ANRITSU instrument boot up failed discuss(MS462X VNA)? - Page 1
Forum section: electronics / repair

author: mrf245
author_rank: Regular Contributor
timestamp: April 26, 2018, 08:15:15 am
content: Hi, I'm interesting in some old ANRITSU instruments system boot up failed (like MS462X series, I guess someone know that).I got MS4623B from old factory, surely it can't boot up now. When power up, only fan is running but no display, no any light and any other response.Tested all votage is OK, some people said check if BBRAM (M48T18) fault. BBRAM is SRAM with external battery and clock crystal, this BBRAM only 8KB but contain some system boot up information, if battery run out, data will lose result in boot up failed.When system booting, before display show system information, BOOTLOADER chenking BBRAM data first, if error then will stop boot sequence.I checked battery that is totally run out. BBRAM datasheet shows battery life is almost 10 years. no one know how long this 4623 stayed without running.I guess that some other ANRITSU machines will use same method (bootloader+BBRAM or NVRAM), data in BBRAM was writing after whole machine assembled. New machine or repair, re-write data or file to BBRAM, it will running again.Or make some setting access from ports (serial, JTAG,debug port,etc...), system will create proper data or file in BBRAM and running again (just like some TEK oscilloscope).Anyone know how that work or any suggestion? Thanks very much.

author: precaud
author_rank: Frequent Contributor
timestamp: April 28, 2018, 01:09:26 pm
content: Do you have access to a manual? Many instruments have a "cold boot" or "reset" function which writes default values into the RAM before starting up, actuated by holding down some key while powering up.

author: imett
author_rank: Contributor
timestamp: May 02, 2018, 06:10:15 pm
content: i've the same problem, i could provide a memory dump of another instrument but in my instrument doens't work.nothing the instrument is halted.Another way could buy from an ebayer a special patched flash that may work but he want 500$...

author: mrf245
author_rank: Regular Contributor
timestamp: June 09, 2018, 02:26:01 pm
content: Quote from: imett on May 02, 2018, 06:10:15 pmHello imett, if you can sure your memory dump file is OK in new chips but your 4623 still doesn't work, check if any access signal feeding into M48T18 CE pin, ensure boot-loader running fine so program can check M48T18.Ebayer a special patched flash I guess it bypass checking M48T18 process, but how to solve cal-data problem I don't know...

author: mrf245
author_rank: Regular Contributor
timestamp: June 09, 2018, 02:31:50 pm
content: Quote from: precaud on April 28, 2018, 01:09:26 pmThanks, in service manual it only remind that "maybe U74 (M48T18) data lost" and "replace main processor board" but nothing detail about how to fix it.I also guess it has special service menu when boot, should press some keys when power-up, or adjust switch in processor board, no manual mention it.

author: bongo92
author_rank: Newbie
timestamp: October 31, 2018, 03:04:29 pm
content: Quote from: imett on May 02, 2018, 06:10:15 pmHello,I have the same problem with an Anritsu MS4623b which doesn´t boot. I´m actually trying to write an special EPROM Image to fix this problem. Could you provide the Memory dump of the other Instrument? In return I would provide the EPROM content.Best RegardsMax

author: imett
author_rank: Contributor
timestamp: December 26, 2018, 10:18:10 am
content: here the memory dump of working instrument done with ftp (??), i've make a copy in bin format (i done this copy manually, row by row, please check if is correct) but in my case doesn't work. i've also a patched fw which disable some memory option but this also doesn't work for me..maybe you are more lucky than me

author: Armadillo
author_rank: Super Contributor
timestamp: December 26, 2018, 10:30:56 am
content: Are there any encryption byte or CRC byte associated with those data?With ambient noise and environmental electrical spikes transients, if I am the programmer, I will always program verify the EEPROM bytes fetched before executing it.But maybe can get lucky with older machines plain vanilla coding, don't know.

author: imett
author_rank: Contributor
timestamp: December 26, 2018, 10:44:38 am
content: i don't know about crc or encryption , the only things that i know are that the last info of the battery ram are the date (..obviuos the chip is a rtc) and the main board are very similar to a famous evaluation /development board with the same uP..(now i don't remember the name..)An user told me that the info inside the battery ram are important because they are about the memory size.. like 16 is 16MByte of ram eccFFFC1F30 04 08 AA AA AA AA 31 36 32 30 34 38 30 31 32 38 ......1620480128FFFC1F40 30 32 30 32

author: imett
author_rank: Contributor
timestamp: December 26, 2018, 10:51:26 am
content: the uP is a mc68020? the evaluation board could be motorola VME 135-1? .. now i don't have the instrument on my hand

author: djac
author_rank: Regular Contributor
timestamp: December 26, 2018, 08:27:00 pm
content: I have the same problem with the MS4622B. But my device was not completely dead from the beginning.In the first step the bootloader started normally. It tried to load the application program from the floppy first, then from the internal hard disk and then successfully from NVRAM. Then he started the application program with the corresponding message.But then nothing happened anymore. First I thought that the program image was defective and started the internal debugger of the bootloader (after power on press "1"). With the help of this debugger I was able to reload the application program from diskette into NVRAM. But there was no change.Since the behavior corresponded exactly to what happens when you enter a non-existent Internet address as default gateway when configuring the Ethernet interface (software bug documented by Anritsu), I suspected that some bits in the BBRam, which I assume will store this configuration, might have tilted.So I measured the voltage of the BBRam's battery without removing it from the BBRam and see, the voltage was only about 500mV.When I then restarted the device, it remained completely inactive as in the cases described here (keyboard LEDs all on). I don't know how you can discharge a battery with a voltmeter with 10Megohm internal resistance, but obviously this was the case. The battery can't have been lifted by the probes either, because it's clipped firmly onto the ram.If it turns out that the internet addresses are stored in the BBRam and the bits are tilted, then this would mean that the bootloader does not check the integrity of the BBRam's data via a checksum, but via a magic number. At least a program cannot read the battery voltage according to the data sheet of the BBRam.The next question is, what is stored in the BBRam at all? Because the calibration routines mentioned in the manual, such as the user calibration, the ALC calibration and the receiver calibration, are stored in files on the internal hard disk. Only the DAC value for setting the 10MHz fundamental frequency is stored there according to the manual.Thus, basic data seems to be stored there, such as other DAC values or also e.g. the activation of options as well as the address of the GPIB interface etc..I suppose, therefore, that the whole device will be adjusted after a data loss as well as after production. This will probably be done by a program, which Anritsu owns for this purpose, but probably did not make available to the public.Possibly this program is on the boot utility disk that comes with every device. Unfortunately I don't have it and I don't know any documentation about it.Anyway, it's not enough to patch the bootloader so that it doesn't test the BBRam, although that would be very helpful, because you can run any program that the bootloader finds under A:\SYSTEM\APP.Is there anyone here who has ever contacted Anritsu about this issue?Greetings Dieter

author: imett
author_rank: Contributor
timestamp: December 26, 2018, 08:49:31 pm
content: i've this boot utilities maybe could help you.matteo

author: imett
author_rank: Contributor
timestamp: December 26, 2018, 08:58:51 pm
content: here another info about memory mapping

author: djac
author_rank: Regular Contributor
timestamp: December 26, 2018, 09:26:42 pm
content: Hi matteo,thank you for that. Do you know any documentation about the utility disk?Regards Dieter

author: imett
author_rank: Contributor
timestamp: December 27, 2018, 03:37:43 am
content: on the maintenance manual are used two floppy utilities disk,one for boot and one for calibration..this is used for boot the instrument and launch boot apps i think

author: imett
author_rank: Contributor
timestamp: December 27, 2018, 11:00:08 am
content: i found iny files this patched boot disk.. sorry i don't rememberw why is patched

author: djac
author_rank: Regular Contributor
timestamp: January 03, 2019, 05:11:28 pm
content: I have now contacted anritsu. The first answer is not very hopefully:Hello Dieter,Thank you for contacting Anritsu EMEA region customer technical support.Would you like us to quote for sending the MS4622B VNA CPU board to our factory in the US for repair?This is the only option available for replacing & programming the BBRAM due to the age of the instrument (manufactured 2002).Best regards \ MfgXXXI answered:Hallo XXX,I suppose that the costs for a repair in US would be far to high for such an old device. But please do so.On the other hand I can do it by myself, if I get some information:I have disassembled the boot eprom and know the locations where it tests the BBRam for integrity. To change the code would not be complicated.The problem is the contents of the BBRam. Best would be to get a documentation what it should contain. But it would help to get an binary image from the BBRam of a correctly running MS462x or the default image what your engineers use, if they repair the device.What I do not understand is, why there is in the service manual no procedure given to solve this problem. The only thing that is defective is the battery, clipped on the BBRam-Chip, that costs 5$. And the battery has a life time of 10 years, means beyond the usual life time of the device.I cannot imagine, that Anritsu expects that their customers should send their analyzer every 10 years to the us-factory only for changing a battery. The restoring of the contents is just software, that any customer can do by itself, if he gets the appropriate information and tools.I would be not very lucky to throw away a well running analyzer only because a battery has reached the end of it's life time.Regards Dieter JaegerLet's see if they are willing to give real service to it's customers.Regards Dieter

author: mrf245
author_rank: Regular Contributor
timestamp: January 10, 2019, 01:18:46 am
content: Hello all, very long time no see this post.After copied U74 file from another analyzer, the analyzer boot normally, but it lost all source CAL data, so after made this replacement, it should make source level calibration. After it be done,everything will be OK.

author: mrf245
author_rank: Regular Contributor
timestamp: January 10, 2019, 01:47:30 am
content: Quote from: imett on December 26, 2018, 08:58:51 pmHello imett,Where did you find this mapping files? It loos like from service manual (but I have not found this in official service manual)?

author: mrf245
author_rank: Regular Contributor
timestamp: January 10, 2019, 03:00:34 am
content: Quote from: djac on December 26, 2018, 08:27:00 pmHello Dieter,At least I know BBRAM contain ALC CAL data.You were so lucky to find MAC error in BBRAM, to see debugger data is very good idea.Do you know what others can debugger and monitor do (when analyzer turn on, press 1 and select 6 or 7)?Now my analyzer has another strange problem:After start application, it running normally,but after several minutes, it shows "vector XX, address error",or other similar errors; Measuring graphs looks like very strange; After several seconds no response at all. It should cycle power, and error comes again.Sometimes analyzer will no report errors, just died at all.To check this errors, we run DRAM and other RAM test (except FLASH and NVRAM test), DRAM test no response, others were OK.We also tried replace DSP SRAM and main DRAM 16MB on board, but no work at all.Now analyzer start app failed, stop at "starting system......"I don't know if there is any method to monitor the background messages (maybe it can report RAM failed or other error details), it can very help for our diagnose.

author: djac
author_rank: Regular Contributor
timestamp: January 10, 2019, 10:34:30 pm
content: Hello, mrf245,as an attachment a comment from me to the BIN-File of the BBRam of Matteo (imett). I have examined the code of the patched Matteo boot eprom to determine what the BBRam contains. Or rather, which parts are relevant to the boot-prom code. Maybe this will help you.The errors of the application program can be resulting errors of the wrong content of the BBRam, which also contains data that is important for the application program.The data in the ALC table could range from 0xFFFC0418 to 0xFFFC0177 and contain floating point numbers. However, there are a few other data.Have you ever performed an ALC-Cal? Have you corrected the 10MHz frequency via the service menu? Afterwards you can see which locations in BBRam are altered.Greetings Dieter

author: mrf245
author_rank: Regular Contributor
timestamp: January 11, 2019, 01:24:20 am
content: Quote from: djac on January 10, 2019, 10:34:30 pmThank you very much DieterI also consider about BBRAM data maybe not suitable for this machine.We have done perform ALC-CAL due to APP indicated "ALC-CAL-FAILED", succeeded. But 10MHz FREQ correct we have no executed yet.This error 4622 has a different from other good analyzers (see attach below).There is a DRAM expend card on mainboard, 48MB. If remove this expend card, analyzer will not run into APP and stay at "APP load failed".I have not see any memory size set when boot and in application.This expend card move to other good analyzers which no need this card, it still run perfectly.My friend has replaced all 8 pieces of DRAM on mainboard to new (I'm not sure its SUPERIA) and nothing changed.If BBRAM contains system configurations, I guess it will include whether analyzer need extend memory card or not.But how to set it?Or set in "DEBUG mode"?

