ANRITSU instrument boot up failed discuss(MS462X VNA)?

[mrf245]

Hi, I'm interesting in some old ANRITSU instruments system boot up failed (like MS462X series, I guess someone know that).
I got MS4623B from old factory, surely it can't boot up now. When power up, only fan is running but no display, no any light and any other response.
Tested all votage is OK, some people said check if BBRAM (M48T18) fault. BBRAM is SRAM with external battery and clock crystal, this BBRAM only 8KB but contain some system boot up information, if battery run out, data will lose result in boot up failed.
When system booting, before display show system information, BOOTLOADER chenking BBRAM data first, if error then will stop boot sequence.
I checked battery that is totally run out. BBRAM datasheet shows battery life is almost 10 years. no one know how long this 4623 stayed without running.
I guess that some other ANRITSU machines will use same method (bootloader+BBRAM or NVRAM), data in BBRAM was writing after whole machine assembled. New machine or repair, re-write data or file to BBRAM, it will running again.
Or make some setting access from ports (serial, JTAG,debug port,etc...), system will create proper data or file in BBRAM and running again (just like some TEK oscilloscope).
Anyone know how that work or any suggestion? Thanks very much.

[precaud]

Do you have access to a manual? Many instruments have a "cold boot" or "reset" function which writes default values into the RAM before starting up, actuated by holding down some key while powering up.

[imett]

i've the same problem, i could provide a memory dump of another instrument  but in my instrument doens't work.
nothing the instrument is halted.
Another way could buy from an ebayer a special patched flash that may work but he want 500$...

[mrf245]

i've the same problem, i could provide a memory dump of another instrument  but in my instrument doens't work.
nothing the instrument is halted.
Another way could buy from an ebayer a special patched flash that may work but he want 500$...

Hello imett, if you can sure your memory dump file is OK in new chips but your 4623 still doesn't work, check if any access signal feeding into M48T18 CE pin, ensure boot-loader running fine so program can check M48T18.
Ebayer a special patched flash I guess it bypass checking M48T18 process, but how to solve cal-data problem I don't know...

[mrf245]

Do you have access to a manual? Many instruments have a "cold boot" or "reset" function which writes default values into the RAM before starting up, actuated by holding down some key while powering up.

Thanks, in service manual it only remind that "maybe U74 (M48T18) data lost" and "replace main processor board" but nothing detail about how to fix it.
I also guess it has special service menu when boot, should press some keys when power-up, or adjust switch in processor board, no manual mention it.

[bongo92]

i've the same problem, i could provide a memory dump of another instrument  but in my instrument doens't work.
nothing the instrument is halted.
Another way could buy from an ebayer a special patched flash that may work but he want 500$...

Hello,

I have the same problem with an Anritsu MS4623b which doesn´t boot. I´m actually trying to write an special EPROM Image to fix this problem. Could you provide the Memory dump of the other Instrument? In return I would provide the EPROM content.

Best Regards
Max

[imett]

here the memory dump of working instrument done with ftp (??), i've make a copy in bin format (i done this copy manually, row by row, please check if is correct) but in my case doesn't work. i've also a patched  fw which disable some memory option but this also doesn't work for me..
maybe you are more lucky than me 

[Armadillo]

Are there any encryption byte or CRC byte associated with those data?
With ambient noise and environmental electrical spikes transients, if I am the programmer, I will always program verify the EEPROM  bytes fetched before executing it.
But maybe can get lucky with older machines plain vanilla coding, don't know.

[imett]

i don't know about crc or encryption , the only things that i know are that the last info of the battery ram  are the date (..obviuos the chip is a rtc) and the main board are very similar to a famous evaluation /development board with the same uP..(now i don't remember the name..)
An user told me that the info inside the battery ram are important because they are about the memory size.. like 16 is 16MByte of ram ecc 

FFFC1F30  04 08 AA AA AA AA 31 36  32 30 34 38 30 31 32 38  ......1620480128
FFFC1F40  30 32 30 32

[imett]

the uP is a mc68020? the evaluation board could be motorola VME 135-1? .. now i don't have the instrument on my hand

[djac]

I have the same problem with the MS4622B. But my device was not completely dead from the beginning.

In the first step the bootloader started normally. It tried to load the application program from the floppy first, then from the internal hard disk and then successfully from NVRAM. Then he started the application program with the corresponding message.

But then nothing happened anymore. First I thought that the program image was defective and started the internal debugger of the bootloader (after power on press "1"). With the help of this debugger I was able to reload the application program from diskette into NVRAM. But there was no change.

Since the behavior corresponded exactly to what happens when you enter a non-existent Internet address as default gateway when configuring the Ethernet interface (software bug documented by Anritsu), I suspected that some bits in the BBRam, which I assume will store this configuration, might have tilted.

So I measured the voltage of the BBRam's battery without removing it from the BBRam and see, the voltage was only about 500mV.

When I then restarted the device, it remained completely inactive as in the cases described here (keyboard LEDs all on). I don't know how you can discharge a battery with a voltmeter with 10Megohm internal resistance, but obviously this was the case. The battery can't have been lifted by the probes either, because it's clipped firmly onto the ram.

