Does anyone recognize this board, is it a gpsdo?

[alank2]

http://www.ebay.com/itm/10-MHz-Double-Oven-OCXO-Double-sinewave-EPSON-TOYOCOM-TCO-6920N-10MHZ-/111693078549?pt=LH_DefaultDomain_0&hash=item1a016d2015

[Lightages]

It certainly looks like one. Hard to say though without more information or details on the other metal can on the board.

[Deathwish]

the smaller can is a  ublox le Gps receiver, I just purchased one.This one to be precise.

http://www.ebay.co.uk/itm/291140312483?_trksid=p2057872.m2749.l2649&ssPageName=STRK%3AMEBIDX%3AIT

[Lightages]

Yes, I just found something like it on the UBlox website.

[edpalmer42]

Didn't you notice that he has pictures of TWO DIFFERENT BOARDS!!!!

So I asked him which one he was selling.  He said he's selling the board in the first picture.  Not the GPSDO.  Just the oscillator that was removed from the GPSDO plus a little support circuitry.

Just a little deceptive, wouldn't you say?

Ed

[alank2]

Yes, I noticed.  Very lame as he has the one with the GPS as the main picture...

[grumpydoc]

Yes, I noticed.  Very lame as he has the one with the GPS as the main picture...

For fun I bought one - I got the board with the GPS receiver.

Might be interesting to figure out how to talk to it.

The large chips on the board are a NEC uPD70F3738 micro-controller, a Xilinx XC3S200A FPGA and a M29W320EB 32M flash.

It is marked NEC NWM-034241-201 on the top silk screen and NEC NWA-057706-001 on the bottom silk screen. There's also a serial No (2641) and date of manufacture (2010)

Photos to follow.

[edpalmer42]

I wish he'd make up his mind what he's selling.

I have no interest in the oscillator, but the GPSDO would be interesting to play with.  But since he told me that the first picture, i.e. just the oscillator, is what he's selling, I'm not willing to deal with him.

[grumpydoc]

I wish he'd make up his mind what he's selling.

I have no interest in the oscillator, but the GPSDO would be interesting to play with.  But since he told me that the first picture, i.e. just the oscillator, is what he's selling, I'm not willing to deal with him.

I confess I bought it as an unknown GPSDO to play with - I was quite prepared to give some negative feedback for misleading photos.

The seller has 2 left sold out - but, I agree, his photos are still ambiguous.

Interestingly the board with just the ocxo is available from another seller (well, could be the same guy using a different ID)

[grumpydoc]

the smaller can is a  ublox le Gps receiver, I just purchased one.This one to be precise.

http://www.ebay.co.uk/itm/291140312483?_trksid=p2057872.m2749.l2649&ssPageName=STRK%3AMEBIDX%3AIT

The one on the board is an LEA-5T

[Deathwish]

I think I would like to get one then shove it in a box with the intention of making something only to forget it as i did the one I just bought 

[grumpydoc]

A couple of photos, as promised (click on image for slightly larger version)

Top of board:



The GPS module is a ublox LEA-5T with what looks to be an SNB RF connector, the white connector has traces going to a max3243 (just below/right of Z5) so I presume carries a serial interface. The blue inductor and four caps at the bottom left are DC supply filtering, the three other inductors are part of separate DC-DC converters built around the tps62110 step-down converter and there are a couple of 3.3V regulators top right & top left. There's also a  Xilinx XC3S200A FPGA, presumably for glue logic.

Bottom of board:



This looks interesting, the first thing I noticed was several differential tracks running to the connector at the bottom of the board - these run to two Micrel SY89833 LVDS fanout buffers - these have a 2GHz bandwidth and claim < 190ps rise and fall times so the 10MHz out is going to have sharp edges! The inputs to the fan-out buffers come from a further pair of LVDS buffers, in this case the TI LVDS104M. Actually I'm slightly puzzled here. The datasheet for the LVDS104 says it is a 16 pin part, but there are 8 pin parts on the board. They are clearly marked with the TI logo and LVDS104M but I can't find this part on the TI  web site - does anyone have any pointers?