author: djac
author_rank: Regular Contributor
timestamp: January 11, 2019, 09:45:44 am
content: Have a look to the 2 Bytes at 0xFFFC1F36 in BBRam. There must be the right value of the memory size in megabytes. The value is ascii coded. This means for an analyzer without a memory expansion card, 16 megabytes. So the two bytes have to be 0x31(0xFFFC1F36 and 0x36(0xFFFC1F37).BEFORE you change the memory, set the appropriate value in BBRam with the debugger, power down, put the the expansion card in or out, and then power on. According to code in boot eprom, that should work.Regards Dieter

author: mrf245
author_rank: Regular Contributor
timestamp: January 11, 2019, 02:10:06 pm
content: Quote from: djac on January 11, 2019, 09:45:44 amOK, looks like debugger is very useful for set analyzer boot parameters, also very important for app running.So I need connect UART to PC, in hyperterminal, set 9600 8 N 1, and is there any manual or commands to let me know how to use that? Many thanks.

author: djac
author_rank: Regular Contributor
timestamp: January 11, 2019, 03:57:46 pm
content: No, I do not know the debugger, and currently my device is dead, so that I can't try it.Regards Dieter

author: Kuan
author_rank: Newbie
timestamp: February 21, 2019, 06:43:50 am
content: Hi everyone,I'm new here.I also had the MS4622B bootup problem due to BBRAM battery ran out.( front panel LEDs were all on, and the CPU halt LED(yellow) of CPU board was on.)Does anyone so kind to tell me, the detaile steps to reprogam the BBRAM on CPU board after it install a new battery(time keeper)?

author: mbielman
author_rank: Contributor
timestamp: February 27, 2019, 11:16:19 pm
content: Hello - also new here and just picked up an MS4622B that appears to have this problem. I contacted a fellow who has a fix for this but wants 500 EUR for the solution. A bit pricey for me at the moment. Really hoping someone here has a solution that doesn't cost a fortune.My unit has not arrived yet so I am guessing about the problem but symptoms are identical. Have downloaded the files listed here so will try those 1st. No idea how to access this RAM when installed into the unit. (new battery on the way)Thanks group! Hope we can lick this one.Mark in Oregon

author: mbielman
author_rank: Contributor
timestamp: March 10, 2019, 03:50:17 pm
content: Hello again. No activity for a while here. Hope this thread isn't dead yet.Still in the same boat. Verified power supplies but nothing else new. Cannot find any info about using the serial port for this. Will try hooking a PC to it anyway - might get lucky but not expecting anything. Also considering removing the BBRAM chip (!) and use my programmer on it. Sounds ugly.I find it hard to believe that no one here has an answer to this problem.Cheers!

author: djac
author_rank: Regular Contributor
timestamp: March 10, 2019, 05:38:36 pm
content: The good news is, I'm getting my device working again. The bad news is that I haven't found a way to get the device up and running again with any means I can get at it. My starting point was the analysis of the boot loader code. But that didn't bring any success, because the code is 512KB and it would have taken far too much time to analyze.So I contacted Michal. He is the one who offers a boot eprom for 500 Euro on Ebay. At first sight this seems to be a lot of money, but in my own experience it quickly puts it into perspective.The task is divided into two parts. The first part is to get into the Boot Menu when the contents of the BBRam are destroyed. Here the Anritsu boot loader fails miserably. The second part is the restoration of the BBRam content. This is done with the help of the debugger and monitor, both part of the Anristu "Boot utility disk".The first part is done by the boot eprom from Michal. For the second part you get a complete documentation. With both you reach your destination after about 1 hour. What remains is an ALC-Cal for which you need a power meter from HP, hp436/437 or one from Anritsu or Gigatronics.That Michal is asking for money for this amount of work is understandable and I don't want to spoil his business by simply distributing his software and documentation here.The attached PDF, however, summarizes my own knowledge about the restoration process and also hints on how to get further documentation from before.Anritsu, on the other hand, can be completely forgotten, no help can be expected from there.Greetings Dieter

author: mbielman
author_rank: Contributor
timestamp: March 10, 2019, 06:02:00 pm
content: Thank you for this Dieter. I have been in contact with Michal also. And like you, considering paying for the ROM. At this point I see no other way and sounds worth the investment. Alternative is an expensive door stop. I have access to all kinds of test equipment so no problem there. Do you have any specs on the power sensor for this task? (frequency and power ranges)regards,MarkPS - my unit does absolutely nothing when powered on. Yellow LED is ON which apparently indicated a halted uP. Does not try to read the floppy, etc. Hope this is all "normal"!

author: djac
author_rank: Regular Contributor
timestamp: March 10, 2019, 06:42:06 pm
content: compatible power meters:Agilent EPM441 + E4412AAnritsu ML2438A + Anritsu MA2442DHP 437 + EP8481A or similarGigatronics 854x in hp437 emulation modeThe behaviour of your device is absolute normal, if the BBRam content is destroyed.Dieter

author: flj
author_rank: Contributor
timestamp: March 13, 2019, 06:59:35 pm
content: Hello,I have similar problem on MS4624D. I wanted to change the display (because the back light was dead) and at the same time to change both batteries. Because the screen was blank and I was looking on external VGA monitor, I reformat the HDD instead of the floppy! I lost everything. After changing the batteries, the instrument can't boot.HELP, Is someone can send me a boot file to boot from the floppy?Thank you

author: flj
author_rank: Contributor
timestamp: March 13, 2019, 07:11:56 pm
content: Hello,I have similar problem on MS4624D. I wanted to change the display (because the back light was dead) and at the same time to change both batteries. Because the screen was blank and I was looking on external VGA monitor, I reformat the HDD instead of the floppy! I lost everything. After changing the batteries, the instrument can't boot.HELP, Is someone can send me a boot file to boot from the floppy?Thank you

author: flj
author_rank: Contributor
timestamp: March 13, 2019, 08:55:52 pm
content: Thanx to imett, I have the boot file, mon and debug.How do I restore the app file?

author: flj
author_rank: Contributor
timestamp: March 14, 2019, 03:11:37 am
content: Hello Dieter,I get myself into a similar situation after changing the batteries.. I am missing a copy of the application file. Can you share your app file?Thank you

author: djac
author_rank: Regular Contributor
timestamp: March 14, 2019, 11:46:13 am
content: Unfortunately it's not possible to attach a file longer then 1MB. So you should pm me your email address, so that I can send you the app file.Regards Dieter

author: mrf245
author_rank: Regular Contributor
timestamp: March 15, 2019, 07:42:14 am
content: Quote from: mbielman on February 27, 2019, 11:16:19 pmHelloI consider the fastest way to solve BBRAM problem is ------- desolder your BBRAM, replace a new battery on RAM, put it in a programmer (most of prog can make it) and program a exist BBRAM file, than use soldering iron carefully fix it.Now at least there're 2 kinds of BBRAM files,. See attach

author: mbielman
author_rank: Contributor
timestamp: March 23, 2019, 01:31:47 am
content: Yes! I considered this but I do not have very good tools for desoldering through-hole ICs. (manual solder sucker)Mark

author: mbielman
author_rank: Contributor
timestamp: March 23, 2019, 01:33:26 am
content: Hello Dieter - Please see my PM about this.thxMark

author: mbielman
author_rank: Contributor
timestamp: March 31, 2019, 01:23:59 am
content: Hello again. So I picked up the special boot ROM and my 4622B is alive!However, I get the following errors via the self test:0503-1 Test Channel Fail (-5.05)0504-1 Test Gain Ranging Fail (-5.11)Word has it that this is a CPU board problem. :-( No idea what to do about it.What a bummer!

author: TooManyHobbies
author_rank: Newbie
timestamp: March 31, 2019, 02:50:13 am
content: I picked up a MS4623B with a bad power supply. Once I get it working I may well have questions about bootup. But first, the Astec LPQ253 power supply has 4 outputs and one is adjustable. Can anyone tell me what the fourth output is supposed to be set to? None of the manuals I have seen contain that level of detail.

author: RFMWdude
author_rank: Contributor
timestamp: April 24, 2019, 04:17:14 pm
content: Quote from: TooManyHobbies on March 31, 2019, 02:50:13 amThe Service Manual mentions 4 voltages; see the attached diagram.Is there information missing from this?

author: TooManyHobbies
author_rank: Newbie
timestamp: April 25, 2019, 12:27:46 am
content: The problem was that these voltages did not square with the rated output of the Astec power supply (no 6.5V source for example and the 5V source was indeed connected). Anritsu was helpful in pointing out that the factory PS was made by TDK so this is somebody's substitute. I got the PS fixed, and now am in the same state as the folks above, voltages on backplane all correct, no LCD messages or backlight (no power to backlight), no serial messages, no VGA video. The RAM backup battery was dead, but the RTC battery is at 2.8 volts which ought to be good enough. The "CPU HALT" LED is on.Do I assume the data in the RTC is corrupt or is there some way to read it out before I unplug the battery?

author: TooManyHobbies
author_rank: Newbie
timestamp: May 03, 2019, 05:36:53 pm
content: Am trying to locate the MS4623B application files that are no longer on Anritsu's site. Do you know where I can find them?

author: 174929851
author_rank: Newbie
timestamp: August 23, 2019, 11:23:55 am
content: Hello my friend mrf245,I have the same problem on my MS4622B,can you add my Wechat? The Wechat number is 13661332612. Deeply grateful 感激不尽！

author: Dronhom
author_rank: Newbie
timestamp: September 25, 2019, 09:36:04 pm
content: I picked up a MS4623B with a bad power supply. Once I get it working I may well have questions about bootup. But first, the Astec LPQ253 power supply has 4 outputs and one is adjustable. Can anyone tell me what the fourth output is supposed to be set to? None of the manuals I have seen contain that level of detail.My Scorpion has a TDK Lambda Sirius power supply. CSF250NM 6.75/12 15B 5/15E to be specific.12V 10A output is not connected, and the 28V voltage is formed on the small board outside the power supply.

author: Dronhom
author_rank: Newbie
timestamp: September 27, 2019, 03:12:01 pm
content: Hi everyone.Is there any chance to get the modified EPRom now? I couldn't find the eBay seller who sold it previously as written here above and the Youtube seller (ms4623b@gmail.com) doesn't reply to my emails.

