Looking for user/programming manual for Anritsu MF91A Wavelength Meter  - Page 1
Forum section: electronics / testgear

author: _Wim_
author_rank: Super Contributor
timestamp: October 16, 2016, 07:14:33 am
content: Hi, I recently acquired an Anritsu MF91A Wavelength Meter, and would like to use its GPIB port. The unit responds to *IDN?, but I can seem to find any manual describing the other commands. I do not even find a user manual, the only thing I found so far are the attached datasheets. So if anyone has some more info on this unit they can share, it would be much appreciated.

author: _Wim_
author_rank: Super Contributor
timestamp: October 27, 2016, 07:18:24 pm
content: Nobody any more info on this one?

author: PA0PBZ
author_rank: Super Contributor
timestamp: October 27, 2016, 08:20:29 pm
content: I tried to find something but there's not much out there. Can you read the EPROMs and get the commands from there?

author: _Wim_
author_rank: Super Contributor
timestamp: October 27, 2016, 08:24:56 pm
content: Thanks for your answer. Yes, there is indeed not much out there, I spent already quite some time searching. I was hoping somebody had still a printed manual somewhere... About reading out the Eproms, I could give that a try, but I would need to buy a suitable programmer first. I will check which type is used this weekend.

author: _Wim_
author_rank: Super Contributor
timestamp: October 30, 2016, 09:29:13 am
content: There are 2 Eproms inside, both type HN27C64G-20. I have ordered an Minipro TL866A which supports this device. Hopefully I can extract some more info this way...

author: PA0PBZ
author_rank: Super Contributor
timestamp: October 30, 2016, 09:38:49 am
content: Quote from: _Wim_ on October 30, 2016, 09:29:13 amThat's nice. What processor is in there? If it is 16 bits you probably have to interleave the contents of both eproms to make sense. If you can't work it out just attach the contents and we'll all have a play.

author: _Wim_
author_rank: Super Contributor
timestamp: October 30, 2016, 10:02:52 am
content: It is an 8-bit Toshiba TMPZ84C00P processor. The unit contains 4 boards (sorry, taken with my cellphone only because this was nearby): a display board, a processor board, an AD and DA board and an analog board. The unit is really jam-packed, and wires all over the place.Currently, the unit displays peak wavelength and corresponding power, but I would like to read out the entire scanned spectrum using GPIB. When I bought then unit, I was hoping that the BNC connectors at the back ("power" and "wavelength") would allow me to use my scope in XY-mode to have a nice spectrum display, but wavelength and power are an 1Vrms signal proportional to actual peak.

author: _Wim_
author_rank: Super Contributor
timestamp: November 06, 2016, 12:42:41 pm
content: Ok, here is the contents of both eproms. Any tips how to proceed? I looked for human readably text using notepad++ using different encodings, but not much useful there. What software is recommended for this purpose?Edit: typos

author: _Wim_
author_rank: Super Contributor
timestamp: November 06, 2016, 01:04:48 pm
content: Using the fee dZ80 software (http://www.inkland.org.uk/dz80/) I was able to generate two assembly files...

author: _Wim_
author_rank: Super Contributor
timestamp: November 06, 2016, 01:14:20 pm
content: I first joined both binary files, and then ran the dZ80 software. This way I get one complete assembly file. To reverse engineer this one however will not be so easy I think..

author: PA0PBZ
author_rank: Super Contributor
timestamp: November 06, 2016, 02:36:50 pm
content: Looks like you have a ROM form 0 to 03FF and a RAM from 6000 upwards. Can you identify the RAM? I'm not sure if they only use I/O to talk to the peripherals or that there is also some memory mapped stuff.This is disappointing, I expected to see the commands in there but no. I also combined the ROMs and disassembled the code and it looks like they are doing some bit banging for the GPIB. I think I found a clue where they look for 0A or 0D/0A but I need some more time to make sense of it. There's only 10 instances of "I" in the whole ROM and none of them is in a compare instruction...I did find some compares looking for the following, which could or could not be (part of) some kind of GPIB commands:B01C02D012E02F03R0What is the *IDN response? That could give me another clue about what is going on there.Code:ROM:1B11 11 3D+ ld de, 643DhROM:1B14 21 24+ ld hl, 6124hROM:1B17 1A ld a, (de)ROM:1B18 13 inc deROM:1B19 FE 0A cp 0AhROM:1B1B CA C8+ jp z, loc_1BC8ROM:1B1E FE 0D cp 0DhROM:1B20 20 09 jr nz, loc_1B2BROM:1B22 1A ld a, (de)ROM:1B23 FE 0A cp 0AhROM:1B25 CA C8+ jp z, loc_1BC8ROM:1B28 C3 B3+ jp loc_1BB3