The OCXO output itself runs through what looks like some LC filtering, then to a 74LCX244 buffer, then presumably into the LVDS104's

As well as the LVDS outputs the bottom connector has DC in - presumably 12V as it runs straight through to the OCXO VCC pin with just a bit of LC decoupling. there are also 15 lines on the opposite side to the LVDS output, most of these have 10k pulls downs attached (the row of SMD resistors below Z5 on the top of the board). It is not possible to trace them visually into the board after that so they could run up to the FPGS or the CPU - no idea whether they are a parallel interface or status lines or what.

Finally there are four TTL level lines running out to the unpopulated connector Z1, not sure what these are - some sort of serial debug interface (not JTAG as not enough pins).

I might power it later today and check that the 3.3V logic gets power with just 12V applied, I can't try it out properly until I get hold of a SNB to BNC adapter to hook it up to the GPS antenna.

UPDATE: Powered up, various LEDs flash & change so the processor is probably OK and 10MHz out of one set of LVDS outputs, so the OCXO is working (and the oven current conforms to the datasheet). The other set is inactive, there is nothing out of one of the LVDS104M's - but I don't know whether that's because of a fault or it's supposed to do that.

Datasheets

OCXO: http://www.wild-pc.co.uk/docs/TCO-6920N.pdf
CPU: http://media.digikey.com/pdf/Data%20Sheets/Renesas/uPD70F3737,38,92,93.pdf
RS232: http://www.ti.com/lit/ds/symlink/max3243.pdf
GPS: http://www.u-blox.com/images/downloads/Product_Docs/LEA-5_NEO-5_TIM-5H_HardwareIntegrationManual%28GPS.G5-MS5-09027%29.pdf
DC-DC: http://www.ti.com/lit/ds/symlink/tps62110.pdf
FPGA: http://www.xilinx.com/support/documentation/data_sheets/ds529.pdf
LVDS: http://www.micrel.com/_PDF/HBW/sy89833al.pdf http://www.ti.com/lit/ds/slls396f/slls396f.pdf

[lukier]

I just got my board as well.

TI LVDS chip is probably this one:
http://www.ti.com/lit/ds/symlink/sn65lvds2.pdf

There is a couple of opamps (OP291, NJM5534), but I didn't spot any DAC (well it may be one of the tiny QFN equivalent SOT-23-5 parts) or precise voltage reference. How they tune the OCXO? PWM generated DAC? There is a fair amount of R/L/C components around these areas so that seems probable.

I have a gut feeling that this might come from some NEC telecom equiment. People usually associate rubidium with base stations, but OCXO based GPSDO is pretty much as good as rubidium one.

On one hand it would be great to reverse engineer this particular board - the MCU might be implementing some clever Kalman filter based tuning and learned the aging parameters of this particular OCXO (hypothesis). On the other hand this MCU is a bit too exotic to me to bother either reverse engineering FW blobs or write FW from scratch, so I'm tempted to salvage the parts and reuse in my own design. 

[grumpydoc]

I just got my board as well.

TI LVDS chip is probably this one:
http://www.ti.com/lit/ds/symlink/sn65lvds2.pdf

Yes, I came across that this morning in an idle minute I had to hit google. Looks as though I should have just read the part No as "LVDS1"

There is a couple of opamps (OP291, NJM5534), but I didn't spot any DAC (well it may be one of the tiny QFN equivalent SOT-23-5 parts) or precise voltage reference. How they tune the OCXO? PWM generated DAC? There is a fair amount of R/L/C components around these areas so that seems probable.

There's a D to A on the CPU - only 8 bits but it has two channels so they could be scaled and added to give more resolution. It should be easy enough to trace the drive back - it comes out of the 5534 op amp.

I have a gut feeling that this might come from some NEC telecom equiment. People usually associate rubidium with base stations, but OCXO based GPSDO is pretty much as good as rubidium one.

I would assume so - not something I know a lot about.