author: VT7
author_rank: Contributor
timestamp: November 08, 2019, 01:18:57 am
content: Hi!I have gotten such a device and even with the recovery eeprom.With it and some old floppies i could manage to boot it and restore the firmware and also the coot code.suggestion: all batteries were dead, i had to replace them.so CAL is gone.i got into the Monitor-System with serial console and typed in the config (cnfg;m and so on...) and even set the time (SET ...).now the machine tries to boot but hangs itself up at "Starting tasks..." and wont start further. I have waited >1h but nothing happens.after that i tried to get any information about the error and read out the test results of the self test.. the section "QUIKBUS" fails.But. no-where in the internet i find an explanation for this.. just nothing.so i post it here:the code comes from the serial interface.Code:Bug>menu1) Continue System Start Up2) Select Alternate Boot Device3) Go to System Debugger4) Initiate Service Call5) Display System Test Errors6) Dump Memory to TapeEnter Menu #: 5No Errors1) Continue System Start Up2) Select Alternate Boot Device3) Go to System Debugger4) Initiate Service Call5) Display System Test Errors6) Dump Memory to TapeEnter Menu #: 1RAM QUIK: Quick Write/Read...................... Running --->RAM ALTS: Alternating Ones/Zeroes............... Running --->RAM PATS: Patterns.............................. Running --->RAM ADR: Addressability......................... Running --->RAM CODE: Code Execution/Copy................... Running --->RAM PERM: Permutations.......................... Running --->RAM RNDM: Random Data........................... Running --->RAM BTOG: Bit Toggle............................ Running --->RAM REF: Memory Refresh Test.................... Running --->SRAM QUIK: Quick Write/Read...................... Running --->SRAM ALTS: Alternating Ones/Zeroes............... Running --->SRAM PATS: Patterns.............................. Running --->SRAM ADR: Addressability......................... Running --->SRAM CODE: Code Execution/Copy................... Running --->SRAM PERM: Permutations.......................... Running --->SRAM RNDM: Random Data........................... Running --->SRAM BTOG: Bit Toggle............................ Running --->SRAM REF: Memory Refresh Test.................... Running --->SRAMDISK QUIK: Quick Write/Read...................... Running --->SRAMDISK ALTS: Alternating Ones/Zeroes............... Running --->SRAMDISK PATS: Patterns.............................. Running --->SRAMDISK ADR: Addressability......................... Running --->SRAMDISK CODE: Code Execution/Copy................... Running --->SRAMDISK PERM: Permutations.......................... Running --->SRAMDISK RNDM: Random Data........................... Running --->SRAMDISK BTOG: Bit Toggle............................ Running --->SRAMDISK REF: Memory Refresh Test.................... Running --->QUIETBUS QUIK: Quick Write/Read...................... Running --->Testing address range 80C10000-80C15FFCException: Access Fault (dspfault.c: unknown)PC =FFAC4316 SR =2704Format/Vector =7008SSW =0085 Fault Address =80C10000 Effective Address =0000D1A4maybe i can help out with other things or eprom images when my machine runs again.

author: VT7
author_rank: Contributor
timestamp: November 10, 2019, 01:54:49 am
content: i've tested further on. another thing that irritates me is that the RTC test of the BBRAM fails.the test programm can not allocate enough RAM to start the RTC ADR test.i have also made a log:Code:Diag>rtcRTC CLK: MK48T0x Real Time Clock................ Running ---> PASSEDRTC RAM: MK48T0x Battery Backed Up RAM.......... Running ---> PASSEDRTC ADR: MK48T0x RAM Addressing................. Running ---> FAILEDRTC/ADR Test Failure Data:RAM allocatememc.next=E000 memc.size=1FF8i understand not enough of this system...

author: m3vuv
author_rank: Super Contributor
timestamp: November 10, 2019, 03:12:31 am
content: Quote from: djac on January 03, 2019, 05:11:28 pmWhat did the assholes say to that?

author: VT7
author_rank: Contributor
timestamp: November 10, 2019, 07:27:18 pm
content: nothing, i would suppose..

author: mbielman
author_rank: Contributor
timestamp: November 12, 2019, 10:40:56 pm
content: FYI - After I got the NVRAM restored (had to but the alternate boot ROM) I was getting self test errors. (see previous posts) Turns out I had a bad Down Conversion Module of the IF board. Actually found one, replaced it and now my MS4622B appears fully operational! What a ride!!!

author: Staffan321
author_rank: Regular Contributor
timestamp: January 21, 2020, 08:40:03 pm
content: Hello,This was a long thread, hoping to keep it alive a little more...I have a 37247 VNA with a CPU very similar to what is discussed here - also with a BBRAM. It is not yet dead, but time is not on my side.Does anyone have any suggestions on how to:* Download the data from the BBRAM? Difficult to pull out and read with an EPROM programmer? Risky?* Replace the BBRAM? If I just enter a blank one, I guess the VNA will halt still? Is there a risk that something is erased, i.e., I can't revert to the old BBRAM (should it still be around)?Does anyone know if there are any chances that the bootdisk etc found in this thread may work also for the 37247? The CPU is most likely a MVME162 by the looks of it.Many thanks in advance!Regards,Staffan

author: mbielman
author_rank: Contributor
timestamp: January 22, 2020, 02:52:57 am
content: Hello Staffan,No idea about the boot disk and other software. I would think these are NOT the same. But again, not sure. I think you can do a backup of this to floppies.Regarding the BBRAM, sounds tricky! But I think if you have a new battery at the ready, you should be able to swap in the new one w/o issues. (I think there'sa large storage capacitor there to assist.)I would NOT try removing the BBRAM chip - too risky. Just go w/a quick battery replacement. If the unit halts, come back here and I can help.regards,Mark

author: Staffan321
author_rank: Regular Contributor
timestamp: January 22, 2020, 06:36:06 am
content: Hello Mark,Ok, many thanks!When you say replace battery, I guess you’re not referring to the BBRAM internal, but the external one? Would that support also the BBRAM?I’m between a rock and a hard place - although soft version so far. The machine is functional, but I just don’t want to see it die ... and I definitely don’t want to brick it!Regards,Staffan

author: mbielman
author_rank: Contributor
timestamp: January 22, 2020, 01:45:21 pm
content: The MS462x motherboards have 2 batteries as I recall. The coin cell is for your calibrations and other "user" data. You can easily back that up. The "BBRAM" holds the CPU settings and if you lose that, the unit is indeed bricked. It has the piggyback battery on the RTC/RAM chip. (usually yellow) Pop it off with a screw driver and press in a new one.Mark

author: Staffan321
author_rank: Regular Contributor
timestamp: January 22, 2020, 02:24:10 pm
content: Hi Mark,The BBRAM is a black box (M48T08-150CPI). Possibly there is something that can be pulled, but not sure. In the service instruction it looks more like you need to pull the complete IC...Time to start worrying?Regards,Staffan

author: mbielman
author_rank: Contributor
timestamp: January 23, 2020, 01:49:52 am
content: Hi Staffan,That's a different situation... and apparently a different CPU board. I'm surprised that IC is not in a socket. What were they thinking!!!Well hold on. Looked at the data sheet... if it's a DIP package you have a problem. BUT the SOIC version has the snap-on "top hat" battery:(cannot insert pix so look here:https://www.mouser.com/datasheet/2/389/m48t08-955049.pdf)Can you tell???Mark

author: Staffan321
author_rank: Regular Contributor
timestamp: January 23, 2020, 06:32:00 am
content: Hi Mark,Yes, I know of the snap on battery. Keeping my fingers seriously crossed for that, but not sure. I will have to open the VNA to check. I have a picture, but can’t tell from that. This seems to be Motorola decision, by the look of their board, by the way. ... but yes, what were they thinking?Nevertheless, I would so much like to download the content of the BBRAM so that I stand a decent chance of restoring the machine, should anything go wrong. I read in this thread about using a debugger and a serial port, but don’t see how that can be done. The cpu is a MVME162 so there should be software around or even better, installed.There is no serial port on the vna so is there one on the cpu?Just don’t understand if a broken BBRAM will cause the board to brick itself even more or if it’s possible to get it running again with an OK BBRAM?I read also about boot code. Is there a special disk supplied with the MS462? The 37247 doesn’t seem to have anything like that. Would very much like to get hold of the boot FW inside the VNA to examine. Is this on a regular eprom somewhere? Likely not a dip? Would like to get that to perhaps examine. Notice the thorough work by djac and would like to give it a second shot.Many questions. Perhaps several are obvious, but I have never had to deal with this before (although heard about it and - so far - happily realized it doesn’t concern me - so far that is...).Regards,Staffan

author: mbielman
author_rank: Contributor
timestamp: January 23, 2020, 07:21:29 pm
content: Hi Staffan,Is this your board, or close to it?https://upload.wikimedia.org/wikipedia/commons/e/e6/Motorola_MVME162-023.jpgThe BBRAM in the pix appears to be the DIP package. I do not understand the thinking behind that, unless it's in a socket. Guaranteed to fail at some point.Then Anritsu can charge you big $$ to fix it! Appalling!!!If yours is indeed a DIP and not in a socket, removing it and reading the contents may be your best option, ugly as that sounds. You might try the user manual for that board.Perhaps there's a way to use a monitor program and read memory locations. (?)In my case, I tried EVERYTHING but the board just would not boot. I eventually paid $400 for a special BOOT ROM that did not require the BBRAM to be valid.Seems I had no other choice. But that allowed the CPU to boot and then you could alter the BBRAM contents via RS232 to what it needed (DRAM size and other stuff)and then you reinstall the normal BOOT ROM, load the system disks to the "HDD" (really in RAM) and away you go.No idea if that ROM would even work on your CPU board... mine is different, but also a Motorola.I shake my fist at Anritsu!regards,Mark

author: mbielman
author_rank: Contributor
timestamp: January 23, 2020, 07:31:17 pm
content: Take a look at this:https://prep.fnal.gov/catalog/hardware_info/motorola/mvme162_user_manual.pdfI saw the BBRAM address locations listed here and perhaps there's a way to read it.Mark

author: Staffan321
author_rank: Regular Contributor
timestamp: January 24, 2020, 07:55:24 am
content: Hi Mark,That’s exactly my board. Is that the same you have?I agree with your thoughts about Wiltron in this case. Motorola made the board, but why choose this solution in a machine where the RF/IF hardware likely is substantially more valuable?I’m thinking there may be other roms than just the one I have. Would love to find one where I can just reach the BBRAM. Guess there should be a default SW from Motorola, but where?Given that it is a basic VME board, probably also disk and floppy are compatible so it should be possible to run something plain vanilla.I see discussions in this thread about a debugger and a monitor. Do you know how this was done? Does your instrument have an RS232 somewhere?Regards,Staffan

author: mbielman
author_rank: Contributor
timestamp: January 24, 2020, 04:19:44 pm
content: Hi Staffan,The Scorpion VNAs (MS462X) use this one: Motorola MVME162LXIt has a serial port and that is how the MONitor program communicates with the outside world (to a PC running a terminal emulator).You can then view/modify the BBRAM.I think all of these programs are on this thread somewhere. I can post them (I think) if you cannot find them BUT no clue if they would work on your system.When the Scorpion VNA boots, it has a menu that if you (very quickly!) press the 1 key (as I recall) you can start the monitor/debugger which opens the serial port.Maybe on your system you connect through a LAN or USB port??? No idea.I just did a Google search and get all kinds of hits for these CPU boards.I do NOT see (yet) any software downloads.Mark

author: Staffan321
author_rank: Regular Contributor
timestamp: January 24, 2020, 08:22:28 pm
content: Hi Mark,OK, it seems we're using the same board in that case.During boot, only message is to "Press any key to start the format hard disk". There is no serial port either on the VNA itself, does the Scorpion have that?There is an opening on the back (now covered with a plate) that looks like for a D-SUB. Maybe a feature not installed? On your machine, is the serial port by any chance connected to the CPU board directly? Perhaps more likely going through the mother board I guess.I have downloaded all software from this thread. There are however a couple of documents about MVME162, mentioned by Dieter, that I couldn't get hold of. If you have those, it would be great.No clue what would happen if I just inserted a boot disk and ran. What I have done previously is updating the app - four discs are read consecutively - no clue if it just reads and puts somewhere on the disk, but wouldn't like to scrap the HD with the wrong data...Many thanks for all help - very much appreciated! Will look for more info on the MVME162. Plan for the weekend is to at least measure all control signals to the RF hardware - in case the machine would decide to give up on me...Regards,Staffan

author: Staffan321
author_rank: Regular Contributor
timestamp: January 24, 2020, 08:48:28 pm
content: Hi,One more question. I realize there is actually flash memory on the CPU board. No clue why that isn't used for the config, but anyways. Earlier in the thread it seems like the cold start process checks the BBRAM and if it is corrupt _invalidates_ the flash. Does this mean it actually zaps it or at least renders it unusable? Or is it just that it won't rely on that for the current start?Basically, if the BBRAM fails once, is the board really bricked until a new eprom with other code is inserted?Regards,Staffan