author: _Wim_
author_rank: Super Contributor
timestamp: November 06, 2016, 02:59:09 pm
content: Thanks for your efforts.This is the reply to IDN? : <- ------LC3------«x0D»

author: _Wim_
author_rank: Super Contributor
timestamp: November 06, 2016, 03:04:46 pm
content: I though I seemed to remember I got different results previously, and indeed I did. I connected a helium laser source, and got a different feedback for the same IDN? command: <- 0632.8IC3-56.20«x0D» This means it replies with the wavelength (623.8nm) and power (-56.2 dbm) even on a IDN? command.Could this mean there is only 1 GPIB feedback?

author: _Wim_
author_rank: Super Contributor
timestamp: November 06, 2016, 03:10:33 pm
content: Dammit, indeed it seems so. Connected my second laser (850nm), and tried different commands. All give the same feedback... I did not notice this before, because I never connected a known source well playing around with the GPIB, and figured what I got back was just the serial number of the unit...

author: _Wim_
author_rank: Super Contributor
timestamp: November 06, 2016, 03:19:41 pm
content: So when I change from Dbm to µWatt, the unit indicated "IC1" instead of "IC3". When I change to "relative mode", the unit indicated "IC4". When I put the unit in uncall mode (I think this measures power over its entire wavelengt instead of a specific wavelength), the unit replies with "IU4" (when still in relative mode). Switching back to dbm, the unit replies with "IU3".I need to swith to "local" again to be able to switch from units, otherwise I cannot change them. So maybe some commands do exist to swith between units and from uncal to cal.

author: _Wim_
author_rank: Super Contributor
timestamp: November 06, 2016, 03:21:49 pm
content: The " ------LC3-----" reply was signal low because the cap was on and no light source was connected...

author: PA0PBZ
author_rank: Super Contributor
timestamp: November 06, 2016, 05:04:37 pm
content: Quote from: PA0PBZ on November 06, 2016, 02:36:50 pmLooking again I think these are valid commands:B0 B1C0 C1D0 D1 D2E0 E1F0 F1 F2R0R0 seems like a good candidate for reset...

author: _Wim_
author_rank: Super Contributor
timestamp: November 06, 2016, 06:03:11 pm
content: Grrrr, my unit just died on me. No display, no nothing. Time for some electrical debugging first. I will keep you updated.

author: _Wim_
author_rank: Super Contributor
timestamp: November 06, 2016, 07:52:11 pm
content: No signs of obvious damage, fuses are still ok, voltages on main filter caps also. Will start with a recapping job first (was planning to do that anyway), hopefully (probably wishful thinking) it jumps back to life after that.

author: PA0PBZ
author_rank: Super Contributor
timestamp: November 06, 2016, 08:21:39 pm
content: Good luck with that Wim, I've been looking at the disassembly a bit more and I can see how it builds the output buffer in a very weird way. It starts with filling it with either spaces or "-", then it adds characters in the middle like C, U, H, L, I, N and then it reads the characters back to make decisions about what else to put there, not sure what the original programmer smoked... Anyway, I will put it aside and wait for you to resurrect the thing.

author: _Wim_
author_rank: Super Contributor
timestamp: November 06, 2016, 08:24:34 pm
content: Thanks for your assistance so far. Looking forward to test the "new" commands. I am quite sure I will be able to fix this, but it always takes quite some time...

author: _Wim_
author_rank: Super Contributor
timestamp: November 11, 2016, 02:59:32 pm
content: Hi,A repaired solderjoint later, I could test my "new" commands:B0 => switches to the second channelB1 => switches to first channel? (I have only 1 channel, so I cannot test this)C0 => goto uncal modeC1 => goto cal modeD0 => read-out in dBmD1 => read-out in µWattD2 => relative modeE0 => turn display backlight onE1 => turn display backlight offF0,F1,F2 =>? Does apparently nothing I can seeR0 => give a different reply to the read command, but cannot figure out what it means. By using R1 I can get back to the normal reply.During the test, a laser source of 851nm was connected with an output power of approx -1dBm

author: _Wim_
author_rank: Super Contributor
timestamp: November 11, 2016, 03:01:22 pm
content: Forgot to mention, only after the second R0 I get a different responce. Same for R1...

