Fixing a Broken Amprobe AT-7000 Reveals How a $2,700 Cable Tracer Died in a Drawer and Came Back

Most people have never held an Amprobe AT-7000-EUR, and even fewer would guess a cable tracer can cost about $2,700. Electricians use this kit when a cable disappears into drywall, a ceiling, a floor, or a crowded panel and a cheap tone probe is not enough. One half of the kit is a transmitter you clip onto a circuit. That box injects a tracing signal, 6.25 kHz on live wires or 32.768 kHz on dead ones, in high, low, or clamp mode. The other half is a receiver with a color screen, a tip sensor, and a Smart Sensor array that shows where the wire runs and which way it is going, often to about two inches, and can pick the correct breaker instead of a handful of false hits.

Tom bought the pair for work at roughly £2000 ($2700). After months of sitting in storage, the transmitter simply went dark for no apparent reason. The transmitter went dead, which means the batteries, buttons, and display did not even twitch. However, the receiver opted to reactivate, which is at least some aid in locating the problem. Fluke’s service team quoted £70 for an initial quote and another £600 to even try a repair. When the fees were factored in, it was off to the “YouTube Heroes for Hire” op Buy it Fix it.

Sale

DJI Mic Mini (2 TX + 1 RX + Charging Case), Ultralight, Detail-Rich Audio

• Small but Mighty – The DJI Mic Mini lavalier microphone transmitter is small and ultralight, weighing only 10 g, [1] making it comfortable to wear…
• Detail-Rich Sound – Mic Mini wireless microphones delivers high-quality audio. A 400m max transmission range [2] ensures stable recording, even in…
• Extended Battery, More Recording Time – Mic Mini wireless lavalier microphone with Charging Case offers up to 48 hours of battery life, [3] ideal for…

Five small screws later, the transmitter board was on the bench. A 10.2 volt bench supply showed the normal voltages popping up: 5V, 3.3V, and 1.2V, all present and accurate. A thermal camera scanned for hotspots but found nothing unusual. An oscilloscope showed a clear 23.9989 MHz clock signal from the 24 MHz crystal as well. Even the backlight seemed to work well after the ribbon was reseated. So it appeared that the hardware issue was not with the power supply.

Only after connecting the serial pins to a computer at a baud rate of 115200 did the true tale become obvious. Boot logs appeared before abruptly terminating with a NAND boot failure. Both machines run some ancient Linux 2.6 firmware from a 128 MB NAND chip housed within a TSOP-48 box. At startup, the system on a chip reads that chip, checks the boot image, and refuses to continue if it discovers a problem. This is exactly what the dead transmitter was doing.

After blowing hot air into the NAND chip, a programmer read it. We could see the data was there, but a hex view looked like a nightmare, with a large empty patch and random bit flips. In the erroneous areas, E1 was where E should be, O where 01 should be, and C9 where C1 should be, among other things. A wild goose hunt through Google’s Gemini chatbot took up half of the day in theory on how ECC works, and I didn’t get anywhere or get the unit up and running, but the smart play was simpler.

The receiver was also ripped apart, and it had the same CPU, RAM, and, most critically, flash IC. So some wires were attached to the serial header, and a fast run of U-Boot with the programmer’s bit-flip settings adjusted slightly resulted in a clean NAND image. The next thing he knew, he had the files side by side, and it was obvious what had gone wrong: only a few cells in the transmitter’s bootloader had faded out after years of inactivity. Using a hex editor, clone the sound healthy bootloader bytes from the receiver into the rotten transmitter bootloader, creating a hybrid image that was then written back into the original chip.

That got him all the way there, and the resoldering should have done the work, but one weak solder joint on the flash pin meant it wouldn’t boot up. After a brief fix up, the transmitter rebooted into its normal Linux 2.6 interface. So a live test was performed, and when the receiver approached the transmitter on the cable, the signal climbed up as it should. The kit was back up and running for daily operations. Those leaky NAND cells are still in there, so a fresh flash IC is the lasting insurance policy. A professional tracer that official service priced like a small appliance came back because two identical boards shared a bootloader, and a handful of forgotten bits were put back where they belonged.
[Source]