Symmetricom S200 Teardown/upgrade to S250

[SoundTech-LG]

I did a little teardown of the Symmetricom S200 with Rb Osc Option. This unit came to me from the usual online flea mkt, with the description of: all lights lit red.
It was the SMPS. Replace 4 caps on the secondary side.
I then discovered that the real difference between the S200, and the more expensive S250, was the lack of in/out jacks. Everything else appears the same! The FW is the same on these models. Currently version 1.30, and is on the 512 mB CF card. I have cloned image files to create more CF cards.

I know the signals for 1PPS out, and 10mHz out, are there, at the jacks (measured them). All other input signal components seem to be stuffed. Just a check box in the web app to use any of the available reference signals (including input jacks).
So I will soon have the oem AMP jacks installed, and then thoroughly test out. A pretty easy upgrade to S250 model.

The big heatsink and thermal pad over the VIA Eden ESP 400 mHz Processor Samuel 2 http://Https://en.wikipedia.org/wiki/List_of_VIA_Eden_microprocessors

[SoundTech-LG]

So it went well. Not the prettiest cutting of the panel, but it was pretty tough plastic.
You can see the status of the inputs for 10mHz In, and 1PPS In. I just did a loopback from the outputs, so thorough test of out to in.
I also tried the IRIG out/in works flawlessly. Not sure how much more they charged for the S250, but I'm thinking at least $1K.
Nice upgrade.

[jpduffy1]

I picked up a S250i and it has Firmware 1.01 on it.   I tried to dd the CF card from a 256mb one to 512mb card, but now I cant seem to get the system to bootup.   When you cloned the card how did you do it?   Looks like a goofy set of partitions.   

When I compare the two cards they look identical with the exception of the total size of the card.

I have the software update files for 1.11, 1.26 and 1.36.   The update instructions for 1.26 said to load 1.11 on the 256mb card first then transfer it to the larger card boot that then do the 1.26 etc.

Any ideas?

Thanks

- Joe

[SoundTech-LG]

Ok, so you need to use the program HDD Raw Copy Tool. Copy a good booting CF card.

http://www.hddguru.com/software/HDD-Raw-Copy-Tool/

Then you can save the image as a file to your local HD. Then you can make as many spare copies as you like. It will only save it in the original CF card size format.

If you try to copy the image to a larger CF card it will work, but you are still left with the original (smaller) size. The remaining space is inaccessible.

BTW, Do NOT  take Windows suggestion to FORMAT the card!!!  It has a proprietary format on it!

As a favor can you post to DropBox,  the 1.36 version file???   Thanks!

If you need a good, booting CF card, I have the image file on DropBox.

I'd like to see those Symmetricom upgrade instructions too. How did you manage to get the FW? It seems under lock and key at Symmetricom/Microsemi.



 

[SoundTech-LG]

I have uploaded the 512mB bootable V 1.30 CF card image file to DropBox.
You can place on HD and then use HDD Raw Copy to create your bootable CF card.

When I hear from you we can do a file swap.

[SoundTech-LG]

I have determined U40, a DIP 8 93C46 EEPROM, holds all the Configuration for Model #,  S/N, & Oscillator type. Pretty easily re programmed for multiple possible configurations.

[timeguy]

Wow am I glad to have come across this post! I know it is old so I may post separately if it does not revive.

I am new here but also have a Symmetricom S200. I would LOVE to make this modification. Can you let me know what AMP jacks you used for the project? Am I correct in assuming that you simply cut out the panel holes and soldered the jacks to the PCB?

Cheers!

[SoundTech-LG]

The photos here show pretty clearly how it is done. The plastic overlay on the back panel needs to be drilled out (hint: start with tiny bits, and progress to the finished size.) You'll want to re-program U40 too, the eeprom that holds configuration of (old/new)Model, S/N, oscillator type, etc. Easy if you have a programmmer. Once you do that you can swap to another oscillator type, change model #'s, and best of all, gain full functionality of the S250 model, inputs/outputs. 1PPS, 10MHz, IRIG. Have fun. I got the BNC's from Digikey. Last time I looked they were out of stock on those. sorry, I don't recall the p/n, but they have good photos there.

[SoundTech-LG]

Just found it. They only have 1 in stock

https://www.digikey.com/product-detail/en/amphenol-rf-division/031-6577/ARF2115-ND/4037243

[EOC_Jason]

Mouser is showing 369 in stock...

[testpoint1]

please be aware if the X72 firmware version is ealier than 5.x you can not use the 1PPS in signal, the latest seems is 5.08

[Theboel]

Hi SoundTech-LG

Do you have any measurement ?
its look like it use Motorola GPS receiver can You confirm it ?

[testpoint1]

Hi SoundTech-LG

Do you have any measurement ?
its look like it use Motorola GPS receiver can You confirm it ?

looks like the M12 GPS, I ever use it

[SoundTech-LG]

Yes, Motorola M12 / M12+ ... I have also one unit that has a Furuno GPS installed (an early unit though).

The X12s that I have all work with the S200s, and S250s. Not sure if that is a default, or I just have later FW.

[timeguy]

Thank you so much! I do not think I could have found the BNC part number on my own.

I have ordered 3 x ARF031-6577 from Mouser. I can hardly wait for them to arrive next week!

The pictures above are very clear indeed. I was primarily curious if any action was required after soldering the BNC's to the board. I am now understating that I will need to re-program the U40 EEPROM. I have never done something like this before, and do not currently have a programmer, but am willing to buy one and learn.

I did some research and it appears that U40 chip in the S200 is a: M93C46 1Kb Serial Microwire EEPROM.

Would something like this suffice to program it? Or would I require a different kind of programmer?:

https://www.amazon.com/Gikfun-Programmer-CH341A-Burner-EEPROM/dp/B01I1EU9LG?ref_=fsclp_pl_dp_7

Cheers!

[SoundTech-LG]

Not sure on that programmer. Price is certainly right! Most of the commercial programmers are 100's of dollars.
If you just need a 93C46 programmed for your unit, I can do that. PM me.

[remois]

  Hi:

  Does anyone have an update file for versions 1.26 and 1.36 of Symmetricom S200 that you can share?  I bought the S200 sometime ago, but the device has reached end of life and the company has been sold to Microsemi, I could not find where to get the update files.

  Thank you very much in advance,

[timeguy]

I would really appreciate this too. My firmware version is currently 1.26. I would prefer to upgrade to 1.36. I am happy to share 1.26 if it would be helpful?

[SoundTech-LG]

First, you specifically need an Industrial grade CF card (such as the one Symmetricom used in the S200/S250) but one rated at 512MB (but it actually holds a bit more).

Then you need to DL the Utility for cloning CF cards in their entirety here:
https://hddguru.com/software/HDD-Raw-Copy-Tool/    Hint: don't use windows FORMAT on it ever!!!

