Looking for user/programming manual for Anritsu MF91A Wavelength Meter

[_Wim_]

Hi, I recently acquired an Anritsu MF91A Wavelength Meter, and would like to use its GPIB port. The unit responds to *IDN?, but I can seem to find any manual describing the other commands. I do not even find a user manual, the only thing I found so far are the attached datasheets. So if anyone has some more info on this unit they can share, it would be much appreciated.

[_Wim_]

Nobody any more info on this one?

[PA0PBZ]

I tried to find something but there's not much out there. Can you read the EPROMs and get the commands from there?

[_Wim_]

Thanks for your answer. Yes, there is indeed not much out there, I spent already quite some time searching. I was hoping somebody had still a printed manual somewhere... About reading out the Eproms, I could give that a try, but I would need to buy a suitable programmer first. I will check which type is used this weekend.

[_Wim_]

There are 2 Eproms inside, both type HN27C64G-20. I have ordered an  Minipro TL866A which supports this device. Hopefully I can extract some more info this way...

[PA0PBZ]

There are 2 Eproms inside, both type HN27C64G-20. I have ordered an  Minipro TL866A which supports this device. Hopefully I can extract some more info this way...

That's nice. What processor is in there? If it is 16 bits you probably have to interleave the contents of both eproms to make sense. If you can't work it out just attach the contents and we'll all have a play.

[_Wim_]

It is an 8-bit Toshiba TMPZ84C00P processor. The unit contains 4 boards (sorry, taken with my cellphone only because this was nearby): a display board, a processor board, an AD and DA board and an analog board. The unit is really jam-packed, and wires all over the place.

Currently, the unit displays peak wavelength and corresponding power, but I would like to read out the entire scanned spectrum using GPIB. When I bought then unit, I was hoping that the BNC connectors at the back ("power" and "wavelength") would allow me to use my scope in XY-mode to have a nice spectrum display, but wavelength and power are an 1Vrms signal proportional to actual peak.

[_Wim_]

Ok, here is the contents of both eproms. Any tips how to proceed? I looked for human readably text using notepad++ using different encodings, but not much useful there. What software is recommended for this purpose?

Edit: typos

[_Wim_]

Using the fee dZ80 software (http://www.inkland.org.uk/dz80/) I was able to generate two assembly files...

[_Wim_]

I first joined both binary files, and then ran the dZ80 software. This way I get one complete assembly file. To reverse engineer this one however will not be so easy I think..

[PA0PBZ]

Looks like you have a ROM form 0 to 03FF and a RAM from 6000 upwards. Can you identify the RAM? I'm not sure if they only use I/O to talk to the peripherals or that there is also some memory mapped stuff. 
This is disappointing, I expected to see the commands in there but no. I also combined the ROMs and disassembled the code and it looks like they are doing some bit banging for the GPIB. I think I found a clue where they look for 0A or 0D/0A but I need some more time to make sense of it. There's only 10 instances of "I" in the whole ROM and none of them is in a compare instruction...
I did find some compares looking for the following, which could or could not be (part of) some kind of GPIB commands:
B01
C02
D012
E02
F03
R0

What is the *IDN response? That could give me another clue about what is going on there.

Code: [Select]

ROM:1B11 11 3D+                ld      de, 643Dh
ROM:1B14 21 24+                ld      hl, 6124h
ROM:1B17 1A                    ld      a, (de)
ROM:1B18 13                    inc     de
ROM:1B19 FE 0A                 cp      0Ah
ROM:1B1B CA C8+                jp      z, loc_1BC8
ROM:1B1E FE 0D                 cp      0Dh
ROM:1B20 20 09                 jr      nz, loc_1B2B
ROM:1B22 1A                    ld      a, (de)
ROM:1B23 FE 0A                 cp      0Ah
ROM:1B25 CA C8+                jp      z, loc_1BC8
ROM:1B28 C3 B3+                jp      loc_1BB3


[_Wim_]

Thanks for your efforts.