author: _Wim_
author_rank: Super Contributor
timestamp: November 11, 2016, 05:25:04 pm
content: Quote from: PA0PBZ on November 06, 2016, 05:04:37 pmCould you explain how you found these? Now I know they exist, I am not even able to find them back in the assembler code, let alone to find new ones... Is there a special software tool you use for this? (for ex. IDA Pro?)

author: PA0PBZ
author_rank: Super Contributor
timestamp: November 11, 2016, 06:36:22 pm
content: Quote from: _Wim_ on November 11, 2016, 05:25:04 pmHi Wim,Yes, they where not easy to find, they do not exist as readable text which you see in almost all firmware. And yes, I use IDA Pro but you can find the same in your disassembly.It's just a combination of patience, luck and experience I guess. When I started with micro's it was all assembly language and I can still find my way around it, and this is a Z80 of course, the same chip I started with a long time ago.Here is an example from IDA, the comments are mineCode:ROM:1B2B FE 42 cp 42h ; 'B' ; B0 B1ROM:1B2D 20 11 jr nz, loc_1B40ROM:1B2F 1A ld a, (de)ROM:1B30 06 02 ld b, 2ROM:1B32 FE 30 cp 30h ; '0'ROM:1B34 28 06 jr z, loc_1B3CROM:1B36 05 dec bROM:1B37 FE 31 cp 31h ; '1'ROM:1B39 C2 B3+ jp nz, loc_1BB3 ; Not a valid commandROM:1B3CROM:1B3C loc_1B3C: ; CODE XREF: sub_1A6D+C7jROM:1B3C 70 ld (hl), bROM:1B3D 13 inc deROM:1B3E 18 D4 jr loc_1B14ROM:1B40 ; ---------------------------------------------------------------------------ROM:1B40ROM:1B40 loc_1B40: ; CODE XREF: sub_1A6D+C0jROM:1B40 23 inc hlROM:1B41 FE 43 cp 43h ; 'C' ; C0 C1ROM:1B43 20 0F jr nz, loc_1B54ROM:1B45 1A ld a, (de)ROM:1B46 FE 30 cp 30h ; '0'ROM:1B48 38 69 jr c, loc_1BB3 ; Not a valid commandROM:1B4A FE 32 cp 32h ; '2'ROM:1B4C 30 65 jr nc, loc_1BB3 ; Not a valid commandROM:1B4E E6 0F and 0FhROM:1B50 77 ld (hl), aROM:1B51 13 inc deROM:1B52 18 C0 jr loc_1B14This part decodes the B0/B1 and C0/C1 commands, but it is not easy to see what they do, they just set a bit or store a value somewhere in memory and I have no way of telling what that does. If there is anything specific that you want me to have a look at please let me know.

author: _Wim_
author_rank: Super Contributor
timestamp: November 11, 2016, 07:10:56 pm
content: I have installed the free version of IDA for this project, but unfortunately it does not support the Z80. The paid version is too expensive for my very limited use (this little project). The file from IDA looks a bit more readably, but still, I would not have realized that these were GPIB commands.I am looking specifically for a command that returns an array with all the measured light intensities for the scanned spectrum. This unit scans the attached light source from 600nm to 1000nm, with a resolution of 0.1nm. I would like to display the completely scanned spectrum, and not only the reported peak value. This unit is quite old (1985), but when I connected a HeNe laser source, it still exactly reports 632.8nm, I was quite impressed by that.

author: PA0PBZ
author_rank: Super Contributor
timestamp: November 11, 2016, 07:45:46 pm
content: Quote from: _Wim_ on November 11, 2016, 07:10:56 pmI already understood what you want from a previous post, but do you even think that there is such a command?Maybe the commands that have an unknown action (F0, F1 and F2) or the R0 one (I can't remember an R1 but I will have to check again) need an additional parameter, like the wavelength? (Hmm, F for frequency...) Maybe it is not possible to return the whole scanned spectrum automatically but if you can set the wavelength and then get the intensity it could solve your problem. I have to look at the firmware again to see if it accepts/expects parameters.

