Anritsu MS2721B internal CF card missing

[analogRF]

I've got a MS2721B which doesn't boot and the internal CF card has been taken out before they got rid of the instrument.
There are minor damages inside all fixable but I need to restore the OS before attempting anything.

Does anyone know how I can make the firmware CF card for this unit? I could not find a disk image

I downloaded the firmware and unzipped it on a USB flash ready for "firmware upgrade"
The whole file system of the OS seems to be already in there. Is it possible to just copy the firmware file structure
to a CF card and put it in? How should I format the CF card?

I asked Anritsu tech support and as usual they are of no help, saying (1) go read the maintenance manual! (2) The whole CPU board of the unit must be replaced so send it to us!

any help is appreciated.

[Stray Electron]

  is there any chance of getting the seller to send you the CF card if you offer him a ridiculous price for it?  I have two Anristsu SAs (older models) and I like them but there is ZERO support for them. 

[DaJMasta]

Have your tried just updating the OS with a blank CF card installed?  The updater on later models, at least, will load before the instrument fully boots if the USB stick is in at power on.  There's also an alternate firmware loading mode (not sure if it normally resides on the flash, though) that's accessible from startup with a button sequence, though again I don't know whether this applies to B models.


In any case, it could be worth contacting Anritsu support.  They've been helpful to me a couple of times (replacing a tilting bail and downgrading a firmware update that caused issues), so while they may just say "send it in for service" they also may be able to help you out.

[analogRF]

Have your tried just updating the OS with a blank CF card installed?  The updater on later models, at least, will load before the instrument fully boots if the USB stick is in at power on.  There's also an alternate firmware loading mode (not sure if it normally resides on the flash, though) that's accessible from startup with a button sequence, though again I don't know whether this applies to B models.


In any case, it could be worth contacting Anritsu support.  They've been helpful to me a couple of times (replacing a tilting bail and downgrading a firmware update that caused issues), so while they may just say "send it in for service" they also may be able to help you out.

as I already mentioned, I have contacted anritsu. they have never been of any kind of help to me in several cases including this one.
They simply said the whole board must be replaced

anyways, the instrument seems to be a decommissioned unit from a government agency and the seller I got it from had bought a bunch of these in a government auction and they all had their CF card removed. It even has a sticker showing when and by whom was the CF card removed 

yes, there is an emergency repair procedure in the manual when you need to hold softkeys #1,3,5 and power it on with a firmware USB in the unit.
but it didn't work with a blank CF card. Well I had it formatted (FAT32) maybe I shouldn;t have or it is just for recovering a corrupt OS not a fresh install...

Shahriar has a video on of these and the CF card in his unit was also cut out and he simply says he downloaded the firmware and made a CF card for the unit and he puts back in and it works. I have asked him how exactly he did it but he has never answered any of my questions in the past.

I think I am gonna just dump the unpacked firmware on the CF card and see how it goes. In the mean time I have damaged the CF card (another long story) so I need to buy another one first. The file structure of the unpacked firmware on USB stick seems like an image of a working OS...

[Thedon]

I own a MS22723B which I purchased a couple of years ago and was going to do a tear down and review but forgot to. I ended up taking it apart to replace the screen protector as the original was scratched and yellow I have attached photos. Maybe somebody can compare lower spec models with mine to see if there are any hardware differences. AnalogRF I don't understand why Anritsu informed you that the main PCB needs changing as the service manual lists the 512MB internal flash card as a replaceable part (3-2000-1567). If it helps I'm willing to take apart my unit again and have a look what's on my flash card maybe there are files on there with model and serial numbers which are scanned during boot up I don't know I always thought the card was for storing calibration data any way let me know if I can help.

[Thedon]

Here are some more photos including the old screen protector which is yellow and the new one which is nice and clear.

[analogRF]

I own a MS22723B which I purchased a couple of years ago and was going to do a tear down and review but forgot to. I ended up taking it apart to replace the screen protector as the original was scratched and yellow I have attached photos. Maybe somebody can compare lower spec models with mine to see if there are any hardware differences. AnalogRF I don't understand why Anritsu informed you that the main PCB needs changing as the service manual lists the 512MB internal flash card as a replaceable part (3-2000-1567). If it helps I'm willing to take apart my unit again and have a look what's on my flash card maybe there are files on there with model and serial numbers which are scanned during boot up I don't know I always thought the card was for storing calibration data any way let me know if I can help.

Thanks, Thedon. Nice instrument. The board looks very much like mine except that I don't have the flash card 
here is what exactly Anritsu "support engineer" wrote to me: "This internal compact flash is not sold separately and a new Main/SPA PCB would need to be ordered to get a new one of these." Sounds ridiculous but that's how Anritsu is.