Once you complete those two steps. Make the full CF card from this Version 1.36  image file here:
https://www.dropbox.com/s/ukg2ehyql6e8bhc/S250%20v1.36%20512mB%20at%20Factory%20Default.imgc?dl=0

Place the CF card in your S200/S250 socket. Turn on and go.

Do not use windows FORMAT ever!!!

[SoundTech-LG]

The reason you need an Industrial Grade 512 MB CF card is that the garden variety CF cards are too small. The clone program will fill them, but run out of room. There is just a bit more data that needs to fit. Industrial grade CF cards seem to have the extra space.

[SoundTech-LG]

you'll want one of these if you don't already...

https://www.amazon.com/Compact-Multi-Reader-Electronic-Computer/dp/B015VEXL8W/ref=sr_1_5?keywords=transcend+cf+card+reader&qid=1554920117&s=gateway&sr=8-5

[8bit]

The Symmetricom/Microsemi SyncServer S200/S250/S300/S350 are the same base system board just with extra/faster/better parts added to it.

I am working on adding an OCXO to my basic S250. It seems there are four steps:
 1) add the OCXO to the board
 2) add the JP3 jumper
 3) install R121 (what value?) to connect the 10Mhz signal
 4) reprogram U40 to change the oscillator type

I have seen MC597X4-040W as a part number for the factory OCXO. It's made by MCCOY/CORNING/VECTRON/OFC (On ebay today for $20).
I have been told that JP3 is need for the system to use optional oscillator (the additional OCXO or Rubidium X72).
I know that R121 connects the OCXO output to the system. The Rubidium connector is already connected and you can just plug in the X72.
Does anyone have a factory OCXO S200/S250/S300/S350 ? I need to know the value of R121 next to the OCXO. Is it Zero Ohms or some small 102 or 104 value?
Does the oscillator type truly have to be reprogrammed to use it? Has anyone tried the /sbin/seeprom program on the system?

The steps for adding a Rubidium X72 are basically the same (no R121 install) but cost more, required custom cables, and the system is picky about the X72 firmware.
Unlike the old TS2100 LPRO-101, the X72 does not require a new dedicated power supply. The X72 can use the 12V from the existing power supply.

The S300/S350 seems to use the newer SA.22c Rubidium module.

Also, FYI, the CompactFlash card seems to be a "Fixed Disk PIO" type CF card and not a normal "Removable DMA" type CF card that everything else uses.
Some CF cards may allow the system to boot and run but then the system generates errors. It's best to use the correct flash card.
You can use a non-industrial CF card but it may fail early. Industrial cards are long life SLC chips with extended temperature ranges and special controllers.
You can connect a normal serial terminal to the console port on the front (9600 8N1) and watch linux start to see if there are problems.

The system has a small 32-bit Linux install on it with the following partition table:
 1: primary: 18 MB (boot kernel)
 2: primary: 8 MB (data)
 4: Extended:
 5: 182 MB (system A)
 6: 182 MB (system B)
 7: 99 MB (temp space for upgrade files)

NONE of the "standard" 512MB CF cards are the same size. The factory Delkin has 1024128 blocks which is rather large for a 512MB card (500MB).
The factory format does not use the full card (about 1M blocks) so you can use a slightly smaller card or a larger card (1GB) and just not fill it.
There does not seem to be a supported way to initialize a blank CF card in the system so you have to start with an image that will boot correctly.
You may be able to boot a USB drive but there is no available code to do that. Just write a working image to a CF card from a PC and USB adapter.

You can make a disk image of the CF card and boot it in VirtualBox.... It needs 4 serial ports, 3 network interfaces, and 2 parallel ports.
You need to attach a virtual serial port to TCP port so you can access the console (just use putty). There's not much you can do with it because of all special hardware the SyncServers have, but it boots.

If you want a quick free backdoor to look around the linux system, just telnet to the S250, login as normal admin to access the restricted shell and run the command:
   root eng sys cat "/dev/null && bash"
With bash running it will timeout after a few minutes and you'll need to connect again.

I have heard that the S200/S250 used two different ETX boards. A 400Mhz VIA C3 with 128MB or a 500Mhz Intel Atom with 256MB.
I'm using the factory 1.36 release with the VIA board. The system does not even use 64MB of memory so upgrading it does nothing (I did it anyway).
If you want to replace the memory, it's a standard PC133 SODIMM (just rip one out of a Cisco 1841).

The S300/S350 uses an Intel 1.6Ghz board with more memory so it's a lot faster (and supports the 1Gig ethernet port and dual flash and more stuff).
The code is different than the S200/S250. The system and kernel are newer for the S300/S350 but the NTP version is 4.2.4p8 for both.

[SoundTech-LG]

It sounds as if you have spent considerable time with these. One thing I noticed was your mention of using a larger CF card, such as a 1GB you mentioned. I could never get that to work. It would take the full 512k+ image ok, but would not boot the system at all, like a 512k Industrial would.

[8bit]

I added the OCXO to my S250 this weekend. It was quick and easy.

JP3 disables the default 10Mhz TCXO. That clock is only used for timing (not CPU or network).
If you disable the TCXO and boot the system it will be unhappy and say it has an unknown timing clock, as expected.

I soldered in the new OCXO. Added a jumper at R121 to connect the output to the system and restarted. It was happy again meaning it now had a 10Mhz clock source.
The web page and other utilities still say it has a TCXO. I connected to the box with telnet, logged in, and used the shell hack to gain non-privileged access to Linux.
Then I was able to run the /sbin/seeprom program and change the oscillator from 0 (default TCXO) to 1 (OCXO) and reprogram the checksum at the same time.
No need to remove and manually reprogram U40. If you add the RB clock the value is 2.

I rebooted again and the S250 is happy with its new oscillator. The web page correctly shows the system is configured with an OCXO.

[SoundTech-LG]

U40 is so easy to program...  can't see why all that additional effort is worth it.

[notfaded1]

This is great stuff!  I just got a 1520-200-rb.  It boots up and I can get it DHCP address but I can't reach the webpage or telnet or ssh to it.  I'm not sure what's going on but I'm going to get a new 512M card and reader for PC and make a new OS for it and try that.  I can't get it lock onto any GPS satellites at all even though it says antenna is ok.  Mine has the factory x72 in it.  It's currently got 1.11 version on it.  I'm going put newer fresh OS saved on a new 512 CF card to hopefully get it going correctly and allow me to get to webpage and set it up right.  The fact that I can see ntp packets on the status page and it picks up a DHCP address makes me think it is on the network but no webpage and no ping of the ip or ability to ssh or telnet to it.  I have ordered a USB to db9 serial cable because that was my next place to try when I found my old friends here at EEVBlog.  Idk why I didn't look here first!  Fingers crossed but you guys give me hope and since I have an original 1520-200-rb I gotta get this baby working.  Mine has the gt-8031f in it and x72 rubidium occillator.

