ANRITSU instrument boot up failed discuss(MS462X VNA)?

[VT7]

nothing, i would suppose.. 

[mbielman]

FYI - After I got the NVRAM restored (had to but the alternate boot ROM) I was getting self test errors. (see previous posts) Turns out I had a bad Down Conversion Module of the IF board. Actually found one, replaced it and now my MS4622B appears fully operational! What a ride!!! 

[Staffan321]

Hello,

This was a long thread, hoping to keep it alive a little more...
I have a 37247 VNA with a CPU very similar to what is discussed here - also with a BBRAM. It is not yet dead, but time is not on my side.
Does anyone have any suggestions on how to:
* Download the data from the BBRAM? Difficult to pull out and read with an EPROM programmer? Risky?
* Replace the BBRAM? If I just enter a blank one, I guess the VNA will halt still? Is there a risk that something is erased, i.e., I can't revert to the old BBRAM (should it still be around)?

Does anyone know if there are any chances that the bootdisk etc found in this thread may work also for the 37247? The CPU is most likely a MVME162 by the looks of it.

Many thanks in advance!

Regards,
  Staffan

[mbielman]

Hello Staffan,

No idea about the boot disk and other software. I would think these are NOT the same. But again, not sure. I think you can do a backup of this to floppies.

Regarding the BBRAM, sounds tricky! But I think if you have a new battery at the ready, you should be able to swap in the new one w/o issues. (I think there's
a large storage capacitor there to assist.)

I would NOT try removing the BBRAM chip - too risky. Just go w/a quick battery replacement. If the unit halts, come back here and I can help.

regards,
Mark

[Staffan321]

Hello Mark,

Ok, many thanks!
When you say replace battery, I guess you’re not referring to the BBRAM internal, but the external one? Would that support also the BBRAM?

I’m between a rock and a hard place - although soft version so far. The machine is functional, but I just don’t want to see it die ... and I definitely don’t want to brick it!

Regards,
 Staffan

[mbielman]

The MS462x motherboards have 2 batteries as I recall. The coin cell is for your calibrations and other "user" data. You can easily back that up. The "BBRAM" holds the CPU settings and if you lose that, the unit is indeed bricked. It has the piggyback battery on the RTC/RAM chip. (usually yellow) Pop it off with a screw driver and press in a new one.

Mark

[Staffan321]

Hi Mark,

The BBRAM is a black box (M48T08-150CPI). Possibly there is something that can be pulled, but not sure. In the service instruction it looks more like you need to pull the complete IC...
Time to start worrying?

Regards,
 Staffan

[mbielman]

Hi Staffan,

That's a different situation... and apparently a different CPU board. I'm surprised that IC is not in a socket. What were they thinking!!!

Well hold on. Looked at the data sheet... if it's a DIP package you have a problem. BUT the SOIC version has the snap-on "top hat" battery:
(cannot insert pix so look here: https://www.mouser.com/datasheet/2/389/m48t08-955049.pdf)

Can you tell???

Mark

[Staffan321]

Hi Mark,

Yes, I know of the snap on battery. Keeping my fingers seriously crossed for that, but not sure. I will have to open the VNA to check. I have a picture, but can’t tell from that. This seems to be Motorola decision, by the look of their board, by the way. ... but yes, what were they thinking?
Nevertheless, I would so much like to download the content of the BBRAM so that I stand a decent chance of restoring the machine, should anything go wrong. I read in this thread about using a debugger and a serial port, but don’t see how that can be done. The cpu is a MVME162 so there should be software around or even better, installed.
There is no serial port on the vna so is there one on the cpu?
Just don’t understand if a broken BBRAM will cause the board to brick itself even more or if it’s possible to get it running again with an OK BBRAM?
I read also about boot code. Is there a special disk supplied with the MS462? The 37247 doesn’t seem to have anything like that. Would very much like to get hold of the boot FW inside the VNA to examine. Is this on a regular eprom somewhere? Likely not a dip? Would like to get that to perhaps examine. Notice the thorough work by djac and would like to give it a second shot.

Many questions. Perhaps several are obvious, but I have never had to deal with this before (although heard about it and - so far - happily realized it doesn’t concern me - so far that is...).

Regards,
 Staffan

[mbielman]

Hi Staffan,

Is this your board, or close to it?
https://upload.wikimedia.org/wikipedia/commons/e/e6/Motorola_MVME162-023.jpg

The BBRAM in the pix appears to be the DIP package. I do not understand the thinking behind that, unless it's in a socket. Guaranteed to fail at some point.
Then Anritsu can charge you big $$ to fix it! Appalling!!! 

If yours is indeed a DIP and not in a socket, removing it and reading the contents may be your best option, ugly as that sounds. You might try the user manual for that board.
Perhaps there's a way to use a monitor program and read memory locations. (?)