author: mbielman
author_rank: Contributor
timestamp: January 24, 2020, 08:53:07 pm
content: Hi Staffan,Yes, mine has a serial port on the back, along with many others. See attached photo. And yeah there is a small interface board connected to the motherboard that has all of this.I have a BOOT disk, a MONitor disk, and the application disks (2 of them). It's been so long ago that I went through this but I do have instructions somewhere. I think I ran BOOT,selected LOAD MONITOR and I think it asks for the floppy. A bit fuzzy on that. Once you are in the monitor (debug) program, you can examine/modify the BBRAM.Good luck!Mark

author: mbielman
author_rank: Contributor
timestamp: January 24, 2020, 08:56:13 pm
content: " _invalidates_ the flash"Yes, I saw that too and believe that is the case. The flash is called the "Hard Disk Drive" in the VNA and stores calibrations and such. Not required for boot up.Mark

author: Staffan321
author_rank: Regular Contributor
timestamp: January 24, 2020, 09:41:11 pm
content: Hi,Great, thanks! OK, you're better off when it comes to connecting then. I don't seem to have anything (definitely not USB :-)Good to hear that 'only' calibrations are lost. I should have all of that on a floppy (several actually).If you think your boot files may differ from what is already posted here, it would be really appreciated if you could make them available.Many thanks and regards,Staffan

author: Staffan321
author_rank: Regular Contributor
timestamp: January 25, 2020, 06:02:42 pm
content: Minor update.I guess it's 1-0 to Wiltron/Motorola for -reasonable- serviceability. The BBRAM is still the one with a fixed battery, but you can actually pull the whole module out. I attach a close up of the board. It's sitting on a socket - phew.Now comes the question that is closing in to to being stupid: what are the risks of pulling it out?I right now have a working VNA.If I pull the BBRAM out and, for some reason I should have known about, kill or zap it in the process, I would not be happy...On the other hand, soon enough the board will probably die anyways...... not my favourite situation.Any suggestions or comments would of course be very much appreciated.Regards,Staffan

author: Staffan321
author_rank: Regular Contributor
timestamp: January 26, 2020, 03:22:15 pm
content: Hello,OK, so I pulled the BBRAM out and read it with my programmer. Attaching binary and an ascii version. The VNA still boots so now I'm a lot more relaxed and much happier :-)Don't think my programmer is able to program the BBRAM unfortunately. It's an LT866CS, anyone knows a suitable programmer or a working EPROM equivalent, that would be very good to know.Time to buy a BBRAM replacement...Regards,Staffan

author: mbielman
author_rank: Contributor
timestamp: January 26, 2020, 03:55:39 pm
content: Excellent!I have the same programmer and could not find this part either. Hmm. Did you read it as a "generic" 8kX8 SRAM?You could experiment with a new IC as a 5V EEPROM (8kX8) like an Atmel perhaps.At least you have the contents and your instrument is OK!Mark

author: Staffan321
author_rank: Regular Contributor
timestamp: January 26, 2020, 08:11:32 pm
content: Hello,Yep, this lifted a couple of stones...I actually read it as a 27C128, i.e., a 8x16k EPROM in order to get the second CE-pin enabled (being address bit 13 on the 27C128, but NC on the 27C64 type). Also insulated pin 1 since this is an output on the M48T08 (albeit open drain) and an input on the EPROM.I'm thinking about replacing the MT48 with an EPROM altogether. If I really need to recalibrate the machine, I can insert a new MT48 at that time and download.If it turns out that the memory space just below (Address bit 13 equals 0) is unused by the MVME 162 board, I can just use a real 27C128. This requires however that nothing is trying to output to the data bus in this address space since there otherwise will be a memory collision. Possibly, one could hard wire another pin on the EPROM in a clever way and get the same function (three state when Address bit 13 is zero).Looking at the board, I can't really figure out which chip is the EPROM - seems to be no DIP sockets so form factor is different. Is it the one next to the battery?Regards,Staffan

author: mbielman
author_rank: Contributor
timestamp: January 27, 2020, 04:31:41 pm
content: "I'm thinking about replacing the MT48 with an EPROM ..."I would NOT do that! The MT48 is also the RTC in the unit and if that were missing, you would probably have all kinds of problems."Is it the one next to the battery? "Yes. With the sticker on it. That's no doubt the boot rom. No need to touch it unless you want the contents for safe keeping.If it were me, I would pick up a new MT48 and experiment with the programmer. I use the Atmel 8kx8 eeproms all the time. It "looks" like an SRAM to the system (except for the slow write cycle).mark

author: Staffan321
author_rank: Regular Contributor
timestamp: January 27, 2020, 06:57:49 pm
content: Hi,Do you think the OS is depending on a real time clock? I was hoping it would just be used as reference when booting. I have no problem with all my graphs being dated 1900-01-01...On the other hand I might as well get hold of another BBRAM and start experimenting a bit. Do you know of anything having the same programming voltages?The ROM would be for reference, but also for trying to figure out what is done in the boot process. I guess there will be a couple of sequences where the code accesses an array in the BBRAM and then ends up reading a final byte somewhere... That should provide some nice info on what is really important on the BBRAM...Regards,Staffan

author: Staffan321
author_rank: Regular Contributor
timestamp: January 31, 2020, 06:49:44 pm
content: Oh happy day!I just tested my newly programmed BBRAM and it seems to be working :-)Just a short summary for anyone interested:Programmer: TL866CS using Minipro 6.50BBRAM M48T08-150CPI is pin compatible with EEPROM AT28C64 _except_• Pin 26 is NC on AT28C64 (should be pulled high during read/write M48T08, use a jumper form VCC)• Pin 1 is NC on AT28C64, should be insulated (use some kapton tape) on M48T08 when using in programmer• IMPORTANT: AT28C64 allows +12V (BEYOND DAMAGE on M48T08) on OE and A9 (Pin 22 and Pin 24) during Chip identification and Erase. DO NOT REQUEST ID nor ERASE using programming!!!To program M48, data in 0000-01FF7 is like RAM and immediately programmed. Notice that reading may go wrong from time to time and render FF FF FF…, but just re-read once more and it should be fine.The final 1FF8-1FFF are special and needs attention. To write data, bit 7 in 1FF8 needs to be set high. Fortunately, the programmer will reach this byte first and thus (if bit 7 is set to high), the following bytes will be written. Thereafter, need to set bit 7 low in order not to lock the clock from updating the memory addresses.One can play with the Read bit (bit 6) also, but seems not so important.That should be it – good luck!Don’t forget to remove the kapton tape on pin 1 before inserting in MVME162 :-)Regards,StaffanPS. For once I did not buy on ebay - battery lifetime on those units are likely shorter than what you get from a unit bought on Mouser or Digikey...

author: miketubby
author_rank: Newbie
timestamp: June 04, 2020, 06:07:21 pm
content: I have an Antrisu MS4622A (serial 023202) that is bricked - won't boot.I have read this thread and have opened it up. Both the CR3032 coin cell and the SnapHat (M4T28-BR12SH1) are flat - both under 200mV.How do I get the contents back into the BBRAM/RTC chip - mine has an M48T18-100MH1 SMD soldered to the board. I have ordered a new SnapHat.I have all the discs that came with the unit but I don't think it will boot the monitor/debugger without the BBRAM being valid?Does anyone have:1. A copy of an alternative boot rom that will bypass the BBRAM corrupt problem?2. A copy of MVME Bug162 that I can program in a 27C040?3. A copy of a correct BBRAM file for an MS4622A?RegardsMike

author: ve2ulu
author_rank: Contributor
timestamp: June 05, 2020, 02:20:33 am
content: http://www.bitsavers.org/pdf/motorola/VME/MVME162/firmware/MVME162-633A/https://rescue.sunhelp.narkive.com/0md0Dts1/looking-for-mvme162-rom-imagescheck and read...I dont know if is work...With good rom (very hard to have), boot and push 1, start MonitorWith terminal on serial port (att: check if reverse tx and rx), 9600n81, type "CNFG;M" and type this data:"32 " Clock speed00E0A0000xxx Mac-Address (sticker on back side of CPU board.)16 DRAM Size in MBytes, 40 with Option 24 installed2048 SRAM Size0128 DSP shared memory02 Flash Size08 extended Flash Size, 02 and 08 works both for menow you have minimal setup to boot.read carefully BBRAM-RESTORATION.PDFThe serial number dont work for me in this doc, i need to add manualy all hex number and subtract hex 56 to make good checksum!

author: miketubby
author_rank: Newbie
timestamp: June 05, 2020, 01:13:09 pm
content: Quote from: ve2ulu on June 05, 2020, 02:20:33 amOkay, I found three copies of 162Bug... 162LX-bug v2.3, 162-bug 2.6 and 162-bug 4.0 - not sure which to use?My serial number is 023202 so what does that make the checksum using your method?Mike

author: ve2ulu
author_rank: Contributor
timestamp: June 05, 2020, 03:20:38 pm
content: I receive today one 27c040 and two 29f040 to test few bin file in my bricked ms4623b.I test and post the result.In the restoration document, at the last page, to found right checksum, the document say to use CS command but for me in my MS4622B, the result of CS command make wrong number.My machine always reject the serial number and write *INVALIDE* with new checksum, after test many case, i found right number with this method: add in hex all carater (6 from your ascii serial number and 7 from ascii of ANRITSU) and subtract hex 56.In the pdf, the checksum 0481 are the sum of all caratecter, my machine have another checksum number with *INVALIDE**INVALIDE*=25Bhex, ANRITSU=226hex, 25B+226=checksum 481hex like 04 81 in the doc.ascii 023202= hex 30 32 33 32 30 32 = sum hex 129ANRITSU 226hex + 129hex = checksum 34F hexThe serial number is last step to do, invalide serial number dont hurt your machine, after you stabilise your machine, you take time to put serial number in BBram.

author: ve2ulu
author_rank: Contributor
timestamp: June 06, 2020, 12:18:38 am
content: I try all 162Bug... 162LX-bug v2.3, 162-bug 2.6 and 162-bug 4.0 and also MS4623B - Kopie.bin on 29F040 flash eprom.Nothing work for me.29F040 work in place of 27C040?Finaly a found, no, 29F040 dont work in place of 27C040.

author: miketubby
author_rank: Newbie
timestamp: June 09, 2020, 06:07:45 pm
content: I have now received a new SnapHat battery for the RTC and fitted it. Fitted 2 x AA cell to replace the CR3032 coin cell. and the unit still does not boot - as expected.I programmed a 27C040 with MVME 162 BUG 4.0 debugger and placed that at U75 instead of the Anritsu boot PROM and I get:Exception: Access FaultRAW-BUG>on the back serial port at 19200bps 8N1 using TeraTerm and a cross over cable.I think it should be possible to get 162-BUG running and use it to reset the system. The 162-BUG guide talks of setting GPIOs 1 through 5 on the normal MVME 162 board. Do we know where the equivalent GPIO bits are on the MS462X motherboard? For example are they the switches near the FLASH?Has anyone got MVME 162-BUG working on an Antrisu MS462X motherboard?Does anyone have the schematics?Mike

author: ve2ulu
author_rank: Contributor
timestamp: June 10, 2020, 10:30:23 am
content: Nice move, try this."md fffc0000:2000;b" Is all BBram dump"md fffc1ef0:170;b" The board configuration aerea from 0xfffc1ef8 to 0xfffc1ff6 the last byte at 0xfffcff7 is a one byte checksum.Try "CNFG;M"and follow bbram-restoration.pdfTo write use MS command.MS adress dataexample: ms fffc047f 3031 3034 3037 0000 0000This is write the serial number, ascii format, in right place in BBram.