Thanks,

Bill

[notfaded1]

Looks like mine is just like yours... 1520-200-rb!  I want the new Jack's too!  Gotta have the all the 250 outputs!
Just ordered the industrial 512mb CF card and 4 of the dual RF Connectors / Coaxial Connectors BNC RA DBL ISOL 50 Ohm Backplate Valox from mouser:
https://www.mouser.com/ProductDetail/523-31-6577

I couldn't do this without my friends here at EEVBlog!  Mega props!
Bill

[notfaded1]

Here the inside of mine... My pics are so big and high res from my pixel phone only one attachment will fit.  Pixel takes great photos though.  Blow up the picture you can read everything.  I ordered one of those dji osmo 2 gimbals because I'm convinced now the pixel phone cameras are the best for pics and video... Even better than many video cameras and even full body cameras.

Bill

[notfaded1]

please be aware if the X72 firmware version is ealier than 5.x you can not use the 1PPS in signal, the latest seems is 5.08

Can you update x72 firmware?

[SoundTech-LG]

Your greatest effort will be finding FW, and how to perform the upgrade. Microsemi / Microchip will be of NO help. You might ask Mark (TexasPyro) he knows quite a bit about these...

[notfaded1]

I'm not sure how important the 1PPS IN is actually... what's the main purpose of that if you already have GPS sync and the RB running?  For the 1 PPS IN to be of value it has to have better pull-range than the current sync'd oscillator correct?

And the typical system oscillator pull-ranges are:

TCXO 1E-6 (1 ppm)
OCXO 5E-7 (0.5 ppm)
Rubidium 1E-9 (1 ppb)

I'm not sure how you'd ever need the 1PPS in unless it was coming from a cesium clock or something?

Thanks again,

Bill

[notfaded1]

Does anyone know if there's a way to identify the newer x72 rubidium occillators that may have newer firmware?  By label or something?  I've noticed they don't all have same labels on them.  It'd be nice if there's a known newer one to buy.

Bill

[texaspyro]

Your greatest effort will be finding FW, and how to perform the upgrade. Microsemi / Microchip will be of NO help. You might ask Mark (TexasPyro) he knows quite a bit about these...

Once upon a time there was a guy offering to upgrade X72's on Ebay for around $30.   But he warned that not all units could be upgraded and if it didn't work the unit would be bricked.

[notfaded1]

I tried an industrial Delkin Devices 512MB CF card from the same manufacturer as my unit has... the Raw Copy didn't work because the image file says it's 524MB and the 512MB card has only a little over 500MB of usable space... so it cuts out around 92% as it can't write anymore?  I'm going to try a one gig industrial card for the heck of it because the only issue seems to be the size of the 512MB card.  I even tried using HDCopy to make an image of my current card and writing it back out to the new 512MB CF and it's just a little bit too big as well for the other card.  It seems the size on these cards varies greatly. 

Bill

[SoundTech-LG]

yup.  Does your new (to you) Industrial Delkin 512 have a matching part # ?
These cards are larger for sure. If you can get a 1GB card to work, I would be very surprised, and impressed. If that was the case, shouldn't any larger card work? No. Please let us know the results.

[notfaded1]

I'll let you know as soon as the 1Gig CF card comes and I try it... the image posted here says it's 524MB in HD Guru... i'm not sure how you got that to fit on a 512MB CF card which is around 500MB.  I can't believe buying the same brand 512MB Delkin industrial card didn't work for me.  I do have another 1520-S200 coming from ebay that works so it'll hopefully have a good card in it.  I really want to get this image here for 1.36 working somehow but so far I don't have any card it'll fit on which is a real bummer.  I did get a usb to 9 pin serial adapter and got into the command line.  The version 1.11 running on my machine won't allow running the cat command.  I can go into "eng" and "sys" but running "cat" to try and get bash running just says command not found.  I tried doing the "http on" command and it runs but I can't reach the webserver or ping the server's IP at all on my network.  This is very strange because I see the display saying ntp packets are incrementing on status display.  The S200 says it's acquired an IP with DHCP and it gets the mask and gateway without issue.  I think the problem is this version 1.11 maybe.  From the command line I do see it knows it's an S200 and also knows it has the rubidium oscillator.  Fingers crossed the second S200 I bought has a newer version of code on it.  I still want to find some blank cards that will work.  If someone wants to sell a working CF with 1.36 on it I'll pay.  Or if someone knows a source of industrial 512MB CF's that really work I'd like that too.  I'll check the part number on my Delkin 512MB CF tonight when I get home from work.

Oh also on another note I did get the stacked jacks in the mail from mouser.  I bought 4 pairs before I bought the second S200 server.  I suppose I could put the extra one on one of the sets of pads on the second S200 when it comes.  They weren't exactly cheap but I bought an extra one just in case I messed one up soldering them in.  Shouldn't be a problem... I've got a Metcal MX5000 soldering station.  They use only Metcal soldering stations in our factories here at work... they work for space applications soldering under a scope so I figured it would work for me too!  I highly recommend them.  You can get the older MX5000 now for a decent price on ebay if you look around now that the MX5020 and now MX5050 have come out.  I bought an extra hand piece so I can have two irons with different tips running.

Thanks again SoundTech-LG and others here,

Bill

[SoundTech-LG]

Spent many hours with the limitations inherent in using CF cards in this hardware. I found generally the Symmetricom supplied Delkin 512 MB cards (that will hold at least 524MB) are no problem. I think I did find one type Transcend Industrial that would work. How to know if it will...  you just have to try. I believe Symmetricom made sure Delkin used a certain spec of CF for these units. I guess you have to try making your 1GB CF with the 524GB image on it, but doubtful it will work.

[testpoint1]

Does anyone know if there's a way to identify the newer x72 rubidium occillators that may have newer firmware?  By label or something?  I've noticed they don't all have same labels on them.  It'd be nice if there's a known newer one to buy.

Bill

one american guy can do the upgrade, charge 25 usd, you need to ship to him, but your X72's SN maybe later than 05xxxxxxxxx.

[SoundTech-LG]

Hard to know much about him, without info on him...

[testpoint1]

Hard to know much about him, without info on him...

PM you already.