The calibration data and system settings are stored in the EEPROM on the board not in the CF card. CF card only holds the OS and user data, traces, etc...

Anyways, I checked their website and it seems your fiirmware must be different than my instrument, so its image will not help me. However, if you
are willing to open it up again, I would very much appreciate if you can send me a copy of the firmware (OS)  files/directories. I want to compare it with what is unpacked on the USB flash and if the structure is exactly the same, I guess it would be safe to say that the firmware update just copies the files from USB to the CF card, so I can make the CF card myself. I also need to know how the CF card is formatted.

by the way, where did you get the screen protector? from Anritsu directly?

[Thedon]

Sounds like you did your homework that response from Anritsu makes no sense unless they want to install the firmware themselves maybe they don't trust their customers but we know what's the real reason. OK I will take it apart and copy the contents of the card and yes the screen protector was obtained from Anritsu but it came at a cost $170.45 for a piece of plastic I couldn't see any inbuilt RF shielding.

[brainstorm]

I purchased the same unit over ebay a while ago and also had the internal CF missing (with slightly broken holder as if it was removed by force). I wrote up my experience trying to boot it up with a firmware update image (with limited yet encouraging success) over here:

https://blogs.nopcode.org/brainstorm/anritsu-ms2721b-spectrum-analyzer/

TL;DR: I managed to dump the uncompressed memory contents to poke around with a few of the VxWorks functions to diagnose the underlying problem(s).

I think it would be of very high value (to me, perhaps others), if some of you owning the instrument could:

1. Connect it via ethernet to your home router or equivalent and power it up.
2. Telnet into it via the DHCP-assigned IP address.
3. Run a few of the commands outlined in the blogpost and paste the output back over here.

I'm specially interested on the VxWorks shell commands: DoRAMTest, sysSelfTest, sysOptionUpgrade and dumpEEPROM... to start with

You can either run the python script published on my blog to retrieve a ton of callable-from-the-VxWorks-shell functions and offsets or ask me about the .csv if you are interested.

/cc @Thedon, from your photos, you seem to have a fancy version of the unit with GPSDO and extra RAM daughter board? Interesting!

Cheers!

[brainstorm]

Here's a followup on my repair efforts if somebody is interested:

https://www.reddit.com/r/ReverseEngineering/comments/g0g8w2/vxhuntervxworksradare2_a_spectrum_analyzer_repair/

... r2/ghidra give quite a bit of insight on how to repair the boot process on my instrument (i.e when the CF card is "not good"), hope it helps someone else in my situation!

[thm_w]

Here's a followup on my repair efforts if somebody is interested:

https://blogs.nopcode.org/brainstorm/anritsu-ms2721b-spectrum-analyzer-repair-part-2/

... r2/ghidra give quite a bit of insight on how to repair the boot process on my instrument (i.e when the CF card is "not good"), hope it helps someone else in my situation!

Thanks for writing out all of this information.

[analogRF]

I purchased the same unit over ebay a while ago and also had the internal CF missing (with slightly broken holder as if it was removed by force). I wrote up my experience trying to boot it up with a firmware update image (with limited yet encouraging success) over here:

https://blogs.nopcode.org/brainstorm/anritsu-ms2721b-spectrum-analyzer/

TL;DR: I managed to dump the uncompressed memory contents to poke around with a few of the VxWorks functions to diagnose the underlying problem(s).

I think it would be of very high value (to me, perhaps others), if some of you owning the instrument could:

1. Connect it via ethernet to your home router or equivalent and power it up.
2. Telnet into it via the DHCP-assigned IP address.
3. Run a few of the commands outlined in the blogpost and paste the output back over here.

I'm specially interested on the VxWorks shell commands: DoRAMTest, sysSelfTest, sysOptionUpgrade and dumpEEPROM... to start with

You can either run the python script published on my blog to retrieve a ton of callable-from-the-VxWorks-shell functions and offsets or ask me about the .csv if you are interested.

/cc @Thedon, from your photos, you seem to have a fancy version of the unit with GPSDO and extra RAM daughter board? Interesting!