author: _Wim_
author_rank: Super Contributor
timestamp: November 11, 2016, 07:53:49 pm
content: Yes, I do not know if there is such a command. Reading out the intensity for a specific wavelength would off course also be a good solution. I have already tried to add a wavelenth to the unknown intructions, and also tried to complete alpabet from A0 to Z1 to check if a get a different responce.But so far no other returns exept for R0, but I do not understand what this feedback is... I have also checked other manuals from Anritsu to check if they have comparable commands, but so far found nothing comparable.I am already very gratefull for the commands I have, this allows me to perform some long term logging for the sensor I am working on.

author: PA0PBZ
author_rank: Super Contributor
timestamp: November 11, 2016, 08:32:43 pm
content: After the second R0 it looks like you get 4 different power measurements:Now the question of course is, what are they? the 4 strongest points after the 851.5 -01.02? The fact that you have to send R0 or R1 twice makes me think that they expect another parameter, did you try to send R0 or R1 followed by a wavelength either on the same line or on a second line?<<x20>> is just a space, not sure why it shows in hex here.

author: _Wim_
author_rank: Super Contributor
timestamp: November 11, 2016, 08:54:40 pm
content: Quote from: PA0PBZ on November 11, 2016, 08:32:43 pmJust played around a bit more. It seems that "sending it twice" is related to timing. If I use SEND and afterwards READ, I only need to send R0/R1 once. But if I use the SEND&READ function of my software, I need to send R0/R1 twice.I have added a wavelength directly to the R0 command (seperated by a space), and on a new line (seperated by , or. I have tried many other combinations also, but always get the same feedback.If do not think the feedback on R0 are 4 power measurements, becasue the light source I used is monochromatic, so no other wavelenth should have a measureable intensity (at least not when seperated by 0.1nm)

author: _Wim_
author_rank: Super Contributor
timestamp: November 11, 2016, 09:05:48 pm
content: Quote from: _Wim_ on November 11, 2016, 08:54:40 pmOk, I have to take that back a little. The feedback is related to power, but I do not think is are different wavelengths. Below is the feedback I get by reducing the level of the laser each time with 1 db.So 3 of the 4 fields nicely drop with one dB (power of the peak dropped from -4dBm to -10dBm in these 6 steps)

author: _Wim_
author_rank: Super Contributor
timestamp: November 12, 2016, 07:21:49 pm
content: I have found an Anritsu manual that has simular commands:https://dl.cdn-anritsu.com/en-us/test-measurement/files/Manuals/Programming-Manual/10370-10286.pdfI have tried to supply parameters using for example "F0 800_NM" and "F0 800" (same for F1 and F2), but I get no different reply so far.

author: PA0PBZ
author_rank: Super Contributor
timestamp: November 12, 2016, 07:28:24 pm
content: That confirms that Anritsu uses these letter-figure combination of GPIB commands, but that is something we already found. Since the manual you found is for a signal generator I have not much hope that there are similar commands apart from IDN.

author: _Wim_
author_rank: Super Contributor
timestamp: November 12, 2016, 07:34:12 pm
content: Most Anritsue GPIB command (probably of more modern units) look more "standard" as used by HP and R&S. This manual uses also the letter/figure combination.I agree the commands will not be simular, but there is a good change F0 to F2 will also modify parameters.I was also looking for the way they make longer commands, which separators are used, and how they are triggered.

author: PA0PBZ
author_rank: Super Contributor
timestamp: November 12, 2016, 07:48:15 pm
content: Look at this (chapter 5.3):http://exodus.poly.edu/~kurt/manuals/manuals/Other/ANRITSU%20ML93A%20Operation.pdf

author: _Wim_
author_rank: Super Contributor
timestamp: November 12, 2016, 08:05:41 pm
content: Thanks again! So this is indeed also in my unit what F0, F1 and F2 mean...So now only R0 and R1 can bring the needed information

author: PA0PBZ
author_rank: Super Contributor
timestamp: November 12, 2016, 08:32:17 pm
content: Quote from: _Wim_ on November 12, 2016, 08:05:41 pmI had another look at the R command:So if you send R0 it stores a 1 in location 6400H, if it is not a 0 it stores a 1 there.This changes the output type, if there is a 1 @ 6400H it outputs the 4 numbers:if there is a 0 it outputs the normal format. So... sorry but it's not going to do what you want.

author: _Wim_
author_rank: Super Contributor
timestamp: November 12, 2016, 08:49:01 pm
content: I was already afraid so...Many thanks for your help, it was very much appreciated! I would never have gotten this far alone.I have attached a summury of the commands discoverd if anyone would need them later on.