[notfaded1]

Thanks a million SoundTech-LG, testpoint1 and everyone for that matter.  Well I took delivery of the second 1520-s200 today.  The good news is it's running v1.30 and I can reach the webserver on it for the first time!  I still can't believe a copy of the this working CF v1.30 won't fit on the delkin industrial 512mb CF card I bought but it's just too small... ain't never gonna work.  I'll try the 1G card when it comes but from what you've told me... it's probably not promising.  The only reason I can guess is these little VIA MB's these are made from have a bios and firmware that doesn't support 1G CF I suppose?  It seems like a bigger CF card should work with binary image written out to it... unless the hardware doesn't support the size of the CF card.  That's the only thing I can think would be a reason.  I wouldn't even know where to begin thinking about how to upgrade the firmware on the VIA motherboards BIOS in this embedded computer inside these Symmetricom Sync Servers!  It's possible there's a way but right now I'm going to try the gig card when it comes and keep searching for a source of 512MB CF industrial cards that have enough room.  There are really almost none on ebay from the USA... most are all from China you can find.  So it's like russian roulette... pull the trigger on the auction then wait for the slow boat to show up and hopefully... maybe it'll be right!!!  What a PITA.  If I find a good source I'm going to buy a lot of them and stash them for upgrading these symmetricom sync server because they're awesome little units!  Ironically I've found some of the rubidium oscillators they use in the newer s300 and s350 sync server cheaper than the x72 rubidium oscillators used in the s200 and s250.  Go figure!  Has anyone hacked away on the S300/S350 flavor yet?

Thanks again everyone... I wouldn't have gotten as far as I have if not with help from my brothers here at eevblog.         

I'll post pics of the non working same brand Delkin Industrial CF card so others can avoid my pitfall.

Bill

[notfaded1]

Here's the back of the bad Delkin 512mb CF card that's too small dag nabbit!

[notfaded1]

And the front...

Bill

[notfaded1]

On a better note... these came in the mail from Mouser the other day!   

[notfaded1]

Oh!  BTW... other great info... the v1.30 does allow running other unix command my v1.11 DID NOT!  I can run cat, rm, and cp now!  The newer version has many additional commands in the sys level of commands.  You can enter "eng" for engineering:

9 ? eng
10 ? ?
--------------------------------
Commands
--------------------------------
ACT
ALA
CLK
ETH
FTP
GPS
IP4
IP6
IPA
LFR
MODEM
NTP
OSC
REF
SNMP
SYS
TCO
intrinsic help
--------------------------------
11 ?

or "sys" for system:

11 ? sys
12 ? ?
--------------------------------
Commands
--------------------------------
CAT
CP
DAEMON
DISPLAYINIT
HALT
HTTP
HWREV
MODELNUMBER
OPTEXT
OPTIONS
REBOOT
RESTOREDFLT
RM
SAVECURRENT
SERIALNUMBER
SWVERSION
UPDATECRC
intrinsic help
--------------------------------
13 ?

The newer linux dist is actually less secure than the old one...

Bill

[notfaded1]

It sounds as if you have spent considerable time with these. One thing I noticed was your mention of using a larger CF card, such as a 1GB you mentioned. I could never get that to work. It would take the full 512k+ image ok, but would not boot the system at all, like a 512k Industrial would.

I've been able to get v1.36 to boot on a 1G compact flash card.  It's a:
Lexar
Professional
Compact Flash
with Write Acceleration
1GB
133x Speed it also has a Wa on lower right corner.  I'll post a pic of the card shortly.

[notfaded1]

It sounds as if you have spent considerable time with these. One thing I noticed was your mention of using a larger CF card, such as a 1GB you mentioned. I could never get that to work. It would take the full 512k+ image ok, but would not boot the system at all, like a 512k Industrial would.

Weird thing I had issues with many 512M CF cards trying to get them to boot but the 1GB one I used did boot up v1.36.  I still haven't found a 512MB card that can fit the v1.36 image.

Bill

[notfaded1]

yup.  Does your new (to you) Industrial Delkin 512 have a matching part # ?
These cards are larger for sure. If you can get a 1GB card to work, I would be very surprised, and impressed. If that was the case, shouldn't any larger card work? No. Please let us know the results.

The one Delkin card I bought that's too small even for the v1.30 image or even an older image I have says DDiCF51-U and 29094-1816 on the back of it.  You can see I've been trying a LOT of them.  These things are finicky.  /sbin/seeprom does work in the limited bash shell.  You can change the serial number and model number as well.

Bill

[SoundTech-LG]

Well that is certainly quite curious...  are you using HDD Raw Copy Tool to write the file image?

[notfaded1]

Well that is certainly quite curious...  are you using HDD Raw Copy Tool to write the file image?

Yes I used Raw Copy... same program.

Bill

[SoundTech-LG]

Sounds as if any size CF card should work then, as long as it's bigger than 512 MB 

[notfaded1]

I sincerely hope so ST but the way one of mine doesn't like the 512M card with an image that fits make me think either there's something wrong with one of mine or they are just really flaky with CF cards?  The 1G was the only card I could find that could boot 1.36 at all.  I'll have to look if any of my original 512M CF from factory are big enough for that image.  I'm also going to try my working 1G 1.36 in my other unit that's currently running 1.30 and is my main hooked up unit right now.  The eeprom editing tool works when you are in bash in sys mode without a hitch.  I'm interested in adding more x72 to more units without it and converting them to s250's.  It's an approximately 300$ upgrade by itsself.  I have 4 pairs of the dual BNC's now and have been procrastinating drilling into the back of the case(s)... have you taken the whole motherboard out of a unit yet before?  Another update since I switched from my cheap tiny cable GPS 12V antenna and got a real symmetricom antenna and it made all the difference.  Without it even mounted on my roof and just sitting in the first floor window sill between two tall houses I get 3-5 SATS all day long!  I can't stress how much this was different.  Now I'm looking Active GPS Splitters... OMG it's more C notes!

Bill

[SoundTech-LG]

The Symmetricom/HP splitters work great...  I use them for my S250s and SecureSync and 9483 Netclock units as well.

Don't stress about taking out the motherboard...  piece of cake. Just be careful, and take your time.
Drilling out the back is just the plastic overlay, the metal holes are there already. Just use a tiny drill, and work your way up to the final size to lessen cracking of the plastic.

[NA5WH]

Snagged a S200 for a decent price, but had to order out the appropriate.  Went ahead and did the physical mods and added the jacks....   got the PPS (50% duty cycle) and the irig-b signal... both looks awesome, but not the 10 mhz..... just slight noise..   thought it was just the lack of receiver antenna... but yeah.. no luck today...    and I had put all the screw in retainers in...... 

Guess its time to go surfing for the signal...  had hoped not to have to do any more special mods... but such is life... ^_^

[SoundTech-LG]

Hi,

Sorry to hear you do not see the !0M signal. the first thing I did before touching anything was to probe at the pads for the connectors for the signals. They were all there. Then I proceeded to add in the jacks. You might want to check for open/short...

[NA5WH]

yeah...... its going to be a short... where I don't know...... because its going to be one of those days.... flip her guts open and she's all "here is your 10 mhz right here.. its all good"  *sighs*

edit:
Adding some additional photos, in case it is useful for someone looking at the 48V DC version, and/or the OXCO version.