author: Staffan321
author_rank: Regular Contributor
timestamp: June 10, 2020, 07:16:36 pm
content: Hello,I've been following this thread and notice that there are quite a few people trying to get the boot process working on old units. Many seem to be connecting to the machine debug port using a serial interface.On my 37247 there is no serial connector on the outside, but there seems to be pins available on the MVME-162 CPU board. Is the MS462 using that board too? I'm hoping someone could show me the inside of one in the hope that there is a cable from the CPU board to the backside serial connector. Perhaps I could setup the same kind of connector on mine.If you have a picture of an opened machine, that would be greatly appreciated.Regards,Staffan

author: ve2ulu
author_rank: Contributor
timestamp: June 11, 2020, 12:30:07 am
content: https://www.abex.co.uk/esales/test/anritsu/vna/37247/001703_s02297/hires/p7021744.jpgThe 37247 have serial connector.https://www.abex.co.uk/esales/test/anritsu/vna/37347/992103_s02854/hires/p1280738.jpgThe 37347 dont have serial connector!

author: Staffan321
author_rank: Regular Contributor
timestamp: June 11, 2020, 05:48:53 am
content: Mine hasn’t got the serial connector on the backside. Would like to be able to connect that way if there is debug info available. Ideally would be able to read out eprom.Regards,Staffan

author: miketubby
author_rank: Newbie
timestamp: June 11, 2020, 04:13:48 pm
content: Quote from: ve2ulu on June 10, 2020, 10:30:23 amIt won't work.While I have 162-Bug firmware it is crashing on start-up and dropping to the very basic RAW-Bug>To do what you say I need 162-Bug to run normally and not generate:Exception: Access FaultRAW-Bug>If you read the documentation for 162-Bug software it tells you that you need to set GPI1 through GPI5 to specific patterns to get 162-Bug to run.When 162-Bug is running properly you get the:162-Bug>prompt, not the emergency:RAW-Bug>prompt. I am getting the emergency prompt probably because Jumper GPI1 through GPI5 are wrong?GPI1-5 are jumpers on a real Motorola MVME-162 VME board but where are the equivalent inputs on the MS462X motherboard?Mike

author: ve2ulu
author_rank: Contributor
timestamp: June 11, 2020, 04:56:41 pm
content: Oh, i dont know is ms462x cpu board have this feature.I work to make some adaptor/socket for the BBram to make extenal programmable capacity of BBram without lost memory when i remove from motherboard.With the right board configuration aerea in BBram, the machine boot and is possible to complet the configuration with the monitor.

author: miketubby
author_rank: Newbie
timestamp: June 12, 2020, 06:43:46 pm
content: To see if your MS462X motherboard is working. Burn 162BUG v 4.0 into a 27C040 and place in U75.Connect a cross-over cable from the rear panel serial port to a PC/Laptop using TeraTerm or similar at 19200bps.When you turn on the power you should get a message:Exception: Access FaultRAW-Bug>Mike

author: miketubby
author_rank: Newbie
timestamp: June 15, 2020, 06:42:52 pm
content: All,Having become quite frustrated with this MS4622A VNA of mine that is a brick and with everything that has not worked so far, I have, today taught myself enough M68K assembler to write an 'unbrick' ROM.I have created an all new ROM for the MS462xx that has only one purpose - to copy a good set of BBRAM data to the RTC and then halt.The idea is that you remove the official boot ROM (27C040) and burn this ROM, power up the instrument, wait a few seconds, while it copies new data in to your BBRAM/RTC, then power down the instrument and re-fit the original Boot ROM.The code was developed using Easy68K and has been dry-run in the simulator. I have NOT YET tested the code because I had to pack my analyser away due to visitors at the weekend.I am sharing this early so that other people with the same problem can look at the code, try it, critique it, etc.Again - I have not yet tried this code. If your Anritsu Analyser explodes, your house burns down or your wife leaves you - its not my fault!Mike G8TIC

author: ve2ulu
author_rank: Contributor
timestamp: June 15, 2020, 06:48:47 pm
content: Nice and very simple move!I dont have 27c040 now but when i receive i try this.On my side, i work on SMT adaptor to make BBram remove and program without lost battery power.And also add bigger battery to keep BBram for 20 to 40year.

author: miketubby
author_rank: Newbie
timestamp: June 15, 2020, 09:36:13 pm
content: So, I have now had a change to try my 'Unbrick ROM'....Before: With normal Boot PROM - switch on an all keypad LEDs lit, no activity at all.After installing running 'Unbrick' and then re-installing normal Boot PROM, on power up:1. Keyboard LEDs light briefly and go out - this is different..2. Screen flashes briefly but remains blank3. Floppy drive did a seekCycle the power a second time - now keypad LEDs are jammed on again - back to where we were before!So, it seems my Unbrick ROM must have done something but now the instrument has reverted to fully bricked again.Does anyone else have a fully working instrument from which they can load the debugger and make a full backup of the 8Kb BBRAM/RTC area?Mike

author: ve2ulu
author_rank: Contributor
timestamp: June 16, 2020, 01:06:32 pm
content: This is my BBram TXT capture of my MS4622B, no cal but fully fonctionnal.I use Putty for terminal.

author: Aiy
author_rank: Regular Contributor
timestamp: June 16, 2020, 06:18:01 pm
content: I happened on this other threadhttps://www.eevblog.com/forum/repair/looking-for-application-disk-for-anritsu-ms4623b-vector-network-analyzer/Perhaps the documentation at the mentioned bitsavers site can be of help ?http://bitsavers.org/test_equipment/anritsu/MS462xx/firmware/Best regards

author: ve2ulu
author_rank: Contributor
timestamp: July 05, 2020, 01:53:44 am
content: Today i remplace two module in my 4622B, is RF source module.Some time before, my vna dont have nice curve in low level, reflect and transmit, on port 3 in first but also port 1 and 2, some time i have some noise start at -65db with source at +7DBmAfter i do Non-ratio Parametric Test, i see the problem i have.I change the IF mixer with no change, i change the first source, port 1 and 2 and i have nice result, i change second source and now the port 3 work great.I put the picture before and after of Non-ratio Parametric Test on second source port 3.

author: mrf245
author_rank: Regular Contributor
timestamp: October 23, 2020, 06:25:06 am
content: Quote from: ve2ulu on June 05, 2020, 02:20:33 amHello VE2ULU,Could you tell me what is you mentioned "good ROM"? Is it VNA original BOOT ROM?And connect RS232 to PC and press 1 in monitor, is it press key 1 in VNA's panel?

author: whitebear
author_rank: Newbie
timestamp: February 20, 2021, 01:34:50 pm
content: Just in case someone is still struggling with this ..."RAW-Bug>" is a prompt for ROM-only monitor. Luckily, this monitor has basic memory inspection and modification functions which are enough to change BBRAM contents.Pressing "h" at the prompt gives help message:Code:RAW-Bug>hhD <ADDR>...........(DISPLAY)M <ADDR>...........(MODIFY)R <ADDR>...........(READ LOOP)W <ADDR> <DATA>....(WRITE LOOP)X <ADDR>...........(EXECUTE TARGET)RAW-Bug>Addresses and data words should be entered as 8-digit hex values (e.g. 000012FF).A simple script can be used to type in necessary commands to write BBRAM. I've managed to unbrick my MS4623B using this method.

author: frankly
author_rank: Newbie
timestamp: March 25, 2021, 08:54:55 am
content: Hello whitebearThanks for identifying this, that's extremely helpful for the rest of us and completes the effort without the use of a soldering iron.I counted at least 3 of the 8K images in this thread. They are all different, with "ms4622B_OK" being the most divergent. What image were you successful with? And I assume that this was edited somewhere to load your particular MAC address, eh?thanks & regards, Frank

author: DaJMasta
author_rank: Super Contributor
timestamp: September 19, 2021, 05:00:06 am
content: Does anyone have any info on the LEDs on the motherboard or the boot process for these units? Should I just be referencing the materials from the board the CPU board is based on?I've got one with similar symptoms that just lights most of the front panel lights and doesn't do anything (nothing on screen, nothing on external screen, nothing on RS232), and I've replaced the snaphat, the RTC battery, and copied the contents of the U75 ROM, but I haven't gotten any farther in the process yet. The four LEDs on the board light and then go out very shortly after boot, and when a keyboard is attached, the caps lock and other lights flash like a normal boot, but nothing else (and no activity light flash on the USB port that's in the place of the 3.5" floppy on most units). When the U75 ROM is pulled, the four CPU board LEDs light and don't extinguish, so I think the process is at least getting to reading or preliminary checking of the ROM, but I have yet to find signs of light beyond that.I've tried holding the 1 key on the front panel to try an boot from an alternate source, but again no activity on the FDD replacement LED and no difference on the board (since there's a beeper on it, I would have expected that or LEDs lit if there was a CPU/memory error). I will see if the linked disk utilities will work on a USB stick in this unit, but since the floppy described doesn't sound like it's bootable, I don't know if my unit will even get far enough through the sequence to try to boot from something.Is the BBRAM with the fresh snaphat to blame for preventing the boot altogether, or is my unit hanging before it gets to that stage?

author: DaJMasta
author_rank: Super Contributor
timestamp: September 21, 2021, 04:18:35 am
content: I've done a little more digging but made no progress. I've actually got two units based around the same CPU board - an MS4622 and an MS4623 - and both show the same symptoms at every step. With the original ROMs, there is no output, all the keypad lights light, the four lights on the board go out, no floppy activity, and the halt LED behind does not light. I tried the 4.0 version 162BUG in a ROM and haven't gotten any sign of life out of either - no activity on the serial port, nothing on the front panel or screen, all four status LEDs on the CPU board stay lit, no activity from the floppy.I'm wondering what I could be doing wrong. Do I need to be using the 2.65 version or the Probe+ version? Is there some other step that needs to be taken after power on to access the new ROM? Is there another interface that can provide some insight into whatever problem is going on?Since it's happening the same with both, I doubt it's a one-off CPU board fault, but I even went as far as to scope all the serial port lines for activity and got nothing, and it really doesn't seem like the 162BUG ROM is actually doing anything on either unit given the onboard LEDs. I will check the GPIB connection on a whim to see if there's any activity there, at least, and I don't think I've tried clearing the CMOS (jumper near the RTC battery) on the new one, but short of just trying to reseat the CPU or something, is there something else I should be considering?

author: ve2ulu
author_rank: Contributor
timestamp: September 25, 2021, 05:22:13 pm
content: The BBram are empty or corrupted, you need special boot rom U75 to load BBram with minimal data to boot with original U75 rom.

author: DaJMasta
author_rank: Super Contributor
timestamp: September 25, 2021, 08:46:06 pm
content: Presumably empty, the batteries were quite low. So this is not the original boot ROM and not the 162Bug ROM, but a third? Is this available anywhere, or should I be looking to desolder and reprogram the BBRAM because it's not likely available anywhere?Also found the boot ROM in the second unit was just totally dead - oddly, the instrument showed the same behavior as the working ROM (all four lights go out after initial flash), but when put in the programmer to read, every pin fails the pin check and every piece of data is just FF, lucky I've got a copy of the more recent ROM from the other unit...

author: ve2ulu
author_rank: Contributor
timestamp: September 28, 2021, 10:38:15 am
content: The ms462x need only few data in BBram to boot correctly.I think is a choice of Anritsu to return and repair old machine.I have a good working MS4623 and i have one brick, my next step is make IC adaptor under BBram chip, in case of lost data, BBram are on socket and possible to put in eeprom programmer.The better wait is make rom to programme in place BBram, but is very hard to find people to make a small program on this cpu platform.On youtube, one guy have recovery boot rom, i ask 500$us.

author: ve2ulu
author_rank: Contributor
timestamp: September 29, 2021, 11:01:51 am
content: Do you try MVME 162 BUG 4.0 debugger in U75?