Cheers!

have you had any success yet? I have read your blog and it seems you are still stuck as I am 
I can only think of two possible causes, one is a hardware problem like a bad RAM or other chip and another is a corrupted flash rom or eeprom
on the board. For instance when I turn it on, it shows OS Build 2.04 while I am putting OS 3.78 on the CF card. I think during update, it loads the OS into a flash rom or something and I am guessing that mine is corrupted perhaps due to a failed update?

the two biggest problems that I have (aside from the unit not booting!) is that first of all when I get to the bootstrap mode (emergency recovery) I cannot update the OS from USB  the USB stick is in there but no matter what, when I select Update OS from USB, it does not do anything. I used 4 different USB sticks

the second problem is with the ethernet connection. if I connect to my router and turn it on, it never shows up on my network. If I go to recovery mode and manually force it to get IP address, then it does get IP and I can ping it but I cannot telnet to it and the Master Software on my laptop cannot recognize it. Any idea? any suggestion?

[analogRF]

Here's a followup on my repair efforts if somebody is interested:

https://www.reddit.com/r/ReverseEngineering/comments/g0g8w2/vxhuntervxworksradare2_a_spectrum_analyzer_repair/

... r2/ghidra give quite a bit of insight on how to repair the boot process on my instrument (i.e when the CF card is "not good"), hope it helps someone else in my situation!

it seems my instrument is stuck at about the same point as yours but how come you can telnet to it so easily? Mine does not even show up on the network and only if I go to the recovery mode I can force it to get IP and even then, still telnet does not do anything. when I telnet, it clears the terminal screen and that's it...nothing else shows up on terminal

[analogRF]

I finally got the god damn thing fixed 
Here is what you should do
1-install the Anritsu Master Software Tool (MST)
2-go to Product Update and download (retrieve) the firmware file inside the MST so it is ready
there you will see a button "Emergency Repair", click on that and it will explain what to do but I will tell you
3-connect the instrument to ethernet and turn it on in Recovery mode (hold softkeys #1-3-5 and power on)
when you are in the Bootstrap mode, choose Update OS using Ethernet and it will change to a blank screen with
one red statment saying it is waiting for Ethernet downloading connection...
4- in the MST enter the IP address of the instrument and click on Install New OS Now. and then just sit back and DO NOT TOUCH anything
no matter how everything seems weird or dead. (the message on the instrument screen will not change until much later) but it is actually
accepting the new OS from your computer
5-after quite a while the instrument will flash a new message saying the transfer is complete and it starts programming the ROMs on the instrument with new OS and it will finally go back to the first bootstrap screen
6- reboot the system and enjoy 

However, the only problem that I have right now is that the tracking generator option is nowhere to be seen 
my instrument passes all self tests and works perfectly but the tracking gen is not anywhere...

hope you can find a way to bring that back 

[analogRF]

brainstorm,
can you find a way to dump the eeprom? I am sure all options as well as cal data and serial number are stored in there
I tried your dumpEEPROM command but it didnt work although it seems it was recognized by the OS but didnt dump the EEPROM

[brainstorm]

Awesome news, I'm so happy for you @AnalogRF!

My instrument needs review on the power rails/capacitors, it was a bit finicky on power-on before and now it doesn't even turn on, just flickers. I tried the MST software before but couldn't get a connection so no firmware update was possible, I'll take your advice into account when the hardware side is back in good health

So unfortunately I cannot dump the EEPROM... yet. If you are based in Melbourne we can meet and exchange notes perhaps? Happy to!

[analogRF]

Awesome news, I'm so happy for you @AnalogRF!

My instrument needs review on the power rails/capacitors, it was a bit finicky on power-on before and now it doesn't even turn on, just flickers. I tried the MST software before but couldn't get a connection so no firmware update was possible, I'll take your advice into account when the hardware side is back in good health

So unfortunately I cannot dump the EEPROM... yet. If you are based in Melbourne we can meet and exchange notes perhaps? Happy to!

no, ignore when MST says cannot connect to the instrument! Mine said that too. Ignore that. That type of connection can only be established when the instrument is up and running.
But when you go to the emergency repair and select Install New OS then IT WILL CONNECT to the instrument although it does not say it explicitly.
I guess it must be a sort of ftp connection but FIRST you must put the device in the firmware downloading state as I explained.
You will not see anything happening on the instrument screen but it is actually downloading the firmware.

I desoldered the EEPROM (there is only one single 32KB SPI EEPROM - AT25256AW - on the entire board) and dumped it. It's all garbled binary.
I used every tool I know of to try to extract some meaningful information like the serial number or even model number which the manual says are in the EEPROM or any other meaningful word , but nothing    I put it back in and of course the instrument works fine .