In my case, I tried EVERYTHING but the board just would not boot. I eventually paid $400 for a special BOOT ROM that did not require the BBRAM to be valid.
Seems I had no other choice. But that allowed the CPU to boot and then you could alter the BBRAM contents via RS232 to what it needed (DRAM size and other stuff)
and then you reinstall the normal BOOT ROM, load the system disks to the "HDD" (really in RAM) and away you go.

No idea if that ROM would even work on your CPU board... mine is different, but also a Motorola.

I shake my fist at Anritsu!

regards,
Mark

[mbielman]

Take a look at this: https://prep.fnal.gov/catalog/hardware_info/motorola/mvme162_user_manual.pdf
I saw the BBRAM address locations listed here and perhaps there's a way to read it.

Mark

[Staffan321]

Hi Mark,

That’s exactly my board. Is that the same you have?
I agree with your thoughts about Wiltron in this case. Motorola made the board, but why choose this solution in a machine where the RF/IF hardware likely is substantially more valuable?
I’m thinking there may be other roms than just the one I have. Would love to find one where I can just reach the BBRAM. Guess there should be a default SW from Motorola, but where?
Given that it is a basic VME board, probably also disk and floppy are compatible so it should be possible to run something plain vanilla.

I see discussions in this thread about a debugger and a monitor. Do you know how this was done? Does your instrument have an RS232 somewhere?

Regards,
 Staffan

[mbielman]

Hi Staffan,

The Scorpion VNAs (MS462X) use this one: Motorola MVME162LX
It has a serial port and that is how the MONitor program communicates with the outside world (to a PC running a terminal emulator).
You can then view/modify the BBRAM.

I think all of these programs are on this thread somewhere. I can post them (I think) if you cannot find them BUT no clue if they would work on your system.

When the Scorpion VNA boots, it has a menu that if you (very quickly!) press the 1 key (as I recall) you can start the monitor/debugger which opens the serial port.

Maybe on your system you connect through a LAN or USB port??? No idea.

I just did a Google search and get all kinds of hits for these CPU boards.
I do NOT see (yet) any software downloads.

Mark

[Staffan321]

Hi Mark,

OK, it seems we're using the same board in that case.
During boot, only message is to "Press any key to start the format hard disk". There is no serial port either on the VNA itself, does the Scorpion have that?
There is an opening on the back (now covered with a plate) that looks like for a D-SUB. Maybe a feature not installed? On your machine, is the serial port by any chance connected to the CPU board directly? Perhaps more likely going through the mother board I guess.
I have downloaded all software from this thread. There are however a couple of documents about MVME162, mentioned by Dieter, that I couldn't get hold of. If you have those, it would be great.
No clue what would happen if I just inserted a boot disk and ran. What I have done previously is updating the app - four discs are read consecutively - no clue if it just reads and puts somewhere on the disk, but wouldn't like to scrap the HD with the wrong data...

Many thanks for all help - very much appreciated! Will look for more info on the MVME162. Plan for the weekend is to at least measure all control signals to the RF hardware - in case the machine would decide to give up on me...

Regards,
   Staffan

[Staffan321]

Hi,

One more question. I realize there is actually flash memory on the CPU board. No clue why that isn't used for the config, but anyways. Earlier in the thread it seems like the cold start process checks the BBRAM and if it is corrupt _invalidates_ the flash. Does this mean it actually zaps it or at least renders it unusable? Or is it just that it won't rely on that for the current start?
Basically, if the BBRAM fails once, is the board really bricked until a new eprom with other code is inserted?

Regards,
  Staffan

[mbielman]

Hi Staffan,

Yes, mine has a serial port on the back, along with many others. See attached photo. And yeah there is a small interface board connected to the motherboard that has all of this.

I have a BOOT disk, a MONitor disk, and the application disks (2 of them). It's been so long ago that I went through this but I do have instructions somewhere. I think I ran BOOT,
selected LOAD MONITOR and I think it asks for the floppy. A bit fuzzy on that. Once you are in the monitor (debug) program, you can examine/modify the BBRAM.

Good luck!

Mark

[mbielman]

" _invalidates_ the flash"

Yes, I saw that too and believe that is the case. The flash is called the "Hard Disk Drive" in the VNA and stores calibrations and such. Not required for boot up.

Mark

[Staffan321]

Hi,

Great, thanks! OK, you're better off when it comes to connecting then. I don't seem to have anything (definitely not USB :-)

Good to hear that 'only' calibrations are lost. I should have all of that on a floppy (several actually).

If you think your boot files may differ from what is already posted here, it would be really appreciated if you could make them available.

Many thanks and regards,
  Staffan

[Staffan321]

Minor update.

I guess it's 1-0 to Wiltron/Motorola for -reasonable- serviceability. The BBRAM is still the one with a fixed battery, but you can actually pull the whole module out. I attach a close up of the board. It's sitting on a socket - phew.