author: RFMWdude
author_rank: Contributor
timestamp: October 03, 2021, 09:30:30 pm
content: @DaJMasta:If you:place one of the MVME162 debugger ROMs in the U75 socket (http://bitsavers.org/pdf/motorola/VME/MVME162/MVME_162LX/firmware/162LXBUG_2.3.bin)use an RS232 null-modem (cross-over) cableset your favorite terminal program to 19200 8N1you should be presented with theCode:RAW-Bug>prompt.

author: DaJMasta
author_rank: Super Contributor
timestamp: October 04, 2021, 05:41:47 pm
content: I was not, on either machine, but I used the 4.0 version of the MVME162 debugger. I have one last PROM I can burn, and found that one of the original PROMs were dead (and already duplicated the first), but before I toss another single use chip into the programmer I figured I would try another route (already tried two copies of the 4.0 162 Debugger). No activity on the RS232 at any baud on any pins, all four lights on the motherboard light (not the CPU halt light), nothing on the front panel or screen, just dead.I've got a 44 pin SOIC adapter on the way for my programmer, and I'm going to remove 4 legs from it, pull the U74 BBRAM, and try to program it and then solder in place. Since the back up battery pins don't leave the package, there should be no risk of shorting the battery on reinstallation, and thanks to the wide footprint of the timekeeper IC, a standard SOIC 28 footprint is too narrow to fit it (originally wanted to just press the chip on open contacts, but it's too wide to join). The TL866 II Plus will program the M48T18 and while I couldn't get it soldered to my under-width adapter to fully program it, I was able to get enough pins connected to change the readout value after programming (not just 0xFF all the time).Hopefully this week, I'll see how it goes. If not that and especially if someone can confirm the earlier debugger version could be of use, well I can burn that last PROM and give it a shot.

author: DaJMasta
author_rank: Super Contributor
timestamp: October 08, 2021, 04:16:46 am
content: Well, the SOIC 28 landing pads were too narrow, but the SOIC 44 clip was too wide.... so I resorted to an obtuse solution to this obtuse architecture's quirky repair.I took an earlier BBRAM image in the thread and modified it to have the new serial number, the new checksum, and the "mac address" on the bottom of the board. The rest seemed intact, so I left it, and it's worth mentioning that since the last few entries of the BBRAM continuously update with the current time, every time you program it the verification will come back as false, since the time keeps ticking away.In any case, soldered it back on and booted it up... not success, but different behavior. I didn't realize that before redoing the BBRAM the CPU fan didn't spin, since it was in the chassis and not really visible, but it's noisy enough in this MS4623B that it's obvious that it is now running. Otherwise the front panel lights seem to be the same, and no output on the screens.The next step for me is probably checking the seating on the CPU just to be sure, then checking the RS232 output to verify it's still nothing. Then I'll probably burn the 2.5 or 2.3 version of the debugger into a PROM and give it a shot... I like the modular design on this thing but it's damn near impossible to do any probing on the mainboard because it's covered by the chassis. Maybe I'll try to buy/make a backplane extender cable.

author: ve2ulu
author_rank: Contributor
timestamp: October 08, 2021, 11:49:31 pm
content: Is not easy task to do!If a have time this weekend, i try U75 with V4.0 debugger on my second cpu board.

author: RFMWdude
author_rank: Contributor
timestamp: October 10, 2021, 06:50:39 pm
content: @DaJMasta:I really like your BBRAM contraptionSome additional information:The BUG version doesn't seem to matter. I just tried the 162BUG v4 (filename: 162BUG_4.0_2000.bin) and it gave exactly the same outputPlease see the attachments for some scope and terminal screenshotsThe 'Exception' is (kinda) normal. Just type 'h' for helpWhen using the deBUG ROM, you should see some activity at power-on on the RS232 DB9 connector, pin 3The standard ROM does not output anything on the RS232 port!The 4 green LEDs on the mainboard should turn on and stay on

author: DaJMasta
author_rank: Super Contributor
timestamp: October 11, 2021, 04:59:18 am
content: Well I can confirm that what seems to be helping for others doesn't do anything on my MS4623B, at least. With the 4.0 162BUG ROM I see nothing on pin 3 of the output of the serial port. I traced it back to U18, the transceiver for it, and see no activity on the transceiver's input, and I see nothing on the unpopulated header connector marked UART near that back section of the board.I also tried connecting the jumper marked RESET near the non-snaphat lithium battery, no difference, and tried connecting the jumper on the PROM/FLASH header near the SCSI port, and again no change. The debugger does light all four LEDs whereas the normal PROM does not.I think next I'll trace the UART back to whatever is driving it, then look up the datasheet and see if there's activity. Slow going soldering on wires to pins and then running them out the front for the scope, but at least I should be able to get a gauge of whether there's a part along the way that's dead or just a boot process issue. I wonder if the status LEDs described in the MVME162 documentation are broken out somewhere on the board so I can try and scope them to get some insight into the boot process. Doesn't get far enough to beep the beeper, but the 4 LEDs light, the front panel lights all flash once and then light, and a keyboard attached to the front panel connector shows the caps lock/num lock/scroll lock keys light and then extinguish, so it's doing at least something. Also no floppy drive activity on the unit, but I assume that would be at the end of the boot process. At least the newer monitor with a VGA input also doesn't detect any output signal, saying the cable is disconnected instead of just showing nothing, probably indicates not getting far enough to boot the PROM.

author: RFMWdude
author_rank: Contributor
timestamp: October 11, 2021, 08:36:07 am
content: I would start by checking some basic stuff like voltages, CPU clock and activity on the address and data lines.On the other hand: you mentioned earlier that it did make a difference in behaviour if you changed the standard bootrom for the debug ROM. So that suggests that the CPU is running after all. Some bad RAM chip could prevent the system from completing the boot sequence, but these boards are pretty reliable; I’ve never seen that happen before. The EPROM going bad in one of your units was also weird. Maybe it suffered a power spike? Do you know the history of both units?By the way: It’s perfectly normal that the screen stays blank in this situation: The bootrom contains a ‘driver’ to upload code to and initialize the TMS34020 graphics processor. Your system obviously stops before that.Some background information: The RAM size is coded in BBRAM. That’s not really an Anritsu thing, but this was more or less dictated by the underlying MVME162(LX) and PSOS+ (the RTOS) architecture. When the Snaphat battery is exhausted and the BBRAM contents are lost, the system doesn’t know its RAM size and is unable to boot. Pretty stupid, huh?But since you put the right values in BBRAM, this issue should be resolved. An issue with the serial port does not prevent the system from booting, as far as I know. So there seems to be another problem.What about your other unit (MS4622B)? Does it really show the same behaviour?

author: DaJMasta
author_rank: Super Contributor
timestamp: October 12, 2021, 05:28:22 am
content: I had been working mostly on the 4623 and checked the 4622 again, and it does actually get farther, so I'll focus on that one for the moment. I get the raw-bug prompt (maybe not a null modem cable the first attempt?), and man it's a pain to use. I've been able to use the d and w commands, and have verified writing values to the bbram, but I haven't found out the next word syntax for w and haven't found the end command syntax, so while I can write a word, the prompt then goes away and I need to reboot to write a second wordIn any case, I tried writing the system config information into the BBRAM using this method and tried the real ROM again, instead of the no reaction of before, it waits some time and then gives two short beeps, a second or so apart, then waits a bit and loops the same. Definitely farther, but definitely not enough.I think pulling U75 and programming it out of system may help with this - at least the first block of the BBRAM looks sort of like the program entry point or some additional configuration - but I'd also like to know if it's possible to access the much more capable 162-bug. I read in a different thread in a different place that the key to getting the 162-bug prompt was assigning a block as RAM, since the raw-bug prompt is ROM only and thus has a much, much smaller footprint. I believe the "access fault" is probably some lacking configuration data, but I don't have the slightest idea how I should feed it that aside from using the w command from raw-bug on some word of memory, somewhere. It would be useful to find a way to get into the 162-bug prompt even if that's not ultimately required, but even just figuring out the syntax for w could allow you to program the full BBRAM over the serial port using the raw-bug.I'll see if I can troubleshoot the motherboard of the 4623 when I get this one running, the voltages on the back panel were all good, if I remember right, and soldering in modwires to check signals when powered up is yet another tedious task.

author: RFMWdude
author_rank: Contributor
timestamp: October 12, 2021, 08:20:57 pm
content: Yes, the RAW-BUG is very spartan, but you certainly don't have to reboot between writing memory locationsSee the message from 'whitebear', earlier in this thread: you have to enter 8 bytes at a time and then the address will auto increment.And you don't have to program the entire BBRAM this way. Only the relevant locations/sections. See the file 'BBRAM_changed.txt' from user 'djac' (also earlier in this thread).

author: DaJMasta
author_rank: Super Contributor
timestamp: October 16, 2021, 03:43:41 am
content: You say that, but I still don't know the syntax to write or read the next element in a loop. It will acknowledge commands by echoing them, but whenever I add extra data following the initial 8 hex characters, it does not acknowledge anything else, and instead just hangs at the prompt and doesn't return or seemingly even end the command, thus my need for reboots. It appears to wait for 8 hex characters, even ignoring spaces/line feeds/etc, then stops responding. Not sure if there is a special character or something to delineate data blocks or end of line (carriage return and line feed don't seem to be it, neither do ".", ",", or ";") , but I've only been able to program 8 hex characters, or 4 bytes of memory, at a time, and then the input becomes unresponsive.Maybe I'm just too obtuse to be able to guess it, but I've been unable to find any documentation for the raw-bug version of the ROM and haven't seen example syntax elsewhere. If someone's got that, it would be helpful. Also knowing if programming some of the BBRAM can get you to the full fledged 162-bug or if you just want to do the full recovery in the raw-bug and then swap in the ROM, but provided I can program it enough, I may just find out myself.

author: ve2ulu
author_rank: Contributor
timestamp: October 16, 2021, 01:36:19 pm
content: I suppose it possible to built TXT file before with all command, data and CR.And after copy paste in terminal...

author: DaJMasta
author_rank: Super Contributor
timestamp: October 31, 2021, 04:09:02 am
content: CR doesn't actually signal a new set of four bytes, though, best I can tell. I wasn't able to program it through the serial port, and after another manual write of a few other chunks, I pulled the chip and programmed it with the soldered on adapter I made for the previous one. I put in the attached modified version of the matteo bbram, and the unit booted.With that bbram programmed, the serial number was reset to invalid (I used the checksum method that added 025 for this version), the ALC cal data was gone, and the clock couldn't be set - it thew an error and beeped trying to save it. So after that, I put in the modified boot floppy disk, loaded it up, and that corrected the clock issue. I also found this unit had a bad screen, which turned out to be a bad backlight inverter. The inverter used was a relatively standard LS380 module, which replacements are available, but the domestic ones started around $100 each, so I traced out the board, took a look with the thermal camera, and eventually arrived at a fix. There's a part labeled ICP1 that's a little black SMD part with a "10" on it, slightly under the thermal fuse, and though in series with the input voltage, mine had gone open entirely. After some wondering, I decided it was a 10 ohm NTC and ICP1 was for inrush current protection, so I found a largeish 10 ohm NTC and dropped it, problem solved. Gets close to 80C but then cools down a tad when stabilized, so I'm calling it fixed for now.Going to try manually writing the serial number again with the recovery ROM, but I need to find a way to perform the CAL. Does anyone know of a 437 GPIB emulator for the PC? I've got an NRP series USB power sensor that would work great, and the NRP meter can apparently speak the right flavor of GPIB, but I don't have the meter and it's pricey, and otherwise I don't see a way to manually input cal information for the process, and it would take some effort for me to write a translator for my USB power sensor to communicate with the VNA with a USB to GPIB adapter, though maybe it's few enough commands that it wouldn't be a problem.Otherwise I've gotta look for a compatible power meter, and then maybe just use it and sell it back when I'm done, not sure, I would like to get the ALC and timebase calibrated, at least.