This is the reply to IDN? : <- ------LC3------«x0D»

[_Wim_]

I though I seemed to remember I got  different results previously, and indeed I did. I connected a helium laser source, and got a different feedback for the same IDN? command: <- 0632.8IC3-56.20«x0D»  This means it replies with the wavelength (623.8nm) and power (-56.2 dbm) even on a IDN? command.

Could this mean there is only 1 GPIB feedback?

[_Wim_]

Dammit, indeed it seems so. Connected my second laser (850nm), and tried different commands. All give the same feedback... I did not notice this before, because I never connected a known source well playing around with the GPIB, and figured what I got back was just the serial number of the unit...

[_Wim_]

So when I change from Dbm to µWatt, the unit indicated "IC1" instead of "IC3". When I change to "relative mode", the unit indicated "IC4". When I put the unit in uncall mode (I think this measures power over its entire wavelengt instead of a specific wavelength), the unit replies with "IU4" (when still in relative mode). Switching back to dbm, the unit replies with "IU3".

I need to swith to "local" again to be able to switch from units, otherwise I cannot change them. So maybe some commands do exist to swith between units and from uncal to cal.

[_Wim_]

The " ------LC3-----" reply was signal low because the cap was on and no light source was connected...

[PA0PBZ]

I did find some compares looking for the following, which could or could not be (part of) some kind of GPIB commands:
B01
C02
D012
E02
F03
R0

Looking again I think these are valid commands:

B0 B1
C0 C1
D0 D1 D2
E0 E1
F0 F1 F2
R0

R0 seems like a good candidate for reset...

[_Wim_]

Grrrr, my unit just died on me. No display, no nothing. Time for some electrical debugging first. I will keep you updated.

[_Wim_]

No signs of obvious damage, fuses are still ok, voltages on main filter caps also. Will start with a recapping job first (was planning to do that anyway), hopefully (probably wishful thinking) it jumps back to life after that.

[PA0PBZ]

Good luck with that Wim, I've been looking at the disassembly a bit more and I can see how it builds the output buffer in a very weird way. It starts with filling it with either spaces or "-", then it adds characters in the middle like C, U, H, L, I, N and then it reads the characters back to make decisions about what else to put there, not sure what the original programmer smoked... Anyway, I will put it aside and wait for you to resurrect the thing.

[_Wim_]

Thanks for your assistance so far. Looking forward to test the "new" commands. I am quite sure I will be able to fix this, but it always takes quite some time...

[_Wim_]

Hi,

A repaired solderjoint later, I could test my "new" commands:

B0 => switches to the second channel
B1 => switches to first channel? (I have only 1 channel, so I cannot test this)
C0 => goto uncal mode
C1 => goto cal mode
D0 => read-out in dBm
D1 => read-out in µWatt
D2 => relative mode
E0 => turn display backlight on
E1 => turn display backlight off
F0,F1,F2 => ? Does apparently nothing I can see
R0 => give a different reply to the read command, but cannot figure out what it means. By using R1 I can get back to the normal reply.

During the test, a laser source of 851nm was connected with an output power of approx -1dBm

[_Wim_]

Forgot to mention, only after the second R0 I get a different responce. Same for R1...

[_Wim_]

I did find some compares looking for the following, which could or could not be (part of) some kind of GPIB commands:
B01
C02
D012
E02
F03
R0

Looking again I think these are valid commands:

B0 B1
C0 C1
D0 D1 D2
E0 E1
F0 F1 F2
R0

R0 seems like a good candidate for reset...

Could you explain how you found these? Now I know they exist, I am not even able to find them back in the assembler code, let alone to find new ones... Is there a special software tool you use for this? (for ex. IDA Pro?)

[PA0PBZ]

Could you explain how you found these? Now I know they exist, I am not even able to find them back in the assembler code, let alone to find new ones... Is there a special software tool you use for this? (for ex. IDA Pro?)