The power rails are easy to repair, but are you sure it is the power rails? Disconnect the RF deck completely and try it again. Actually you can go though the whole firmware flashing without having the RF deck connected but I recommend having it because it might want to flash the FPGA on the RF board, too. but for troubleshooting you can disconnect it. There are two 12.2V rails that are the mother of all the other voltages. 1.8V, 2V, 4V, 5V and 3.3V  the rest of the voltages do not start until the instrument is up and runs the application

[brainstorm]

Interesting, can you send me that EEPROM dump? What you mention seems like cal data... it'll help me understand as I go through the EEPROM function callgraph as I recover this repair work: brainstorm at nopcode dot org

I am not 100% sure the rails are the problem, but what I know is that the SuperH4 CPU has all the clock signals, the READY signal shows up but it seems to be rebooting all the time... I did remove the RF deck entirely during all tests, so only working on the main board + display: it flickers on power up and that's it so far, worked well before... what else do you reckon it could be? Perhaps I should revisit the caps near the RAM chips, I might have knocked them off making the system unstable :/

Any sound way to know if the RAM ICs are fine?

[analogRF]

one thing I learned is that your power supply must be able to deliver at least 2.5-3A current (at 13V which I used) otherwise the system reboots randomly at various stages. Just during the boot I think it took up to 2.2A and later on during normal operation sometimes based on what operation you do it would take surge currents up to 3A or more. If the power supply cannot deliver it and drops its voltage, it will reboot.
This thing draws some surge currents (pulse) for a short time that you will not see it on the power supply display. So I finally ended up using an Agilent supply which could deliver 4A and I used it at 13V. The instrument sticker also shows it needs 12V-15V@4A. The original adapter of this unit is rated 12V@5A. I thought that kind of current is only needed if you have a battery that needs charging but I was wrong, even normal operation with no battery still needs some large currents
also if it "flickers", maybe it is the backlight driver or the power supply rail that goes to the backlight driver. The capacitors look high quality and I hardly think they are bad unless they have leaked.
Take the power supply shield off and measure at the big inductors. You must have the 12.2V (I think at two of them IIRC), 1.8V,3.3V, 5V, 4V and I think 2V. but 2 or 3 of them do not have anything because they dont come online until later.

[codex0]

RE what is stored in the EEPROM, the user manual states:

EEPROM This memory stores the model number, serial number, and calibration data for the instrument. Also stored here are the user-set operating parameters, such as frequency range. During the master reset process, all operating parameters that are stored in the EEPROM are set to standard factory default values.

RAM Memory This is volatile memory that is used to store parameters that are needed for the normal operation of the instrument along with current measurements. This memory is reset whenever the instrument is restarted.

External USB Flash Drive This memory may be selected as the destination for saved measurements and setups for the instrument. You can also copy the contents of the internal disk-on-chip memory to the external flash memory for storage or data transfer. The external Flash USB can be reformatted or sanitized using software on a PC. Refer to the Chapter 4, “File Management” for additional information about saving and copying files to the USB flash drive.

Compact Flash Card This memory may be selected as the destination for saved measurements and setups for the instrument. The external Compact Flash Card can be reformatted or sanitized using software on a PC. Refer to Chapter 4, “File Management”

[brainstorm]

Hello @AnalogRF,

I now have a proper lab PSU that can do up to 30V and 6A (ITECH triple output IT6302)... it is definitely a big improvement over the dodgy chinese wall wart I had before XD

I have been chasing the voltage rails you mentioned under the Anritsu tin can:

You must have the 12.2V (I think at two of them IIRC), 1.8V,3.3V, 5V, 4V

I have attached a few of them in this post, it would help a lot if you could verify that those are the same you are seeing on your board. I'm powering the main board with 15V and it barely consumes 350mA, no chip gets hot AFAICT and I've disconnected *everything* (no screen attached, no cold tube board, no CF card, etc...). Please let me know if there's any critical rail that I should specifically check, I have "The Signal Path" youtube video screenshot as a reference, but since that video is from the "A" model (attached below, image with red post-it stickers), there are a few differences.

There's a very small "PWR_FAIL" via that reads 3.3V... but since it's close to the battery charging circuit, I doubt it's an "overall" diagnostic for the instrument's power supply, but just a battery present/not present type of check?

@AnalogRF, I could not locate the 12.2V rail you suggested. The closest seems to be the input voltage (using 15V input via the barrel jack, with 0.2V voltage drop for the cable leads).

As I mentioned a while ago, the processor seems to be alive (3.3V and RDY/RESET signals) and the screen does flicker on boot, but doesn't get very far. When I connect the screen, it oscillates very slowly between 300 and 400mA, which suggests a bootloop.

I'll be taking a closer look at the RAM chips soon since I have some suspicion that one of them is not behaving exactly as the other does, but if anybody has other good troubleshooting suggestions, I'm all ears

[brainstorm]

The RAM seems to have addresses being latched on Ax pins (see attached pinout from the datasheet), but no data is coming in/out via DQx pins (the RAM ICs in this device are on the 16x pinout)... I'll check the SuperH4 CPU next...