author: DaJMasta
author_rank: Super Contributor
timestamp: November 02, 2021, 05:18:56 am
content: Took a crack at fixing the serial number but all of my attempts have been rejected. The cs command mentioned in the restoration pdf is entirely absent from either the rawbug interface (still doesn't load the full 162bug even with the otherwise working bbram), or from the system's debugger interface (press 1 on the front panel at the top, option 7), but I have yet to find any documentation for any of it, the help command "he" gives you a table of two letter command prefixes and nothing else, and I could find no external documentation with a mention of the pROBE+ prompt interface.I tried an additive checksum of the serial numbers and ANRITSU that appears after it (0353 for my machine's SN), then the same subtracted by hex 56 (as suggested earlier in the thread) to try 02FD, but neither was accepted. I also went and made sure everything in the block was zeroed out, as there was an extra AA byte at the end of the block mentioned in the restoration pdf that was in the matteo bbram copy that I thought could be messing with things.Would be great to have documentation for the system's onboard debugger at the pROBE+ interface, access to the full 162bug, syntax for the w command of the rawbug that could take multiple 4 byte inputs, or some clarification on how to calculate the checksum for the serial number, but at the moment I think I'm in the dark on all fronts. Will keep trying to poke around, and will probably connect up the USB GPIB adapter to at least see what it would be asking the 437 for in terms of commands to see if I could feed it some level data and complete a cal with a script, then interface it with my power sensor.

author: ve2ulu
author_rank: Contributor
timestamp: November 02, 2021, 02:09:13 pm
content: I write for SN of machine in BBram, i have 56hex in difference between PDf and my machine.Check your checksum of "Invalide" in BBram and use the difference between 0481 and your number to make your checksum.

author: DaJMasta
author_rank: Super Contributor
timestamp: November 03, 2021, 05:33:21 am
content: I had tried the sum of my serial and "ANRITSU" and then subtracting 56, I had tried just the sum of the serial and ANRITSU, and I just tried 0481 - 012D -> 0354, and had the same results, just invalid as a serial.I don't know what I'm missing, so I'll spell out the math I've got:SN is 011605 -> 30 31 31 36 30 35 -> summed to 01 2DANRITSU -> 41 4E 52 49 54 53 55 -> summed to 02 26Summed is 03 53Summed minus 56 is 02 FDSN subtracted from 04 81 is 03 54Either I don't understand what you're describing, or the method doesn't appear to be working. I've tried all three of these values with the same serial entered, and I don't think the windows calculator in hex mode is going insane. This was the contents of my BBRAM at the relevant section in the latest attempt (checksum of 0354). Also got an image of the pROBE+'s interface "he" command, which appears to be the command list.

author: ve2ulu
author_rank: Contributor
timestamp: November 03, 2021, 10:59:14 am
content: Ok, my english is not very good but a try another time!In the PDF, the checksum for invalide number is 04 81 hex, what your checksum when your machine do invalide number?In my case, y take my machine checksum of invalide number with "cs fffc047b fffc0497" and found the difference with 04 81, i take this difference to correct the result ( -56 hex in my case)I dont know why CS command dont make right number....04 81 is the reference, you try also the difference between "invalide" (02 5B) and your SN (01 2D) (025B-012D=012E) , then subtrate to 04 81 (0481-012E=353) Try 03 53!

author: DaJMasta
author_rank: Super Contributor
timestamp: November 05, 2021, 04:48:25 am
content: I had tried 0353 before, but don't know if I had mistyped or something, so I tried again, still no luck. Seems that algorithm isn't working for my unit, at least.I went looking around for a bit more documentation or software, and buried in some folders on KO4BB's repository, there's a copy of a working BBRAM that isn't the one linked here, and the serial number lines are as follows:Code:FFFC0470 AA AA 6A AA AA AA AA 00 00 01 0F 00 00 00 00 30 ..j............0FFFC0480 31 31 38 31 34 00 00 00 00 00 00 00 00 00 00 41 11814..........AFFFC0490 4E 52 49 54 53 55 00 AA AA AA 6A AA AA AA AA 00 NRITSU....j.....It doesn't sound like the aforementioned algorithm works for this unit, either, so the actual algorithm may be something different. I don't see an obvious pattern just summing and differencing things to get 010F, but I'm also not really familiar with checksum algorithms, so I may not even be trying the right methods. While the checksum is discussed in the MVME162 documentation, the actual algorithm isn't stated and I still don't have access to the full 162Bug debugger for the CS command.

author: DaJMasta
author_rank: Super Contributor
timestamp: November 07, 2021, 01:51:22 am
content: Not direct progress, but I went poking around to try some other math to get a match for these checksums. Tried various versions of XORing and couldn't get a match, then I stumbled into a 69k debugger's manual that describes the CS command's algorithm (attached)The problem is, knowing that it's summing words and adding one when it carries outside of the checksum word... I can't get any of them to match. The one in the last post doesn't work (trying starting on odd and even bytes) and the *INVALIDE* message doesn't have a checksum of 0481 in any of the configurations I've tried... so I'm not totally sure whether I've even found the right algorithm.Could the checksum be starting earlier or going later than just the 00 surrounded block with the serial and ANRITSU?As a point of reference on the same page, this is the same section of ve2ulu's working BBRAM - two data points should help, at least.Code:FFFC0470 AA AA AA AA AA AA AA 00 00 02 FC 00 00 00 00 30 ...............0FFFC0480 31 30 34 30 37 00 00 00 00 00 00 00 00 00 00 41 10407..........AFFFC0490 4E 52 49 54 53 55 00 00 00 00 00 00 00 00 00 00 NRITSU..........

author: ve2ulu
author_rank: Contributor
timestamp: November 07, 2021, 07:34:40 am
content: FFFC0470 AA AA AA AA AA AA AA 00 00 04 2B 00 00 00 00 2A ..........+....*FFFC0480 49 4E 56 41 4C 49 44 2A 00 00 00 00 00 00 00 41 INVALID*.......AFFFC0490 4E 52 49 54 53 55 00 00 00 00 00 00 00 00 00 00 NRITSU..........I check my old data...On my machine, the invalid BBram checksum is 042B, is 56hex under 0481 checksum in PDF.I check and you never port your invalid BBram checksum value.What your invalid BBram checksum?

author: DaJMasta
author_rank: Super Contributor
timestamp: November 08, 2021, 05:22:54 am
content: Thank you, that was the question I needed to be asked to understand what you've been telling me for a bit. I had assumed that since the source BBRAM I copied set it to 0481 that the checksum wouldn't have changed, but the checksum algorithm seems to be checking some other parts of the BBRAM (or ROM or something) that makes the value system specific, rather than just following what it said in the information about the CS command as a simple sum of the block. I managed to write the correct serial number and checksum through the raw-bug command interface using the 162Bug 4.0 ROM linked earlier, getting the initial boot previously with a copy of someone else's BBRAM written to the M48T18 in a programmer, with the snaphat attached, and then soldering the programmed chip in place on the board.My checksum solution was like this:Original Matteo source BBRAM has a checksum of 0481 for *INVALIDE* and ANRITSU in the checksum block - this is also just the summation of each byte (not word summation, which is the default described in the CS documentation, and since the output is a word, it's probably different from what is described there).Running that same BBRAM on my unit overwrote the checksum with 0291, unbeknownst to me, the critical missing piece.The difference between 0481 and 0291 is 01F0, which becomes my machine-specific offset to calculate the checksumMy serial number is is 011605 -> 30 31 31 36 30 35 -> summed to 012DAdd the serial number sum 012D to the ANRITSU sum of 0226 to get 0353, then subtract the machine specific offset of 01F0That gives my serial number and unit a checksum of 0163, and that loads properly in the firmware.To get the new information written into the surrogate BBRAM that was already onboard, I used the raw-bug interface through the ROM and manually rewrote fffc0478 through fffc0487 using the w command and a power cycle each time (not too many cycles and very quick to load in between), then the d command and a bunch of carriage returns to display subsequent 4 byte chunks to verify what I had written. With this method using the physical removal of U74 and programming plus a burned 162bug ROM, I didn't need the proprietary recovery ROM mentioned early in the thread.I've attached my now working BBRAM to the message appended with a .txt suffixNow to get it calibrated (at least against out-of-cal-cycle equipment)!

author: ve2ulu
author_rank: Contributor
timestamp: November 08, 2021, 12:27:30 pm
content: Good!!!Just for info, when you write data, is possible to write many data at once.Like this: ms fffc047f 3031 3034 3037 0000 0000

author: DaJMasta
author_rank: Super Contributor
timestamp: November 08, 2021, 04:33:14 pm
content: The same format doesn't seem to work in the Raw-Bug interface, though, which only has access to the "w" and a couple of other single character commands. Maybe some usage of the "m" command would do it?

author: ve2ulu
author_rank: Contributor
timestamp: November 09, 2021, 12:05:18 pm
content: I never use raw-bug command (i try but i never succes to boot with), but i have another mother board of ms4622 bricked to test with motorola raw-bug.

author: whitebear
author_rank: Newbie
timestamp: February 09, 2022, 12:34:49 am
content: Quote from: DaJMasta on November 08, 2021, 04:33:14 pmYes, using M command is the way to go. Type M xxxxxxxx (where xxxxxxxx is a start address, hex, zero padded to 8 characters), then write 32-bit data words, one by one, also hex, zero padded to 8 characters. Address will auto-increment.If this is of any help, I've attached a ruby script that can be used to read / write BBRAM via Raw-Bug.

author: ve7tnt
author_rank: Newbie
timestamp: June 08, 2022, 06:20:03 pm
content: I am trying to get an MS4622B VNA working and have been reading the postings. VERY HELPFUL!!. Going to open the unit up and replace battery(s) as a first step.I do not have the two disk APP files and am wondering if anyone can help me on this? Could not find anything on the Anritsu Site.I downloaded a boot disk and the unit initially found the floppy and booted but asked for the APP disks. It did this once but now appears dead in the water. Supply voltages are all aok.Sounds like I now have the same problems with the NVRAM issue.Thanks! Idea is to get it going and use if for Ham Radio related filter and antenna projects.

author: ve2ulu
author_rank: Contributor
timestamp: June 09, 2022, 02:12:46 am
content: You are lucky, your unit boot... when the BBram fail at all, the unit do nothing, is dead.Dead but not dead dead... with good rom is possible to reload manualy the bbram.I think the 2 disk are in one link in this tread...I found...http://bitsavers.org/test_equipment/anritsu/MS462xx/firmware/ScorpApp_1.20_nonOpt24.zip without option 24 (no memory extention board on cpu board)

author: dr-chrisp
author_rank: Newbie
timestamp: October 07, 2022, 10:01:41 pm
content: Thanks to all who contributed to this thread. I have a MS4623C which was dead when I bought it at auction, 6 years ago. I tried all sorts of investigation but didn't know about just how disastrous a backup battery failure is on this unit. So, a colleague showed me this forum a couple of weeks ago and today I got my unit running again, seems all fine! My steps were: download the binary file and program 162BUG V4.0 EPROM. Fit that in place of Anritsu EPROM - and wow, the processor is not dead after all. Then I used the Modify command to reprogram the whole BBRAM from one of the files available on this forum (bbram_matteo.bin). I decided to write a small Delphi application that automates the typing, and that allowed me to also poke the correct MAC address and IP addresses into the unit with checksum calculations. The Delphi application is available for anyone that cares to use it, here:http://www.cambridgerf.com/download/files/AnritsuMS462XXbbram.htm.After the BBRAM was re-written, I found that the instrument booted properly (with the original EPROM re-fitted), except that the serial number was showing as *INVALID*. So the final step was to use the System menu "1" and Monitor "6" option to read out the corresponding checksum when the serial number is *INVALID*, and use that to calculate what it should be when the real serial number is entered. That calculation is also included in the Delphi app. You will find that the installer bundles a Word document "The restoration of BBRam of Anritsu Scorpion VNAs.doc" as part of the install, based on "bbram-restoration.pdf" earlier in this thread, and that describes the steps in more detail. I hope that helps. Kind regards to all.

