80C196KB users guide -27065103.pdf80C196KB Data Sheet -80C196-1.pdf80C196KB Opcode table -8096opc.pdf80C196KB Application Note -272116-001.pdf8XC196NP, 80C196NU users manual -272479-002.pdf- a later chip but the manual has a detailed discussion of the instruction codes.I have a bit of other stuff but the above are the most useful docs, DM me if interested in helping.For an assembler - if we ever get that far, AS (http://john.ccac.rwth-aachen.de:8000/as/) seems to support MCS96 output.

author: Vince
author_rank: Super Contributor
timestamp: March 03, 2021, 03:57:18 pm
content: Thanks a lot for all that work !Me no expert but I guess the bottom line is.... that it's so convoluted and complex that it's hopeless ?!....To my untrained eye, the bank switching thing makes it too complexIt's great to see how much the designers were able to achieve with an 8 bit (?) CPU but from our standpoint 25 years later... would have appreciated even more if the y spent the extra buck for a 16 bit CPU with a large, single linear address space for code, RAM and I/O... one big ROM chip for the F/W, and that's it...Anyway, if you still want to take it further, I will be watching the progress with much interest and respect for what looks like an absolute nightmare of a project

author: shakalnokturn
author_rank: Super Contributor
timestamp: March 03, 2021, 10:23:08 pm
content: Quote from: grumpydoc on February 06, 2021, 12:48:47 pmAlthough it's not saying much, running through the dump for text strings with a hex editor it does seem to contain references to MathPlus.

author: grumpydoc
author_rank: Super Contributor
timestamp: March 04, 2021, 09:16:47 pm
content: I've been semi-completely sidetracked by work for a couple of weeks so progress has been slow.Currently still tinkering with my own disassembler which is slowly getting there.Quote from: Vince on March 03, 2021, 03:57:18 pmIt's certainly complex but not hopeless. It should not be too bad to tease out the serial command loop - and maybe figure out what the undocumented commands do - which might give us answers to the important question whether the firmware can be dumped/reprogrammed via the serial port.After that useful things to know would be how to reset the calibration data store once it fills and (ultimately) what the mysterious error codes mean from the auto-cal.QuoteActually that's almost the easy bit.Apart from the RAM and I/O mapping we basically have bank 0 in the first 32k and bank 1-11 in the 2nd 32k, we can then build 11 files which represent the ROM contents with each bank mapped in the upper half - which can then be worked on separately. I've already identified the main inter-bank call routine which looks like this:Code:; inter-bank call. Stack on entry is <address within bank> <bank address> <return address>55f5 L55F5 c2 e9 ea st ea, + ; save #ea, e8 points to scratch area/heap?55f8 f2 pushf ; da is copy of port0 status, copy current low bits to #ea, preserve flags55f9 51 0f da ea andb ea, da, #0f55fd f3 popf55fe c2 e9 ea st ea, + ; stash current bank address in heap5601 cc ea pop ea ; save our return address in heap.5603 c2 e9 ea st ea, +5606 cc ea pop ea ; get bank address5608 af eb 10 01 ea ldbze ea, 272 ; effectively a no-op ROM from 0x110 (=272) just contains 0x00 - 0x0e560d f2 pushf ; preserve flags560e 71 f0 da andb da, #f0 ; strip low bits from #da5611 90 ea da orb da, ea ; merge in requested bank5614 f3 popf5615 c4 0f da stb da, PORT1 ; set up bank5618 cc ea pop ea ; pop destination address in bank into #ea561a c9 1f 56 push #561f ; push address to return to561d e3 ea br (ea) ; "call" code in selected bank561f a3 e8 fe ea ld ea, -2 ; ea <- our original return address5623 c8 ea push ea ; put on stack for return5625 a3 e8 fc ea ld ea, -4 ; get saved bank address (current when we entered sub)5629 f2 pushf ; preserve flags562a 71 f0 da andb da, #f0 ; keep top bits in shadow port0 var562d 90 ea da orb da, ea ; merge in old bank address5630 f3 popf5631 c4 0f da stb da, PORT1 ; restore old bank setup5634 a3 e8 fa ea ld ea, -6 ; restore old #ea contents5638 f2 pushf ; preserve flags5639 69 06 00 e8 sub e8, #0006 ; "pop" heap variables563d f3 popf563e f0 ret ; and return whence we cameMind you - there are variants of the above as well, will take a bit of time to figure them all outQuoteIt's a 16 bit CPU, the interesting thing is perhaps why they went with it given that they clearly needed more than 64k of firmware and (say) the 68000 was pretty mature by the time the range was designed and would have given them a flat 16MB of address space to play with.QuoteOh, I think I'll take it further, not sure how far I'll get though.

author: srb1954
author_rank: Super Contributor
timestamp: March 04, 2021, 10:08:06 pm
content: Quote from: grumpydoc on March 04, 2021, 09:16:47 pmEspecially interesting that they didn't go with something like a 68000 as Philips second-sourced many of of the 68000 family chips. They also had their own 68000-based integrated processor, the SCC68070, which would have been well suited for this application.I guess the instrument division of Philips just didn't talk to their semiconductor division.

author: shakalnokturn
author_rank: Super Contributor
timestamp: March 28, 2021, 11:27:44 pm
content: If this can be of any inspiration:https://www.eevblog.com/forum/testgear/old-philips-fluke-97/msg3260496/I'd bet there are plenty of similarities between the old Scopemeters and Combiscopes on the remote control side of the subject.Marrob released software to read/write calibration data and firmwares to the PM9x series.