Hi Wim,

Yes, they where not easy to find, they do not exist as readable text which you see in almost all firmware. And yes, I use IDA Pro but you can find the same in your disassembly.
It's just a combination of patience, luck and experience I guess. When I started with micro's it was all assembly language and I can still find my way around it, and this is a Z80 of course, the same chip I started with a long time ago.

Here is an example from IDA, the comments are mine 

Code: [Select]

ROM:1B2B FE 42                 cp      42h ; 'B'       ; B0 B1
ROM:1B2D 20 11                 jr      nz, loc_1B40
ROM:1B2F 1A                    ld      a, (de)
ROM:1B30 06 02                 ld      b, 2
ROM:1B32 FE 30                 cp      30h ; '0'
ROM:1B34 28 06                 jr      z, loc_1B3C
ROM:1B36 05                    dec     b
ROM:1B37 FE 31                 cp      31h ; '1'
ROM:1B39 C2 B3+                jp      nz, loc_1BB3    ; Not a valid command
ROM:1B3C
ROM:1B3C       loc_1B3C:                               ; CODE XREF: sub_1A6D+C7j
ROM:1B3C 70                    ld      (hl), b
ROM:1B3D 13                    inc     de
ROM:1B3E 18 D4                 jr      loc_1B14
ROM:1B40       ; ---------------------------------------------------------------------------
ROM:1B40
ROM:1B40       loc_1B40:                               ; CODE XREF: sub_1A6D+C0j
ROM:1B40 23                    inc     hl
ROM:1B41 FE 43                 cp      43h ; 'C'       ; C0 C1
ROM:1B43 20 0F                 jr      nz, loc_1B54
ROM:1B45 1A                    ld      a, (de)
ROM:1B46 FE 30                 cp      30h ; '0'
ROM:1B48 38 69                 jr      c, loc_1BB3     ; Not a valid command
ROM:1B4A FE 32                 cp      32h ; '2'
ROM:1B4C 30 65                 jr      nc, loc_1BB3    ; Not a valid command
ROM:1B4E E6 0F                 and     0Fh
ROM:1B50 77                    ld      (hl), a
ROM:1B51 13                    inc     de
ROM:1B52 18 C0                 jr      loc_1B14

This part decodes the B0/B1 and C0/C1 commands, but it is not easy to see what they do, they just set a bit or store a value somewhere in memory and I have no way of telling what that does. If there is anything specific that you want me to have a look at please let me know.

[_Wim_]

I have installed the free version of IDA for this project, but unfortunately it does not support the Z80. The paid version is too expensive for my very limited use (this little project). The file from IDA looks a bit more readably, but still, I would not have realized that these were GPIB commands.

I am looking specifically for a command that returns an array with all the measured light intensities for the scanned spectrum. This unit scans the attached light source from 600nm to 1000nm, with a resolution of 0.1nm. I would like to display the completely scanned spectrum, and not only the reported peak value. This unit is quite old (1985), but when I connected a HeNe laser source, it still exactly reports 632.8nm, I was quite impressed by that.

[PA0PBZ]

I am looking specifically for a command that returns an array with all the measured light intensities for the scanned spectrum. This unit scans the attached light source from 600nm to 1000nm, with a resolution of 0.1nm. I would like to display the completely scanned spectrum, and not only the reported peak value. This unit is quite old (1985), but when I connected a HeNe laser source, it still exactly reports 632.8nm, I was quite impressed by that.

I already understood what you want from a previous post, but do you even think that there is such a command?
Maybe the commands that have an unknown action (F0, F1 and F2) or the R0 one (I can't remember an R1 but I will have to check again) need an additional parameter, like the wavelength? (Hmm, F for frequency...) Maybe it is not possible to return the whole scanned spectrum automatically but if you can set the wavelength and then get the intensity it could solve your problem. I have to look at the firmware again to see if it accepts/expects parameters.