Now comes the question that is closing in to to being stupid: what are the risks of pulling it out?

I right now have a working VNA.

If I pull the BBRAM out and, for some reason I should have known about, kill or zap it in the process, I would not be happy...

On the other hand, soon enough the board will probably die anyways...

... not my favourite situation.

Any suggestions or comments would of course be very much appreciated.

Regards,
  Staffan

[Staffan321]

Hello,

OK, so I pulled the BBRAM out and read it with my programmer. Attaching binary and an ascii version. The VNA still boots so now I'm a lot more relaxed and much happier :-)
Don't think my programmer is able to program the BBRAM unfortunately. It's an LT866CS, anyone knows a suitable programmer or a working EPROM equivalent, that would be very good to know.

Time to buy a BBRAM replacement...

Regards,
  Staffan

[mbielman]

Excellent!

I have the same programmer and could not find this part either. Hmm. Did you read it as a "generic" 8kX8 SRAM?
You could experiment with a new IC as a 5V EEPROM (8kX8) like an Atmel perhaps.

At least you have the contents and your instrument is OK!

Mark

[Staffan321]

Hello,

Yep, this lifted a couple of stones...

I actually read it as a 27C128, i.e., a 8x16k EPROM in order to get the second CE-pin enabled (being address bit 13 on the 27C128, but NC on the 27C64 type). Also insulated pin 1 since this is an output on the M48T08 (albeit open drain) and an input on the EPROM.
I'm thinking about replacing the MT48 with an EPROM altogether. If I really need to recalibrate the machine, I can insert a new MT48 at that time and download.
If it turns out that the memory space just below (Address bit 13 equals 0) is unused by the MVME 162 board, I can just use a real 27C128. This requires however that nothing is trying to output to the data bus in this address space since there otherwise will be a memory collision. Possibly, one could hard wire another pin on the EPROM in a clever way and get the same function (three state when Address bit 13 is zero).

Looking at the board, I can't really figure out which chip is the EPROM - seems to be no DIP sockets so form factor is different. Is it the one next to the battery?

Regards,
  Staffan

 

[mbielman]

"I'm thinking about replacing the MT48 with an EPROM ..."

I would NOT do that! The MT48 is also the RTC in the unit and if that were missing, you would probably have all kinds of problems.

"Is it the one next to the battery? "

Yes. With the sticker on it. That's no doubt the boot rom. No need to touch it unless you want the contents for safe keeping.

If it were me, I would pick up a new MT48 and experiment with the programmer. I use the Atmel 8kx8 eeproms all the time. It "looks" like an SRAM to the system (except for the slow write cycle).

mark

[Staffan321]

Hi,

Do you think the OS is depending on a real time clock? I was hoping it would just be used as reference when booting. I have no problem with all my graphs being dated 1900-01-01...
On the other hand I might as well get hold of another BBRAM and start experimenting a bit. Do you know of anything having the same programming voltages?
The ROM would be for reference, but also for trying to figure out what is done in the boot process. I guess there will be a couple of sequences where the code accesses an array in the BBRAM and then ends up reading a final byte somewhere... That should provide some nice info on what is really important on the BBRAM...

Regards,
  Staffan

[Staffan321]

Oh happy day!

I just tested my newly programmed BBRAM and it seems to be working :-)

Just a short summary for anyone interested:

Programmer: TL866CS using Minipro 6.50

BBRAM M48T08-150CPI is pin compatible with EEPROM AT28C64 _except_
•   Pin 26 is NC on AT28C64 (should be pulled high during read/write M48T08, use a jumper form VCC)
•   Pin 1 is NC on AT28C64, should be insulated (use some kapton tape) on M48T08 when using in programmer
•   IMPORTANT: AT28C64 allows +12V (BEYOND DAMAGE on M48T08) on OE and A9 (Pin 22 and Pin 24) during Chip identification and Erase. DO NOT REQUEST ID nor ERASE using programming!!!

To program M48, data in 0000-01FF7 is like RAM and immediately programmed. Notice that reading may go wrong from time to time and render FF FF FF…, but just re-read once more and it should be fine.

The final 1FF8-1FFF are special and needs attention. To write data, bit 7 in 1FF8 needs to be set high. Fortunately, the programmer will reach this byte first and thus (if bit 7 is set to high), the following bytes will be written. Thereafter, need to set bit 7 low in order not to lock the clock from updating the memory addresses.
One can play with the Read bit (bit 6) also, but seems not so important.

That should be it – good luck!

Don’t forget to remove the kapton tape on pin 1 before inserting in MVME162  :-)

Regards,
  Staffan

PS. For once I did not buy on ebay - battery lifetime on those units are likely shorter than what you get from a unit bought on Mouser or Digikey...