On one hand it would be great to reverse engineer this particular board - the MCU might be implementing some clever Kalman filter based tuning and learned the aging parameters of this particular OCXO (hypothesis). On the other hand this MCU is a bit too exotic to me to bother either reverse engineering FW blobs or write FW from scratch, so I'm tempted to salvage the parts and reuse in my own design. 

I already have a rubidium and GPSDO so this is just idle curiosity, especially as I don't have anything which wants LVDS and the connectors on the board aren't exactly hobbyist friendly. I'll be happy if I can see that the it has locked and maybe see if there's anything sensible on the RS232 interface.

Have ordered a GPS puck with SMB connector - might get chance to play a little more later in the week.

[grumpydoc]

but I didn't spot any .... precise voltage reference.

There doesn't appear to be one - the two analogue V_REF inputs are tied to V_DD, which comes straight from one of the DC-DC converters.

It is going to be slightly more of a challenge to trace the two analogue output pins to see if they are used to drive the control voltage as the traces are not visible on the top of the board and I need at least three hands to hold the board and two meter probes

[lukier]

I'm also looking at this board ATM. It seems very sophisticated. IC6, IC7 and IC8 are all LM71 SPI temperature sensors. Filters on the OCXO output produce nice 3Vpp sine wave, before it enters LCX244 and later LVDS drivers.

I need to figure UARTs, as I didn't saw with the scope any traffic on the pins of the white connector.

With 3 DC-DC converters generating 5/3.3/1.2V I also wonder what is the purpose of IC9/IC10 (3.3V LDO I presume) - cleaner power for the analog stuff?

Also, I wonder, what are these SMD power resistors (2R70) along with unknown SOT-223 devices.

[grumpydoc]

It should be easy enough to trace the pins back to the MAX3243 and then hopefully to the processor to see which are transmit and which receive.

However, the UARTs in the CPU only provide TXD and RXD - no modem control so you only need three pins and there are 9+ground on the connector. It looks as though all 9 connect to something.

I had a go at tracing the DAC outputs from the CPU, so far with no luck.

[Vgkid]

I bought one, so I will start following this thread. At least it has a rather good ocxo, though i wish more drift specs were given.

[grumpydoc]

OK, had an idle 20 minutes between other jobs and travelling between sites

So - with pin 1 top right (arrow on silk screen) and then counting down and then right (so odd numbered pins across the top and even numbered pins on the bottom row) we have

Z5 pin	MAX 3243 Pin	MAX3243 Function
1	GND
2	9	DOUT1 (RS232 TX)
3	4	RIN1 (RS232 RX)
4	GND
5	10	DOUT2
6	5	RIN2
7	?	not connected to MAX3243
8	GND
9	11	DOUT3
10	6	RIN3

TX and RX are from the boards perspective.

I haven't traced these back to the CPU - one problem is that a lot of the CPU output lines run through 100R resistors which means that the meter's continuity buzzer doesn't work and I have run out of time to do any more for the moment. The most obvious is that they map directly to the three UARTA channels.

[grumpydoc]

I'm also looking at this board ATM. It seems very sophisticated. IC6, IC7 and IC8 are all LM71 SPI temperature sensors. Filters on the OCXO output produce nice 3Vpp sine wave, before it enters LCX244 and later LVDS drivers.

It does seem a bit over-engineered in parts. For one thing why a 200K gate FPGA.

I need to figure UARTs, as I didn't saw with the scope any traffic on the pins of the white connector.

See my previous post - still not had chance to trace these back. The 3243 is set up with auto power down enabled which means unless it detects a valid RS-232 voltage on the data in pins the output pins will be high impedance.

However, I've had a look at all of the DIN pins and can't see any activity there either - so it either doesn't announce anything useful over the serial port or, just possibly, the INVALID output from the MAX3243 is hooked to the CPU and used to disable serial output if there's nothing plugged into the port.

With 3 DC-DC converters generating 5/3.3/1.2V I also wonder what is the purpose of IC9/IC10 (3.3V LDO I presume) - cleaner power for the analog stuff?