[SoundTech-LG]

Well I had not seen a 48V version, nor the OCXO version, so thanks!  Nice photos.
Will be nice to know what you find!

[notfaded1]

Like SoundTech-LG I hadn't seen the 48V or OCXO.  Mine are both standard AC and one is the base model and the other is the Rb.  We're always open to more info about the Syncservers!  I keep one running right next to my bench as an additional reference.  It's got an easy to read display from some distance.  Did you drill out your case and if so how?

Bill

[NA5WH]

I was a bit naughty about removing the plastic covering the holes... I first drilled open from the inside with I think a 1/8th or maybe a bit bigger, as centered as possible. Then used a self-centering stepped-hole bit to open it up to the bnc size. It did remove the 'flat', but really its not like the bnc is going to rotate by any real margin, and the pain of trying to remove the plastic was not worth it.  Add the securing screws and can't tell a bit. 

Don't think I have a good photos of the input, but basically it has diversity of two 48-volt power supplies.   Little surprised to see a different GPS board from the ones on the thread. . It feels weird that my itty-bitty Ublox 7 receiver seems to be more sensitive with a lower-power pre-amp antenna than this board. But I do know ublox is not intended for timing purposes.

Downside is now I want to make a frequency counter and figure out if I can make something that resolves the IRIG-B time-code... its really interesting to see the waveform.

[notfaded1]

Thanks for showing your drilling... that's where I'm at now.  It looks good with the BNC locking bolts screwed down onto them.  I'm curious if you used any other compact flash cards and the version you are running?  I've had all kinds of fun with that.

[NA5WH]

Yeah if I had not tried to use a sharp knife thing before just using the right tool, I wouldn't have chipped the plastic color as much....   so think just using the step bit and going with the flow is the right way.

As for version, right now shows  1.36 Release version,  and hardware clock version 1.83

I don't have anything to write or read that kind of flash card. So have not attempted to convert it to the S250 software or anything.  I think the only thing that misses out on is syncing to input of 10mhz, etc....  which currently I dont have anything "better" in accuracy.

[notfaded1]

Yeah if I had not tried to use a sharp knife thing before just using the right tool, I wouldn't have chipped the plastic color as much....   so think just using the step bit and going with the flow is the right way.

As for version, right now shows  1.36 Release version,  and hardware clock version 1.83

I don't have anything to write or read that kind of flash card. So have not attempted to convert it to the S250 software or anything.  I think the only thing that misses out on is syncing to input of 10mhz, etc....  which currently I dont have anything "better" in accuracy.

If you connect to the serial port you can change the hardware model to S250... it's good to know the outputs are there even if you don't make the change though.  Thanks for that.  The hard part is finding a flash card that can hold the later software and boot.  I've tried many options and many don't work.

[smgvbest]

I was doing some hacking and have now enabled root logon via SSH
if there is a easier way feel free to tell me I wasting my time.  And yes I know you can get a console port @ 9600 baud but ssh is nicer


otherwise

perform a backup and do a save-as to get a backup downloaded
open the backup in a zip until such as 7-zip
inside you will see config-1.2.tar.gz
open this in 7zip
then open config-1.2.tar in 7zip
you now have 2 directories
/etc
/var
go into /etc
open and edit shadow (the password file)
the root account looks like this
root:*:14012::::::
the * mean root can not logon
change to
root:$1$uV2.fU1.$UFcRU1rZDB5NJElVrwIR11:14012::::::
that will give root same password as admin (ie symmetricom)
save
if prompted to update the backup file do so
now go to /etc/ssh
edit sshd_config
find
PermitRootLogin no
change to
PermitRootLogin yes
save file
if prompted to update the backup file do so
close the archive
if prompted to update the backup file do so
go to the wizard and restore using the backup file you just updated

[smgvbest]

FWIW,

/sbin/seeprom  as root lets you read and set EEPROM values



/home/fpgademo lets you read and set FPGA values



Also,
From what I can decern the week number roller over occurs in the FPGA.
anyone good as reversing bitcode???

[8bit]

There are at least four locations where the system can have trouble with dates:
 1) GPS: All the boards have a WNRO issue. Sometimes the software can account for it and extend the date.
 2) Linux: This is a 32-bit system. We are closer to 2038 than Y2K!
 3) Symmetricom code: FPGA and other unknown internals.
 4) NTP: This version is getting older by the minute. Without the source for the FPGA driver and hardware clock you can't update it.

There are at least two GPS boards used in the systems: The Motorola M12+T (mostly older) and The Furuno GT-8031 (mostly newer R version).

I have a GPS simulator so I can throw some dates at it and see what happens (Linux, NTP, IRIG, some utilities).

I tried the newer GT-8736 as a drop-in replacement and it "mostly" worked. The other one to try is the Synergy/i-Lotus, but I don't have one yet.

[notfaded1]

FWIW,

/sbin/seeprom  as root lets you read and set EEPROM values

(Attachment Link)

/home/fpgademo lets you read and set FPGA values

(Attachment Link)

Also,
From what I can decern the week number roller over occurs in the FPGA.
anyone good as reversing bitcode???

Thanks for the true root hack!  You could run the seeprom without root before and admin but root is better for other things to investigate more hacks.  I'm going to root mine too now!  That was smart using the products own config file save feature to edit the shadow file!  So easy duh!  I never even looked at the saved config... I didn't know it contained the shadow file from /etc.

Bill

[SoundTech-LG]

All very interesting stuff!!  Now if i can get enough confidence to try some of this. Very grateful for all this info!!!

[notfaded1]

All very interesting stuff!!  Now if i can get enough confidence to try some of this. Very grateful for all this info!!!

What we need is a solution for the compact flash cards that work every time.  I've tried a few and it's a total crap shoot and most don't work.  I had some luck with the one Gig card.  I may try some more of them vs. more 512MB ones.

[SoundTech-LG]

Looking back through my posts here, I do see I might have used 1 GB card successfully as well. Forgot about that. Have you tried multiple 1 GB cards, or just the one?

[notfaded1]

Looking back through my posts here, I do see I might have used 1 GB card successfully as well. Forgot about that. Have you tried multiple 1 GB cards, or just the one?

I've tried just one so far with some success.  I've found with 1.36 it boots and runs but I've had issues with the webserver on it for some reason.  Now that the real root method was posted I may root it to do more lower level testing on the NIC in the unit.  With real root I'll be able to edit files and do things I couldn't do with admin account.  I'll be able to troubleshoot the webserver much better.

Once I get a good 1.36 version that boots off 1G card and fully works I'll post it.