author: grumpydoc
author_rank: Super Contributor
timestamp: March 29, 2021, 09:02:35 pm
content: Quote from: shakalnokturn on March 28, 2021, 11:27:44 pmI must admit that I missed that post.We know the undocumented commands are CF, DW, EM, EO, EX, PF, QC and QF - the command table starts just after 0x11E0 in the ROMCF=Clear Flash; PF = Program Flash and QF=Query Flash would be pretty plausible and consistent with the scope meter. QC is possibly Query Cal though "PC" is definitely not Program Cal - it is "Program Communication" - i.e serial port parameters.Anyone any suggestions for the rest?The CPL list from the manual isAS Auto SetupAT Arm TriggerCL CalibrateDS Default SetupGL Go to LocalGR Go to RemoteID IDentificationLL Local LockoutPC Program CommunicationPS Program SetupPT Program textPW Program WavefromQS Query SetupQM Query measurementQP Query PrintQT Query textQW Query WavefromRI Reset InstrumentRS Recall Setup (internal)SS Save Setup (internal)ST STatus queryTA Trigger AcquisitionThe list in the ROM is:AS, AT, CF, CL, DS, DW, EM, EO, EX, GL, GR, ID, LL, PC, PF,PS, PT, PW, QC, QF, QM, QS, QT, QW, RI, RS, ST, SS, TALooks like a table of 8 byte entries - the AS text is at 11E2 - and my guess is that's the start of the table, but beyond that nothing is obvious.

author: grumpydoc
author_rank: Super Contributor
timestamp: March 29, 2021, 09:27:33 pm
content: The table looks like this:11e2 41 53 00 06 ca 12 00 00 ; AS11ea 41 54 00 06 cb 12 02 00 ; AT11f2 43 46 01 02 cc 12 04 00 ; CF11fa 43 4c 00 06 cd 12 06 00 ; CL1202 44 53 00 06 ce 12 08 00 ; DS120a 44 57 07 06 cf 12 0a 00 ; DW1212 45 4d 00 04 d6 12 0c 00 ; EM121a 45 4f 00 02 d7 12 0e 00 ; EO1222 45 58 09 03 d8 12 10 00 ; EX122a 47 4c 00 06 e1 12 12 00 ; GL1232 47 52 00 06 e2 12 14 00 ; GR123a 49 44 00 06 e3 12 16 00 ; ID1242 4c 4c 00 06 e4 12 18 00 ; LL124a 50 43 06 07 e5 12 1a 00 ; PC1252 50 46 04 02 eb 12 1c 00 ; PF125a 50 53 00 0e ef 12 1e 00 ; PS1262 50 54 02 07 f0 12 20 00 ; PT126a 50 57 00 0e f2 12 22 00 ; PW1272 51 43 00 02 f3 12 24 00 ; QC127a 51 46 04 02 f4 12 26 00 ; QF1282 51 4d 02 07 f8 12 28 00 ; QM128a 51 53 01 07 fa 12 2a 00 ; QS1292 51 54 02 07 fb 12 2c 00 ; QT129a 51 57 02 07 fd 12 2e 00 ; QW12a2 52 49 00 06 ff 12 30 00 ; RI12aa 52 53 01 06 00 13 32 00 ; RS12b2 53 54 00 06 01 13 34 00 ; ST - yes, before SS?12ba 53 53 01 06 02 13 36 00 ; SS12c2 54 41 00 06 03 13 38 00 ; TANo idea what the other values mean (and, so far, haven't tracked down the code which accesses the table).

author: Edzko
author_rank: Newbie
timestamp: October 14, 2023, 02:38:42 am
content: In case anyone is interested:https://github.com/Edzko/CombiScopeEdzko

author: Vince
author_rank: Super Contributor
timestamp: October 14, 2023, 05:26:52 am
content: Looks nice, hopefully someone competent i.e. not me, will grab your source code and port it to Linux so I can use itIn the mean time I guess my best option is a software GPIB "printer", think I sawx that somewhere, though that too might be windows only I can't remember...

author: HighVoltage
author_rank: Super Contributor
timestamp: October 14, 2023, 06:21:32 pm
content: Quote from: Edzko on October 14, 2023, 02:38:42 amThanksI downloaded the files, but how do I start it under windows?

author: onre
author_rank: Newbie
timestamp: February 07, 2025, 05:21:04 pm
content: Reviving the thread, hope it's okay.I have a 3384B with Math+ and extended memory, but no IEEE-488. The maintenance menu reports a 512 kB ROM. As far as I can tell, it works. Even passes AUTOCAL.As this is my first DSO, I figured I might as well try to make the most of it. A quick look at the HP-GL library situation as of 2025 led me to roll my own, and I also wrote a small Unix/Linux program to communicate with the scope. Attached is a screenshot showing the current state of it. It's written in C, the only library dependency is XCB. Should be rather easy to get to run on anything that's even somewhat POSIX-like. It'll end up in a public source code repository sooner or later.grumpydoc, I salute you for the disassembly and memory mapping effort! Do we already know how to dump the firmware image over RS-232, like civilized people do? Turns out Ghidra supports MCS-96 and I've used it for some disassembly projects in the past and thought I could take a look.The only thing worth contributing I have right now isthe user manualwith added PDF outline, making it easier to find things quickly.

author: HighVoltage
author_rank: Super Contributor
timestamp: February 10, 2025, 04:03:42 pm
content: I still have about 10 of the PM3394B in use.Your software looks nice, would be good to use it over GPIBI am still using the original FLUKE software over RS232