[_Wim_]

Yes, I do not know if there is such a command. Reading out the intensity for a specific wavelength would off course also be a good solution. I have already tried to add a wavelenth to the unknown intructions, and also tried to complete alpabet from A0 to Z1 to check if a get a different responce.

But so far no other returns exept for R0, but I do not understand what this feedback is... I have also checked other manuals from Anritsu to check if they have comparable commands, but so far found nothing comparable.

I am already very gratefull for the commands I have, this allows me to perform some long term logging for the sensor I am working on.

[PA0PBZ]

After the second R0 it looks like you get 4 different power measurements:



Now the question of course is, what are they? the 4 strongest points after the 851.5 -01.02? The fact that you have to send R0 or R1 twice makes me think that they expect another parameter, did you try to send R0 or R1 followed by a wavelength either on the same line or on a second line?
<<x20>> is just a space, not sure why it shows in hex here.

[_Wim_]

After the second R0 it looks like you get 4 different power measurements:



Now the question of course is, what are they? the 4 strongest points after the 851.5 -01.02? The fact that you have to send R0 or R1 twice makes me think that they expect another parameter, did you try to send R0 or R1 followed by a wavelength either on the same line or on a second line?
<<x20>> is just a space, not sure why it shows in hex here.

Just played around a bit more. It seems that "sending it twice" is related to timing. If I use SEND and afterwards READ, I only need to send R0/R1 once. But if I use the SEND&READ function of my software, I need to send R0/R1 twice.

I have added a wavelength directly to the R0 command (seperated by a space), and on a new line (seperated by , or . I have tried many other combinations also, but always get the same feedback.

If do not think the feedback on R0 are 4 power measurements, becasue the light source I used is monochromatic, so no other wavelenth should have a measureable intensity (at least not when seperated by 0.1nm)

[_Wim_]

If do not think the feedback on R0 are 4 power measurements, becasue the light source I used is monochromatic, so no other wavelenth should have a measureable intensity (at least not when seperated by 0.1nm)

Ok, I have to take that back a little. The feedback is related to power, but I do not think is are different wavelengths. Below is the feedback I get by reducing the level of the laser each time with 1 db.

So 3 of the 4 fields nicely drop with one dB (power of the peak dropped from -4dBm to -10dBm in these 6 steps)

[_Wim_]

I have found an Anritsu manual that has simular commands:

https://dl.cdn-anritsu.com/en-us/test-measurement/files/Manuals/Programming-Manual/10370-10286.pdf

I have tried to supply parameters using  for example "F0 800_NM" and "F0 800" (same for F1 and F2), but I get no different reply so far.

 

[PA0PBZ]

That confirms that Anritsu uses these letter-figure combination of GPIB commands, but that is something we already found. Since the manual you found is for a signal generator I have not much hope that there are similar commands apart from IDN.

[_Wim_]

Most Anritsue GPIB command (probably of more modern units) look more "standard" as used by HP and R&S. This manual uses also the letter/figure combination.I agree the commands will not be simular, but there is a good change F0 to F2 will also modify parameters.

I was also looking for the way they make longer commands, which separators are used, and how they are triggered.

[PA0PBZ]

Look at this (chapter 5.3): http://exodus.poly.edu/~kurt/manuals/manuals/Other/ANRITSU%20ML93A%20Operation.pdf

[_Wim_]

Thanks again! So this is indeed also in my unit what F0, F1 and F2 mean...

So now only R0 and R1 can bring the needed information 

[PA0PBZ]

So now only R0 and R1 can bring the needed information 

I had another look at the R command:



So if you send R0 it stores a 1 in location 6400H, if it is not a 0 it stores a 1 there.

This changes the output type, if there is a 1 @ 6400H it outputs the 4 numbers:



 if there is a 0 it outputs the normal format. So... sorry but it's not going to do what you want.

[_Wim_]

I was already afraid so...

Many thanks for your help, it was very much appreciated! I would never have gotten this far alone.

I have attached a summury of the commands discoverd if anyone would need them later on.