[smgvbest]

On the CF CARDs,   on thing I've noticed is it's mine went looking at the boot screen started to do a fsck saying it wasn't clean and that lasted allong time.
wondering if it's possible that what is happening to others.   I pulled the card and i'm going to load it up onto linux and run a fsck there then try to boot again
here's the partitian table from the 512MB drive that is in my S250

Code: [Select]

root@SyncServer:/dev/discs/disc0# fdisk /dev/discs/disc0/disc

Command (m for help): p

Disk /dev/discs/disc0/disc: 524 MB, 524353536 bytes

17 heads, 60 sectors/track, 1004 cylinders
Units = cylinders of 1020 * 512 = 522240 bytes

                Device Boot    Start       End    Blocks   Id  System
/dev/discs/disc0/part1               1          35       17820   83  Linux // boot
/dev/discs/disc0/part2              36          51        8160   83  Linux  // persist
/dev/discs/disc0/part4              52         979      473280    5  Extended
/dev/discs/disc0/part5              52         416      186120   83  Linux  // root image 1
/dev/discs/disc0/part6             417         781      186120   83  Linux  // root image 2
/dev/discs/disc0/part7             782         979      100950   83  Linux // /mnt/upgrade
also it looks like TimeToHC12d is the main glue peice between the RTC maintained by the GPS/FPGA combo and Linux.


Does anyone have a extra Furuno GT-8031F laying around I could purchase from you?

[SoundTech-LG]

All great work, and info!!!  524 MB...  I take it this is version 1.36
have the Furuno, but it is installed in my S250/S200 modified.

[notfaded1]

This isn't exactly cost effective but they're selling whole GPSDO units that have a GT-8031G in them:
https://www.ebay.com/itm/1x-Symmetricom-GPSDO-10MHz-1PPS-w-shield-GT-8031-Note-/312277068872

I'm not sure I understand his note about switches either... the post above in thread about looking for a substitute sounded promising too... I'd love to replace my GT-8031 with something better.  Most of the newer boards in the GT family don't use "NMEA like" protocol it looks like after checking their current products.  The newer products use a binary protocol.

This one has an GT-8031F board on it:
https://www.ebay.com/itm/1x-RCGD-M-GPSDO-10MHz-1PPS-w-GT-8031/312306276819

B

[SoundTech-LG]

Hi,
Well I got brave and tried it...  thought I had it down.
got Invalid command.
Not sure what I am doing wrong...

[SoundTech-LG]

So after a long tinkering around it appears that maybe the modified file is not getting uploaded back into the system. Not sure. Still trying to make this work.
Question...  should a new backup file saved after uploading the modified one, include all the changes? or, do defaults overwrite those changes each time it gets saved?

[smgvbest]

its possible the zip file is not getting updated.  make sure to exit out of the zip file so it saves then come back in and verify the change is still there.
a backup made will include all changes to /etc so this would be in the backup

[SoundTech-LG]

Hi, thank you for your reply. I have checked the backup file after modification. All changes are there. After uploading it, it gives the Invalid command after trying the first line in the list of commands you provided. Additionally...  if I make a new backup file, none of the changes are there... it reverts back to the defaults.  I am using version 1.36 on the CF card, if that may make a difference. What version are you using?

[smgvbest]

I'm on 1.36

[smgvbest]

To enable sftp
edit /etc/ssh/sshd-config
change
Subsystem      sftp    /usr/lib/openssh/sftp-server
to
Subsystem       sftp    /usr/libexec/sftp-server

next

edit /etc/services
change
sftp           115/tcp
to
#sftp           115/tcp

restart sshd thru GUI or
/etc/init.d/ssh restart

[SoundTech-LG]

Hi,
After I make those changes, save the file, open it and verify correct, close it, restart sshd in the GUI, load the backup file,  I still get Invalid Command. If I make a new backup file from the Wizard none of the changes are there either. It is interesting, and a bit frustrating playing around with it though

[SoundTech-LG]

According to NIST there are some vulnerabilities to be aware of with earlier versions of the software...

https://nvd.nist.gov/vuln/search/results?form_type=Basic&results_type=overview&query=symmetricom&queryType=phrase&search_type=all

[SoundTech-LG]

and here is the main screen just in case it looks different...

[smgvbest]

According to NIST there are some vulnerabilities to be aware of with earlier versions of the software...

https://nvd.nist.gov/vuln/search/results?form_type=Basic&results_type=overview&query=symmetricom&queryType=phrase&search_type=all

The software on many of these older time servers have many vulnerabilities
1.3.6 has these versions of some of the most visible packages

inux SyncServer 2.4.20_mvl31-pc_target.chronos.1.670.15.1061924 #2 Thu Apr 16 19:26:14 PDT 2015 i686 unknown
MontaVista linux


ntpd - NTP daemon program - Ver. 4.2.4p8
Server version: Apache/2.0.63
OpenSSH_5.5p1, OpenSSL 1.0.0 29 Mar 2010

[smgvbest]

and here is the main screen just in case it looks different...

For reference here's mine

[smgvbest]

Hi,
After I make those changes, save the file, open it and verify correct, close it, restart sshd in the GUI, load the backup file,  I still get Invalid Command. If I make a new backup file from the Wizard none of the changes are there either. It is interesting, and a bit frustrating playing around with it though

Just for reference, i did the SFTP changes after I had already made the SSH changes for ROOT.   while it should work editing the zip file and loading the back up i did not test that
I've actually restored mine to a point prior to the changes and did my steps again and it worked fine.

 

[SoundTech-LG]

The main difference is the older model processor Samuel. I have a few of those units too, but I somehow doubt that would change anything...

[SoundTech-LG]

I might have to take a break from it for a while.   I'm sure I've done something wrong... although the tar file contents are looking good to go. Just does not work. I'm really just a hardware guy, so who knows. It sure looks great what you were able to do!

[smgvbest]

I might have to take a break from it for a while.   I'm sure I've done something wrong... although the tar file contents are looking good to go. Just does not work. I'm really just a hardware guy, so who knows. It sure looks great what you were able to do!

Can you PM me and send me your file? 
if you can put on a google or other drive where I can grab it I'll take a look

[SoundTech-LG]

Hi Sandra,

Left you the link via PM.

Thanks!
Martin

[smgvbest]

Has anyone looked at upgrading a S250 to a S350?
some of the items I note.
1. different CPU board
2. 2x CF Cards
3. U36/U37 Populated
4. Gigabit Eth Port
5. Alarm Relays
6. Back up Radio
sure theres more.

does anyone have a dump of the 2 CF Cards is the S350?
anyone have teardown photo's?

[8bit]

While upgrading my S200 to a S250/OCXO I also worked on the CF cards and the OS and looked at some of the differences to the S350.

While the S2xx and S3xx look very similar and were clearly based on the same design, they are NOT the same board as I thought before. The S3xx does not have space for the on-board OCXO and uses a different connector to support the off-board RB or OCXO. The S3xx also has a different power supply (looks better). The S3xx also includes the Gig-E chip and the connector for the T1/E1 timing card. It looks like the S2xx could support the alarm relay card and the modem card (but never did). There are also some extra options for military use.