If it turns out that the internet addresses are stored in the BBRam and the bits are tilted, then this would mean that the bootloader does not check the integrity of the BBRam's data via a checksum, but via a magic number. At least a program cannot read the battery voltage according to the data sheet of the BBRam.

The next question is, what is stored in the BBRam at all? Because the calibration routines mentioned in the manual, such as the user calibration, the ALC calibration and the receiver calibration, are stored in files on the internal hard disk. Only the DAC value for setting the 10MHz fundamental frequency is stored there according to the manual.

Thus, basic data seems to be stored there, such as other DAC values or also e.g. the activation of options as well as the address of the GPIB interface etc..

I suppose, therefore, that the whole device will be adjusted after a data loss as well as after production. This will probably be done by a program, which Anritsu owns for this purpose, but probably did not make available to the public.

Possibly this program is on the boot utility disk that comes with every device. Unfortunately I don't have it and I don't know any documentation about it.

Anyway, it's not enough to patch the bootloader so that it doesn't test the BBRam, although that would be very helpful, because you can run any program that the bootloader finds under A:\SYSTEM\APP.

Is there anyone here who has ever contacted Anritsu about this issue?

Greetings Dieter

[imett]

i've this boot utilities maybe could help you.
matteo

[imett]

here another info about memory mapping

[djac]

Hi matteo,

thank you for that. Do you know any documentation about the utility disk?

Regards Dieter

[imett]

on the maintenance manual are used two floppy utilities disk,one for boot and one for calibration..this is used for boot the instrument and launch boot apps i think

[imett]

i found iny files this patched boot disk.. sorry i don't rememberw why is patched

[djac]

I have now contacted anritsu. The first answer is not very hopefully:

Hello Dieter,
Thank you for contacting Anritsu EMEA region customer technical support.
Would you like us to quote for sending the MS4622B VNA CPU board to our factory in the US for repair?
This is the only option available for replacing & programming the BBRAM due to the age of the instrument (manufactured 2002).

Best regards \ Mfg
XXX

I answered:

Hallo XXX,

I suppose that the costs for a repair in US would be far to high for such an old device. But please do so.

On the other hand I can do it by myself, if I get some information:

I have disassembled the boot eprom and know the locations where it tests the BBRam for integrity. To change the code would not be complicated.
The problem is the contents of the BBRam. Best would be to get a documentation what it should contain. But it would help to get an binary image from the BBRam of a correctly running MS462x or the default image what your engineers use, if they repair the device.

What I do not understand is, why there is in the service manual no procedure given to solve this problem. The only thing that is defective is the battery, clipped on the BBRam-Chip, that costs 5$. And the battery has a life time of 10 years, means beyond the usual life time of the device.

I cannot imagine, that Anritsu expects that their customers should send their analyzer every 10 years to the us-factory only for changing a battery. The restoring of the contents is just software, that any customer can do by itself, if he gets the appropriate information and tools.

I would be not very lucky to throw away a well running analyzer only because a battery has reached the end of it's life time.

Regards Dieter Jaeger


Let's see if they are willing to give real service to it's customers.

Regards Dieter

[mrf245]

Hello all, very long time no see this post.
After copied U74 file from another analyzer, the analyzer boot normally, but it lost all source CAL data, so after made this replacement, it should make source level calibration. After it be done,everything will be OK.

[mrf245]

here another info about memory mapping

Hello imett,
Where did you find this mapping files? It loos like from service manual (but I have not found this in official service manual)?

[mrf245]

I have the same problem with the MS4622B. But my device was not completely dead from the beginning.

In the first step the bootloader started normally. It tried to load the application program from the floppy first, then from the internal hard disk and then successfully from NVRAM. Then he started the application program with the corresponding message.

But then nothing happened anymore. First I thought that the program image was defective and started the internal debugger of the bootloader (after power on press "1"). With the help of this debugger I was able to reload the application program from diskette into NVRAM. But there was no change.

Since the behavior corresponded exactly to what happens when you enter a non-existent Internet address as default gateway when configuring the Ethernet interface (software bug documented by Anritsu), I suspected that some bits in the BBRam, which I assume will store this configuration, might have tilted.

So I measured the voltage of the BBRam's battery without removing it from the BBRam and see, the voltage was only about 500mV.

When I then restarted the device, it remained completely inactive as in the cases described here (keyboard LEDs all on). I don't know how you can discharge a battery with a voltmeter with 10Megohm internal resistance, but obviously this was the case. The battery can't have been lifted by the probes either, because it's clipped firmly onto the ram.

If it turns out that the internet addresses are stored in the BBRam and the bits are tilted, then this would mean that the bootloader does not check the integrity of the BBRam's data via a checksum, but via a magic number. At least a program cannot read the battery voltage according to the data sheet of the BBRam.

The next question is, what is stored in the BBRam at all? Because the calibration routines mentioned in the manual, such as the user calibration, the ALC calibration and the receiver calibration, are stored in files on the internal hard disk. Only the DAC value for setting the 10MHz fundamental frequency is stored there according to the manual.