Also, I wonder, what are these SMD power resistors (2R70) along with unknown SOT-223 devices.

No idea for now.

[lukier]

Thanks for tracing the 10 pin connector. I'll try to do some tests tomorrow.

For my purpose (GPSDO) all I really need is to tap 10MHz sine before LCX244 and feed it into a distribution amplifier.

By the way, is there any standard for 10MHz reference signal?

Some people just use multiple 74AHC04 to drive 50 Ohm load with a square wave, some say a nice sine is a must. My Hantek HDG2002B generator probably just has a Shmitt trigger gate at the input and that's it. I need to check my Racal-Dana 1992 counter schematic as well. It's a pity that DS1054Z doesn't have 10MHz input.

There should be 1pps signal somewhere on the board so I could connect that to RaspberryPi's GPIO and run NTP server as well.

It would be nice though to be able to get more internal data from this module, lock status, maybe tap into GPS UART, these temperature sensors etc.

[grumpydoc]

.....maybe tap into GPS UART.....

That, at least, is straightforward - the ublox serial TXD and RXD are connected to UARTA channel 2 on pins 35&36 of the CPU and I can see data on those lines with the 'scope.

I haven't had any luck at all tracing the serial lines from the MAX3243, they don't appear to connect to the CPU UART and I can't find them on the FPGA either.

[grumpydoc]

There should be 1pps signal somewhere on the board so I could connect that to RaspberryPi's GPIO and run NTP server as well.

Appears to be via X7/X8

Now that I have an antenna connected X8 initially flashes once per second missing every 10th second. Then both flash with X8 continuing to miss every 10th beat. I assume that means a basic GPS lock. After a while X8 stopped missing the 10th beats so I presume that means a better quality lock.

After a couple of hours running with a GPS antenna hooked up X7/8 are flashing in tandem at 1PPS and X4 is flashing rapidly - at this point I'd expect the oscillator control to maybe have a coarse lock so we will see if anything changes over the next 24 hours.

......


Well, after another hour or so X4 went steady and X5 starts flashing at 0.25Hz, I guess that means it locked - at least to some degree. At that point I turned the board over to look at the outputs and it looks like IC29 and it's associated fan-out buffer carry the 10MHZ and IC30 has a 1 PPS signal. Sadly turning the board pulled my dodgy power connection off so that's reverse engineering finished for now.

There is also a TTL level serial data burst every second on one of the pins on the top row of the connector - not coming from the CPU UART 

[lukier]

Now that I have an antenna connected X8 initially flashes once per second missing every 10th second. Then both flash with X8 continuing to miss every 10th beat. I assume that means a basic GPS lock. After a while X8 stopped missing the 10th beats so I presume that means a better quality lock.

After a couple of hours running with a GPS antenna hooked up X7/8 are flashing in tandem at 1PPS and X4 is flashing rapidly - at this point I'd expect the oscillator control to maybe have a coarse lock so we will see if anything changes over the next 24 hours.
......
Well, after another hour or so X4 went steady and X5 starts flashing at 0.25Hz, I guess that means it locked - at least to some degree. At that point I turned the board over to look at the outputs and it looks like IC29 and it's associated fan-out buffer carry the 10MHZ and IC30 has a 1 PPS signal. Sadly turning the board pulled my dodgy power connection off so that's reverse engineering finished for now.

There is also a TTL level serial data burst every second on one of the pins on the top row of the connector - not coming from the CPU UART 

Great job. I'm still waiting for my SMB GPS antenna.

Maybe first state is position surveying phase and after that it does the final lock.

I didn't have much time today, but I had a quick look. First I thought that that the power resistors measure OCXO current to detect when the heater has stabilized, but after a quick look it seems that the power resistors and associated opamp seem to have something to do with active antena power, maybe controlling the current or protecting against overcurrent.

It would be great to evaluate this board, i.e. holdover performance. It would take probably a couple of days of measurements to see if the board output drift is just what OCXO specs say or if they implement predictive control.

[Vgkid]

For the gps connector would it be a smb female?