They both support the same 32-bit X86 PC controllers but the S3xx uses a faster CPU with more memory. Even the oldest system with only 128MB RAM should be fine. The newer S2xx came with 256MB RAM and the S3xx have at least 512MB RAM. While the RAM is a standard SODIMM and upgradable, there's little point in doing so. Upgrading the CPU (or PC card) would not change the timing performance as that is handled by the FPGA hardware and not the CPU. A faster CPU would help system response and NTP performance. The S2xx systems are not very fast. The S3xx systems are not much faster.

While the S2xx and S3xx seem to use the same FPGA setup they run different code and seem to be connected a little differently.

It seems they (symmetricom) were working on a unified code release and set of system options for the S2xx/S3xx. I would guess they gave up as it was good enough and then soldout to Microsemi who ended the product development in favor of newer systems (the S600/S650 modeler).

The S2xx software does not require the OPTIONS or OPTEXT to be set (they are just 0) and the web page uses the model number (S200 or S250) to set some features. All the circuitry seems to be the same for the S200 and S250 except for the extra 6 BNC connectors. The oscillator hardware (TCXO/OCXO/RB) seems to be the only real option in the eeprom.

The S3xx use the OPTIONS and OPTEXT to set the hardware/software options present in the system (including hidden features). You can set ALL options from the "root eng" menu including oscillator and model number. No need for root shell.

For the S2xx there is only one 512MB flash card. On the S3xx there are two 512MB flash cards but they are not mirrored. In the S3xx, the first card (hda) has the same setup as the S2xx and the 2nd card (hdc) is just for the database storage unique to the S3xx software.

The stock S3xx software does run on the S2xx system basically unmodified and includes the provision to use a single 1GB flash card with an extra partition for the database storage (or just don't start the DB). I'll have to test the different FPGA code, currently I'm still running the S250 FPGA code. You can reflash between the versions from the root shell.

I loaded the S3xx software on a 1G CF card and setup the 8th extended partition as the rest of the storage (Linux EXT3) and the system is happy. I set the hardware options so it shows working features (also added the easy/cheap OCXO upgrade and BNC connectors to the S200):
 MODELNUMBER S350
 OPTEXT 0x00000027
 OPTIONS 0x000019C9

The S3xx software is a little newer with some extra features. It uses the 2.6 kernel rather than 2.4 but NTP is the same old version.

As for a new working CompactFlash card.... It needs to be NON-REMOVABLE/IDE-MODE AND NON-DMA (and large enough to hold the partitions). Using the wrong type of card should not damage the system but it won't boot. Using a removable CF card generally won't boot at all. Using a non-removable (hard disk) but DMA card will generate errors and won't finish booting. Some cards claim to support full auto-detection of all options but don't count on it working. You can connect the serial console to watch the system boot (9600-8-N-1).

Apacer makes several cards that work. The 512MB or 1G cards from the CFIII or CF5 line work (I am using them). Speed is not important as the system tops out at about 1.6MBytes/sec (extra slow PIO speed). You can get the cards new from DigiKey or Mouser. The CFIII have a better write endurance but are slower (not that it matters). The S2xx and the S3xx boot cards are not written to a lot. The secondary S3xx card is mounted read-write.

The Apacer CF5 cards are obsolete and may be hard to find new. The Apacer CFIII cards are older but still seem to be available new. The newer Apacer CF6 cards should work but I have not tested them.

Extended Temp 512MB CF5: AP-CF512MR9NS-ETNDNRB ($34)
Extended Temp 1G CF5: AP-CF001GR9NS-ETNDNRB
Standard Temp 512MB CF5: AP-CF512MR9NS-NDNRB
Standard Temp 1G CF5: AP-CF001GR9NS-NDNRB

Extended Temp 512MB CFIII: AP-CF512ME3NR-ETNDNRQ ($33)
Extended Temp 1GB CFIII: AP-CF001GE3NR-ETNDNRQ ($47)
Standard Temp 512MB CFIII: AP-CF512ME3NR-NDNRQ ($26)
Standard Temp 1GB CFIII: AP-CF001GE3NR-NDNRQ ($35)

DigiKey has a good number of the Apacer CFIII 1GB ET cards (AP-CF001GE3NR-ETNDNRQ). You can use the 1GB card as a direct replacement for the 512MB card and just not use the extra space. As the card is formatted for Linux you can change the partition size but not the layout (partition numbers) and it will still work correctly. The partitions just need to be large enough to hold the data. I copied a S350 card to the new 1G CF card and booted it in the S250. Then using a root shell and cfdisk I added the 8th partition with EXT3 format and it's a happy box.

[notfaded1]

Would you post a link to the 1G image you are using on your S200 series that works?  I've also spent a lot of time working on this and I'm interested in seeing the S350 code run on an S200 1G card.

Bill

[SoundTech-LG]

wow, great work, great info!!! 

If you have an image for the 1gB CF for the the S250 I would love a copy.

Thanks!

[timenuttie123]

While the S2xx and S3xx look very similar and were clearly based on the same design, they are NOT the same board as I thought before. The S3xx does not have space for the on-board OCXO and uses a different connector to support the off-board RB or OCXO

I have a follow up question to 8bit's comment about the S3XX being different from S2XX. Does the S300 have the precut holes in the chassis for the 3 BNC connectors and the corresponding circuit traces on the board for soldering them?

I am considering getting a used S300, and I'd like to make sure I can at least use PPS OUT (timing inputs would be nice too, but I don't care as much).

TIA!

[8bit]

I only have the original TS2100, S350, S200, and S250 units but not an original S300. Most have had power supply failures (some sparks and smoke).

I would think the S300 and S350 would have the same metal chassis and so the S300 should have all the punched holes but a different sticker covering them.
From a manufacturing perspective it's cheaper to have one or two versions rather than different ones for every single variation (there are many).

This PDF shows the S300 with the holes as you want:
 https://www.microsemi.com/document-portal/doc_download/133336-syncserver-s300-datasheet

It's also an interesting photo as it shows a different S3xx main board that does include on-board space of the OCXO unlike the ones I have. It does have the T1 header, the 2nd CF slot, GigE, and different RB connector so it's definitely a S3xx board. I don't know if they made any S200/S300 without the electronics needed for the S250/S350 connections.

I used a heat gun to soften (not melt) the plastic and then a sharp thin knife to cut the plastic to match the holes. Others have used a drill. Without heating the plastic a drill seems better...the plastic sticker is rather thick and strong.

[notfaded1]

I just bought one of the last 512M cards from mouser... both Digikey and Mouser say they are now backordered.  I was going to order two from mouser but it said an item is backordered so I reduced it to 1.

[notfaded1]

Thanks for the tip 8bit... my problem has always been finding cards that will boot correctly or be big enough.  I've had lots of trials that failed... many of us have.