Thus, basic data seems to be stored there, such as other DAC values or also e.g. the activation of options as well as the address of the GPIB interface etc..

I suppose, therefore, that the whole device will be adjusted after a data loss as well as after production. This will probably be done by a program, which Anritsu owns for this purpose, but probably did not make available to the public.

Possibly this program is on the boot utility disk that comes with every device. Unfortunately I don't have it and I don't know any documentation about it.

Anyway, it's not enough to patch the bootloader so that it doesn't test the BBRam, although that would be very helpful, because you can run any program that the bootloader finds under A:\SYSTEM\APP.

Is there anyone here who has ever contacted Anritsu about this issue?

Greetings Dieter

Hello Dieter,
At least I know BBRAM contain ALC CAL data.
You were so lucky to find MAC error in BBRAM, to see debugger data is very good idea.

Do you know what others can debugger and monitor do (when analyzer turn on, press 1 and select 6 or 7)?

Now my analyzer has another strange problem:

After start application, it running normally,but after several minutes, it shows "vector XX, address error",or other similar errors; Measuring graphs looks like very strange; After several seconds no response at all. It should cycle power, and error comes again.

Sometimes analyzer will no report errors, just died at all.

To check this errors, we run DRAM and other RAM test (except FLASH and NVRAM test), DRAM test no response, others were OK.

We also tried replace DSP SRAM and main DRAM 16MB on board, but no work at all.

Now analyzer start app failed, stop at "starting system......"

I don't know if there is any method to monitor the background messages (maybe it can report RAM failed or other error details), it can very help for our diagnose.

[djac]

Hello, mrf245,

as an attachment a comment from me to the BIN-File of the BBRam of Matteo (imett). I have examined the code of the patched Matteo boot eprom to determine what the BBRam contains. Or rather, which parts are relevant to the boot-prom code. Maybe this will help you.

The errors of the application program can be resulting errors of the wrong content of the BBRam, which also contains data that is important for the application program.

The data in the ALC table could range from 0xFFFC0418 to 0xFFFC0177 and contain floating point numbers. However, there are a few other data.

Have you ever performed an ALC-Cal? Have you corrected the 10MHz frequency via the service menu? Afterwards you can see which locations in BBRam are altered.

Greetings Dieter

[mrf245]

Hello, mrf245,

as an attachment a comment from me to the BIN-File of the BBRam of Matteo (imett). I have examined the code of the patched Matteo boot eprom to determine what the BBRam contains. Or rather, which parts are relevant to the boot-prom code. Maybe this will help you.

The errors of the application program can be resulting errors of the wrong content of the BBRam, which also contains data that is important for the application program.

The data in the ALC table could range from 0xFFFC0418 to 0xFFFC0177 and contain floating point numbers. However, there are a few other data.

Have you ever performed an ALC-Cal? Have you corrected the 10MHz frequency via the service menu? Afterwards you can see which locations in BBRam are altered.

Greetings Dieter

Thank you very much Dieter
I also consider about BBRAM data maybe not suitable for this machine.

We have done perform ALC-CAL due to APP indicated "ALC-CAL-FAILED", succeeded. But 10MHz FREQ correct we have no executed yet.

This error 4622 has a different from other good analyzers (see attach below).

There is a DRAM expend card on mainboard, 48MB. If remove this expend card, analyzer will not run into APP and stay at "APP load failed".

I have not see any memory size set when boot and in application.

This expend card move to other good analyzers which no need this card, it still run perfectly.

My friend has replaced all 8 pieces of DRAM on mainboard to new (I'm not sure its SUPERIA) and nothing changed.

If BBRAM contains system configurations, I guess it will include whether analyzer need extend memory card or not.

But how to set it?

Or set in "DEBUG mode"?

[djac]

Have a look to the 2 Bytes at 0xFFFC1F36 in BBRam. There must be the right value of the memory size in megabytes. The value is ascii coded. This means for an analyzer without a memory expansion card, 16 megabytes. So the two bytes have to be 0x31(0xFFFC1F36 and 0x36(0xFFFC1F37).
BEFORE you change the memory, set the appropriate value in BBRam with the debugger, power down, put the the expansion card in or out, and then power on. According to code in boot eprom, that should work.
Regards Dieter

[mrf245]

Have a look to the 2 Bytes at 0xFFFC1F36 in BBRam. There must be the right value of the memory size in megabytes. The value is ascii coded. This means for an analyzer without a memory expansion card, 16 megabytes. So the two bytes have to be 0x31(0xFFFC1F36 and 0x36(0xFFFC1F37).
BEFORE you change the memory, set the appropriate value in BBRam with the debugger, power down, put the the expansion card in or out, and then power on. According to code in boot eprom, that should work.
Regards Dieter

OK, looks like debugger is very useful for set analyzer boot parameters, also very important  for app running.
So I need connect UART to PC, in hyperterminal, set 9600 8 N 1, and is there any manual or commands to let me know how to use that? Many thanks.

[djac]

No, I do not know the debugger, and currently my  device is dead, so that I can't try it.

Regards Dieter