[brainstorm]

The processor RESET line is high and there's a constant 33,3MHz waveform on EXTAL pin, but it's seemingly struggling to boot since the RDY spits out a train of repeated waveforms, goes silent for a few seconds and repeats (see attached SuperH4-RDY.png).

[analogRF]

Hello @AnalogRF,

I now have a proper lab PSU that can do up to 30V and 6A (ITECH triple output IT6302)... it is definitely a big improvement over the dodgy chinese wall wart I had before XD

I have been chasing the voltage rails you mentioned under the Anritsu tin can:

You must have the 12.2V (I think at two of them IIRC), 1.8V,3.3V, 5V, 4V

I have attached a few of them in this post, it would help a lot if you could verify that those are the same you are seeing on your board. I'm powering the main board with 15V and it barely consumes 350mA, no chip gets hot AFAICT and I've disconnected *everything* (no screen attached, no cold tube board, no CF card, etc...). Please let me know if there's any critical rail that I should specifically check, I have "The Signal Path" youtube video screenshot as a reference, but since that video is from the "A" model (attached below, image with red post-it stickers), there are a few differences.

There's a very small "PWR_FAIL" via that reads 3.3V... but since it's close to the battery charging circuit, I doubt it's an "overall" diagnostic for the instrument's power supply, but just a battery present/not present type of check?

@AnalogRF, I could not locate the 12.2V rail you suggested. The closest seems to be the input voltage (using 15V input via the barrel jack, with 0.2V voltage drop for the cable leads).

As I mentioned a while ago, the processor seems to be alive (3.3V and RDY/RESET signals) and the screen does flicker on boot, but doesn't get very far. When I connect the screen, it oscillates very slowly between 300 and 400mA, which suggests a bootloop.

I'll be taking a closer look at the RAM chips soon since I have some suspicion that one of them is not behaving exactly as the other does, but if anybody has other good troubleshooting suggestions, I'm all ears

i dont have that spectrum analyzer anymore. I fixed it and everything worked perfectly before I sold it.
however, if you watch Shahriar's video about MS2721B (or perhaps MS2721A which has a similar power supply anyway) he will show the voltages
on the board briefly. But there are lots of them clearly marked on the main board and you dont need any reference. All of them are clearly marked
2 or 3 of them are outside the PSU section (1.8V and 24V and perhaps one more 3.3V)
all of them must be stable and there was no pulse or noise or ripple on any of them as I recall. However, 24V only comes on when the system is booted (24V is the supply for the RF deck)

Vsys is 12V as I recall, that's what I was referring to. it is clearly marked on the board.

[analogRF]

Hello @AnalogRF,

I now have a proper lab PSU that can do up to 30V and 6A (ITECH triple output IT6302)... it is definitely a big improvement over the dodgy chinese wall wart I had before XD

I have been chasing the voltage rails you mentioned under the Anritsu tin can:

You must have the 12.2V (I think at two of them IIRC), 1.8V,3.3V, 5V, 4V

I have attached a few of them in this post, it would help a lot if you could verify that those are the same you are seeing on your board. I'm powering the main board with 15V and it barely consumes 350mA, no chip gets hot AFAICT and I've disconnected *everything* (no screen attached, no cold tube board, no CF card, etc...). Please let me know if there's any critical rail that I should specifically check, I have "The Signal Path" youtube video screenshot as a reference, but since that video is from the "A" model (attached below, image with red post-it stickers), there are a few differences.

There's a very small "PWR_FAIL" via that reads 3.3V... but since it's close to the battery charging circuit, I doubt it's an "overall" diagnostic for the instrument's power supply, but just a battery present/not present type of check?

@AnalogRF, I could not locate the 12.2V rail you suggested. The closest seems to be the input voltage (using 15V input via the barrel jack, with 0.2V voltage drop for the cable leads).

As I mentioned a while ago, the processor seems to be alive (3.3V and RDY/RESET signals) and the screen does flicker on boot, but doesn't get very far. When I connect the screen, it oscillates very slowly between 300 and 400mA, which suggests a bootloop.

I'll be taking a closer look at the RAM chips soon since I have some suspicion that one of them is not behaving exactly as the other does, but if anybody has other good troubleshooting suggestions, I'm all ears

you are measuring the MSOFET switching signals in some of these pictures. Just measure the output of each converter (at the output capacitor or even better at test points that are clearly marked on the board with voltage values)

also that 535mV is definitely suspicious . Does not make sense