Morrow V9054 Spectrum Analyzer (199x VXI device) anyone?

[8008]

Hello,
I am trying to revive a Morrow V9054 Spektrum Analyzer. There is not much information on the internet about that beast. I am trying to access the V9054, which is a VXI card via a HP E1498A / V743 VXI controller, everything inside a HP E8401A VXI mainframe. 

Problem is, I have only Windows 95 driver software as dll's. No driver sourcecode. I also have some user guide and a technical guide, but I am missing the "programmer's reference guide".

Currently I can access the device by issuing some well known word serial commands (standard commands from VXI spec), so it works basically. I can inquire its software version, read status registers and such things.

But the real control requires knowledge of control codes and command parameters. I tried to decompile/dissassemble the windows dll's with Snowman (https://derevenets.com/) and gcc's objdump but the output did not provide me a clue. For unknown reason I cannot even find the known command codes in the dissassembly/decompiled source. My knowledge of x86 assembler is sadly low.

So my questions:

- Anyone else using that device?
- Anyone having the "programmer's reference guide" ?

For me, this is a "computer history" project, but the device would also be used if I can revive it.
I already have brought back the E1498A controller with its HP/UX 10.2 back to live ( this is another project described here http://spurtikus.de/2017/03/05/hp75000-series-c-agilent-e8401a-vxi-mainframe/).

Dennis

 

[tmbinc]

Have you tried simply running "strings" (or just using a hex editor) to look at printable strings? If they send the full-length commands (and not shortened - I assume this is SCPI?) you should at least see what's there.

Alternative may be to run this in qemu, and somehow hook up some software glue logic to make it talk to the actual VXI mainframe. What driver model do they use? For example, could the original software be reconfigured to talk to a serial port instead? (which may be easier to emulate)

Does the driver even contain more logic, or does the driver only enable you to talk to the board? I.e., do you have an example app to run with the driver?

[tmbinc]

Looking at https://www.artisantg.com/info/PDF__4D6F72726F775F56393035345F4D616E75616C.pdf - do you have the .dll that implements SetIntrCode, RdIntrCode etc.?

If so - can you upload that DLL? I'm happy to take a look.

[8008]

Hello
thanks for the hints.

I have no test application running, only my bare own test.c with 20 lines of code. This just queries successfully the device version. To define the parameters for a sweep and to start it, I need MUCH more knowledge about the Analyzer than that 

I have uploaded the DLLs ... see below.

I have digged further and have moved some very small steps forward.

The Morrow V9054 is a "message based" VXI device. But it does not speak the nice strings known from other devices (like "VOLTS:DC:MEASURE"). It only supports the Word Serial Protocol. This protocol consists of commands with word size (=2 bytes), 0x7e00 for example means "VXI_GETSTATUS" and returns a status byte from the analyzer. There are many predefined commands (predefined by VXI spec) and a handful commands defined by Morrow. VXI defines a complete protocol for (even "high speed") data transfer around that.

The driver consists of a Windows 95 PnP-Driver named mtcpnp32.dll, another Library implementing the Analyzer-functions named mtcsa32.dll and finally a whole bunch of "transport layer" libraries. I have one for visa (called mtcvsa32.dll) and another one for the ISA bus. The software is targeted to Window 95.

In my setup, the analyzer can be accessed via SCPI only. No Windows PC, the analyzer is inside a VXI mainframe which runs HP/UX. SCPI includes the Words Serial Protocol.

After wasting some time with the Snowman decompiler, which gave me more or less no clue whats going on, I tried the "retdec" Decompiler from github. This thing was able to decompile all libraries, so that I could find some command codes and started to analyze the code. This is for example a decompiled function, some symbols renamed by me after finding out what they mean:

// DD: This function sends a word to acquisition CPU "P1"
// Address range: 0x100019c8 - 0x10001a09
int32_t VISA_SendWord(int32_t deviceId, int16_t command) {
    int16_t v1 = -2; // bp-8
    g2 = deviceId;
    // DD: 0x7f00 = VXI_ENGINECOMMAND
    int32_t v2 = function_10001a0a(deviceId, 0x7f00); // 0x100019db
    g2 = v2;
    if (v2 != 0) {
        // 0x10001a02
        return (int32_t)v1 | v2 & -0x10000;
    }
    int32_t v3 = function_10001a0a(deviceId, command); // 0x100019f0
    if (v3 == 0) {
        // 0x100019fc
        v1 = 0;
        // branch -> 0x10001a02
    }
    // 0x10001a02
    return (int32_t)v1 | v3 & -0x10000;
}

Theoretically I can move forward, but problem is, the three libraries have decompiled to >100.000 lines of code  . I estimate more than 2000 function definitions. The Morrow people were really going to town,  Dave would say.

I've put everything I have to github. This is the directory with the DLLs:
https://github.com/DennisD2/tomorrow/tree/master/tomorrow/src/morrow/lib
Interesting dlls are:  mtcsa32.dll (spectrum analyzer code), mtcvsa32.dll (VISA transport layer code) and mtcpnp32.dll (API for programmers which combines the other two libs).

The decompiler output is here:
https://github.com/DennisD2/tomorrow/tree/master/tomorrow/src/morrow/decompiled
I commented out large parts in these files because it looks as if they are part of code from Microsoft libs which is not needed...

Finally, here are the headers I found on the driver disk.
https://github.com/DennisD2/tomorrow/tree/master/tomorrow/src/morrow/include

Hmm, this looks like very VERY much work 

Dennis

[8008]

Hello again,
I leave this here for anyone else searching a usable library for the Morrow V9054 spectrum analyzer. Currently I seem to be the only one using that device 

After 2 months decompilation and disassembling I was able to retrieve first data from the Morrow V9054 spectrum analyzer. The project is here:
https://github.com/DennisD2/tomorrow

The C code can be compiled on a 64 and 32 bit machine and requires only a few SICL or VISA functions. All code parts with float values were rewritten because the RetDec decompiler generated wrong code.

A more detailed discussion of the code is here:
https://github.com/DennisD2/tomorrow/blob/master/src/morrow/sa9054-info.md

And finally, a nice looking plot from a measurement:


My port includes currently only ~10% of the code of the original Morrow library. There is much work to do left, but hey it is possible to use the analyzer in a nowadays environment.

Currently I am working to add a small user interface based on Plot.ly and WebSockets to control the spectrum analyzer and to display the data in realtime.

Dennis