author: ve2ulu
author_rank: Contributor
timestamp: October 11, 2022, 01:35:44 pm
content: Quote from: dr-chrisp on October 07, 2022, 10:01:41 pmVery nice news!The link for download dont work!

author: rplabs
author_rank: Contributor
timestamp: October 12, 2022, 06:11:40 pm
content: Quote from: ve2ulu on October 11, 2022, 01:35:44 pmRemove the . (dot) at the end.

author: mrf245
author_rank: Regular Contributor
timestamp: March 09, 2023, 08:18:24 am
content: Quote from: dr-chrisp on October 07, 2022, 10:01:41 pmVery cool!I went through the previous post and knew that there was MVME-162 BUG firmware, but after reading some information, I consider that this firmware does not seem to be suitable for use on MS462X (at least I don't know exactly how to restore system settings by command). Modifying BBRAM directly doesn't seem like a perfect idea (for some VNAs it won't boot). Thanks for your work!

author: ve2ulu
author_rank: Contributor
timestamp: December 20, 2023, 04:37:45 am
content: Quote from: dr-chrisp on October 07, 2022, 10:01:41 pmThanks a lot for this.I test 3 cpu board, all with bbram trouble, all have recover.Is 1 hour to upload from my pc, but is work great.Anyone have info on rfsource in this machine? i have 2 master and 2 second source with bad rf output.

author: mbielman
author_rank: Contributor
timestamp: December 20, 2023, 06:19:14 pm
content: Are there instructions for using the Delphi app? The html link just has an exe file and when run I get an error.

author: ve2ulu
author_rank: Contributor
timestamp: December 20, 2023, 08:32:22 pm
content: Quote from: mbielman on December 20, 2023, 06:19:14 pmI remove the dot at the end of the link in my reply.The original reply have dot at the end and cause error in browser.I open one rf source, is optional second rf source.It's nightmare to open, rf shield gasket glue all together, 4x TO220 are screwed on one side and final rf amp are glue on other side, mostly impossible to split without some trick.I unscrew four regulator with 90degree screw bit, after, i unscrew the final amp to the heatsink block.

author: Aleuli
author_rank: Newbie
timestamp: April 11, 2024, 12:51:20 pm
content: I've scored a damaged MS4623B on Ebay. This thread made me confident to get it on "as is" condition.First problem was the battery BBRAM issue of course, solved it thanks to info here. With the little caveat that I was unable to find a 27C040 at mouser or Digikey, so I used the SST39SF040 with some Kapton tape and micro soldering to solve the issue with pin 1 and pin 31 incompatibility.The second problem was the -15V rail having -22V. This was caused by a choke inductor inside the power supply that choose dead by overheating. Fortunately, I had a similar donor power supply and after some fixing of burnt pcb traces everything went to normal.Worked for a while and then a third problem did show on the error log: "0502 REFERENCE CHANNEL FAIL". I traced it to be de JR signal absent on the down conversion module. Checking MMICs voltages on the input and output found a bad one. Now waiting for the ERA4+ to arrive.Meanwhile I found the LCD screen to be really dim. While browsing for a CCFL to led conversion kit on ebay found thishttps://www.ebay.com/itm/134006180669that claims 900 NITS and 1000:1 contrast! Bought 3 and will attempt to make them work on this and also on a E4406A and a CMU200 I also have.I am really grateful to all that contributed to this thread.

author: scott K
author_rank: Newbie
timestamp: March 12, 2025, 04:52:46 pm
content: Hello,This is my first time posting here.I have a fully working MS462X VNA (I am at work and can not remember it's S/N or exact model) it does not have option 24 installed, sadly. I wish it did.Thanks to this site, I averted disaster.I acquired the unit from work, who were going to crush it.The LCD backlight CCFL was bad. I replaced it by buying one at Plazmo here in USA. I forgot the part number but I have a spare and can get that later. They had a direct exact fit, it cost maybe $30? I found it by searching the PLazmo site for the LCD display model.After that I noticed that the LCD backlight power supply had blown a fuse, probably from when the old back light met end of life and had higher current. The fuse was not available so I used a small glass fuse and soldered wires and used heat shrink over that.After inserting the fuse the unit display worked!Once the unit was on, I told work and they said it was not a wanted VNA so take it or crush it. So i took it.I read here that the batteries are a pain the foot and cause dead VNAs.Thanks to EVERYONE in this thread I was able to not cause mine to die.By using a variable power supply, multimeter, ammeter and replacement batteries I was able to devise a keep-alive-circuit while swapping batteries out with new.Of course before any of that I bought new batteries.I bought a snap-hat from Digikey and the large coin cell from a nearby store here.Idea was this...use multimeter, measure batteries. Do not cause short circuit with meter. Insulate probe tips with kapton etc, except for tiny tip of probe. Keep meter in Volts, never current or ohms by accident.I recorded battery voltage, and each was dangerously LOW.I measured new replacement battery voltage and recorded that.I then used a variable power supply , some test leads, and clips (whatever worked) and put an ammeter in series with it, and the ammeter was set to low range like 1mA. I tested this circuit using a resistor. I jiggled the cables to make sure things were tight and good.I then set the variable supply to the same voltage as the old battery and clipped the leads from the supply and ammeter onto the battery. The ammeter read almost 0.000mA and I adjusted the dc supply very carefully till the ammeter showed current going into the battery. I then carefully removed the old battery and the current went up as expected. Now the unit was kept alive by only the DC supply. I then adjusted the dc supply to the voltage of the new battery and inserted the new battery. The dc supply showed almost 0.000mA again.I then removed the test leadsThis process was easy enough on the larger coin cell. But the snap hat battery was VERY HARD!I noticed that two leads of the EEPROM that has the snap hat on it has the battery power present. I devised a way to use DVM test leads as leads to supply power when I removed and replaced the snap-hat battery. It worked but was very nerve wracking. I used a DIP IC puller to yank out the snap hat. The PCB was taped down to the top of the VNA case to hold it when I did all of this. I used a LOT of tape to do this. I had no help from anyone.in the end my unit has new batteries and works.Now time to give back to here if I can!If someone can tell me how to read out/ backup what I have in memory I will gladly share it here. However I can not afford to lose my VNA in the process.This is my fist VNA for my "home lab" and was lucky to get it and it working. I want to keep it alive as long as I can.I also DO have access to a CAL kit and Power meter. I was able to go through power cal. So that data is in my unit memory somewhere.I want to read out a complete image for you all if that is possible.Please keep in mind I work a lot and won't be able to get to this task right away. But I will try.Thank you for reading this.

author: ve2ulu
author_rank: Contributor
timestamp: March 13, 2025, 02:49:37 am
content: First, memory dump, fellow the instructions in the tread.You save all your ram with calibrate and serial number in a file and if Bbram fail later, you have a backup to rebuilt bbram.This machine are very complex but in final, all you need is compatible power meter to calibrate!A 10mhz source reference are nice but not mandatory.Vga port are nice if lcd are defective.I test and use network port, not very fast and if you put wrong IP adress in config, you brick the software!I put old SCSI external hdd, is very useful to save all et retrieve cal and setup.

author: scott K
author_rank: Newbie
timestamp: March 13, 2025, 03:07:59 pm
content: Thank you VE2ULU!Thank you for the advice!I will read through all the posts to learn the save procedures. Can one save a full backup to floppies? I still have a stash of those, actually...Also, how does one hook an external SCSI HDD to the VNA? And are those available anymore?I do have access to the Anritsu ML2438A power meter and a variety of power sensors, and a GPIB cables etc. So, I should be able to calibrate again. I hope.When I get my data, how do I share here?Thank you again!

author: scott K
author_rank: Newbie
timestamp: March 15, 2025, 12:29:38 am
content: In order to capture a working memory dump from a working BBRAM area I did the following...I booted my calibrated unit up S/N 010502 and powered it onwhen boot loader loaded, and asked me to press 1 for menu I did soI then ran Monitor by pressing 6I then performed the following at the "Bug>" promptmd FFFC0000:8000;bI captured that to log and attached here.Hope this helps.I have also been capturing other areas... and I do not know if that is useful..when done I turned off VNAI powered it back on, and noticed my calibrations are gone.I can not say if my attached data has any calibrations in it.Sorry.UPDATE: 3-15-2025I tried to calibrate for power flatness and also perform user calibration and tried to suck the files out of the VNA and have attached what I have

author: ve2ulu
author_rank: Contributor
timestamp: March 16, 2025, 02:06:14 am
content: check reply #93If your rf source are bad, the cal dont work great.To check the rf source, read service manuel, you have procedure to do to read rf level without any compensation.You see my two picture one bad rf source and one good.For BBram lost cal, i dont know, is a mistery for me, you do MD command, Memory Dump.... this command never write...I repair 1 rf source and 1 rf source are open on my bench and i dont have finish repair yet.Open rf source is a nigtmare!

author: SinoSeer
author_rank: Newbie
timestamp: May 07, 2025, 09:30:35 am
content: Thanks for your contributions.Let me share my experience.I bought a used 3-port MS4623B. Besides an ALC error in the SRC2(Switch-IC GSWA-4-30 is dead), everything else is OK. After I thoroughly cleaned it with pure water and alcohol, It stopped at the APP startup screen, so I came here for help. Following previous methods, I used "cf rtc, rtc adr" to reset all NVRAM contents(Serial Port 9600n81), and read back as 0, After an unexpected power cycle, it finally turned into a brick.Then I used a ROM(U75) with 162BUGV4.0, modifying few key parameters in the BBram_restoration.pdf(Serial Port 19200n81). Replace the original ROM, check the parameters listed in the Pdf, then updated the APP 1.20, Ms4623 was basically restored. I replaced the defective GSWA-4-30. After performing ALC calibration with a power meter, the self-test passed, but there were error messages during startup and diagnostics, like this"SKT SYS IDX ERROR""SKT NO SUCH ADDRESS""SKT RECEIVE ERROR"Does anyone know about this?Here are some tips from my experience: After restoring the BBRAM (M48T80) and writing the SN, install and start APP 1.20 (not APP 2.05, as APP 2.05 always resets the SN to "INVALID"). Then, if the VNA has OPT24 installed, you can update to APP 2.05, and the SN won't be reset again. For open the SRC, Note that there is a glued pad on the aluminum cube which is attached to one IC near the front port of the SRC module., Heat this area maybe help. Or use a long stick flat-edge screwdriver, insert it into the gap between the upper casing and the aluminum cube, turn around the screwdriver to separate them.Best regards.

author: SinoSeer
author_rank: Newbie
timestamp: May 14, 2025, 07:36:35 am
content: The SKT error has been resolved. The error message indicates that there is a problem with the network configuration of the VNA. When this error occurs, the VNA's network is not functional and cannot be pinged from a computer.Fix method: Set the first 64 bytes of the bbram content to the following data (this data is from a bbram backup read by a user in this thread). After starting the VNA, modify its network IP parameters in the app.FFFC0000 05 29 19 89 00 00 07 27 01 00 00 00 00 00 00 0AFFFC0010 00 00 25 80 01 00 00 00 C0 A8 0A 01 01 00 00 00FFFC0020 C0 A8 0A 08 FF FF FF 00 00 00 00 00 00 00 00 00FFFC0030 00 00 00 00 00 00 00 00 01 00 04 00 00 00 00 00FFFC0040 01 00 05 80Thanks for your contribution! Love you guys!Best Regards!

author: ekio
author_rank: Newbie
timestamp: September 13, 2025, 09:26:38 am
content: Hi Scott,Did you use some cable to extend the board outside when changing the snap battery? I'm trying to read all process before power-up a MS4622A with look-like broken LCD, dont want to loose CAL data (if exist)I pull out the board to measure the snap battery and is 0.4V... the big CR2032 battery 0.06VThanks,Emilio