[timenuttie123]

I just got two of these from Amazon (I have S300):

https://www.amazon.com/gp/product/B00J8SS9M6/ref=ppx_yo_dt_b_asin_title_o03_s00?ie=UTF8&psc=1

I used "dd" on Linux to copy the original 512MB cards onto the new ones, then installed them back and everything worked right the first shot.

Next: root hack & sftp hack.

[AlexJackson]

I had posted to this earlier but deleted it for not having anything major to contribute.

I also have a base s200 device that Ive had for a few years. I was able to get mine to work on a Transcend 1GB 80x card I had from my old Watchguard XTM 5 firewall. I've also tried the 1.36 disk image linked earlier in the thread and while it worked, it had a number of bugs in the VFD. First was a strange flickering between various bits of text "invalid address" and blank spaces on the hardware clock status "page" on the VFD. Also, when it finally synced/locked over GPS (I have the symmetricom 12v antenna), I got either "REF:    " or "REF: Pkt Err". Further testing shown that even without an antenna or network link, it would lock and sync and show Stratum 1. Loading the image on the factory card also yields very strange intermittent errors in the admin pages. I have since rolled back to 1.10. I did ask around if there other versions available, but I haven't found anything or heard back.

However what I'm really after ultimately is the more advancing timing oscillators and outputs that are lacking on the s200. So I've decided to probe around my s200 with my "new" scope (ds1054z) Ive only used a couple times and see if adding the jacks would even work (especially at 15 bucks each). Gives me a reason to probe something. And yes, I found the signals, 10MHz signal, PPS & IRIG. I have a few other items that can use PPS.

With that said, mine only has the TCXO, and I've ordered a Vectron MC597X4-040W that was shown fitted to an OCXO version earlier in the post as well. Regarding installing R121, to me it looks like its just a jumper and not so much a resistor. To my old eyes the pictures look like the value is "000" but I can barely read/do smd stuff to begin with.

I still have yet to dive into mine much more than some probing and CF card testing. I have several other 512MB cards that don't work either because they're too small. I also havent ordered the bnc connectors at this time, that will probably come next week.

[AlexJackson]

I know I'm totally late to this show. My Vectron OCXO showed up today. It wasn't supposed to be here until Friday. I might have me a nice little project for later tonight or even the long weekend (if I have one). I dont yet have the bnc connectors, but im going to go ahead and drill for them.

From what I seen from the pictures @NA5WH, It appears that R121 is labelled "000" so I'm going to say this is a jumper. So I'm pretty much going to be following in the footsteps of @8bit with the s200 to s250 mod. Sadly, I'm stuck on v1.10 because I couldn't get any of the shell hacks to take, but ill try it with the linked v1.36 to run the seeprom program then ill probably have to go back to 1.10 unless it fixes my VFD issues on 1.36 (not likely).

[SoundTech-LG]

Interesting those shell hacks...  spent considerable time with and got nowhere. Not sure if it is a user error or what.

[AlexJackson]

An update on my s200 'upgrade'. Didn't go well for the main reason for the upgrade, the OCXO. I ran into a few 'issues'.

The installation of the new BNC jacks went well, and the holes drilled ok with my old half-dull step bit. I haven't verified the signals yet until I verify the device comes back up with a good lock.

I couldn't cleanly remove the solder from the center pin on the OCXO (pin #2) with a de-soldering bulb (suck or blow). There was something stuck it so I had to use my fine point iron, get it hot and push it through the hole. I did get some crap out of it that didn't want to melt with my iron. That process took 30 minutes. I did get the new oscillator installed. Jumped R121 with jumper and installed a jumper on J3. The whole installation the new oscillator took me 2 hours with all the cascade of issues I encountered with my iron, soldering station, finding my stuff (it was all moved, and I don't have a true "bench"). Lots of running around involved.

Turns out my card reader is messed up so I cant use the 1.36 image to flash the new image to the CF card and I don't own a programmer. Unless if someone knows how to do the root hack with v1.10. (none of the hacks discussed work on 1.10).

updates:
1. The inputs & outputs work great and the system indicates lock when I do a loopback.
2. Turns out, the cord for my card reader was shot, and my partner had an old cord that fit. I was able to image 1.36, and bust out to a terminal and run seeprom to change the oscillator type.

Without J3 jumped, even when set to the OCXO in seeprom, it will show TCXO in the interface and in ssh. Once J3 is installed it shows as OCXO.

So in the end, the upgrade was a success, but v1.36 still doesn't work properly with my vfd and shows several issues. Unless someone has another version of the OS I'll have to remain on v1.10.

[notfaded1]

I never had VFD issues with the 1.36 version that's really strange problem for sure.

[AlexJackson]

Strange indeed... So today I swapped cards and changed the model type from S200 to S250 (since i now have the I/O jacks) and the VFD and status pages on the VFD are still acting strange.

Whether or not if I have a GPS lock, it will show on the first line, "REF:           " & on the second line, "NTP Stratum 1". Sometimes I'll see "REF: Pkt Err" flash frequently on the VFD. The Sync LED will swap between red & green as well as the "Alarm" LED. Even when the Alarm LED is red, no alarms show on the admin page.

I've messed around with it a lot today, and havent been able to suss out whats going on. I'm going to guess my device has some older hardware that the new firmware doesn't like, or the firmware updates also updates firmware on the peripherals such as the VFD.

[TheWizard]

This thread is getting old, but, was very helpful in getting some older Symmetricom S2xx units up and running, so I thought I would summarize and consolidate everything I've learned here.

The key upgrades for most of these units will be software, Vectron MC597X4-040W OCXO, and an upgraded I-Lotus M12MT/IL-GPS-0030-B GPS receiver board.

To install the Vectron OCXO, purchase from ebay or elsewhere, and solder the oscillator in place on the main board. The board is multilayer FR4 glass/epoxy, so you have to carefully put some heat into soldering the OCXO pins to get good connection.  Then bridge R121 with solder to connect the OCXO 10Mhz output and put a jumper on JP3 to disable the TCXO. Ssh into the unit over lan-1 with admin and enter the following command: root eng sys cat "/dev/null && bash"

CD to the /sbin folder and run: ./seeprom

Select option 38 and set oscillator type to 1 for OCXO (0 is TCXO, 2 is X72 Rubidium Osc).  Then select option 4 to update checksum.....this must be done. Type "exit", then type "reboot".  If your firmware also needs updated, you can avoid updating the eprom by simply installing the OCXO first, then running the software update from the web gui.  This will automatically scan the system and set osc type automatically.

The factory Motorola/Furuno/M12 GPS board has a rollover date in September of 2022. The I-Lotus (IL-GPS-0030-B) is a direct compatible replacement and costs $65 and is good for 20 years from the date of the sticker on the board. Simply remove 4-screws and swap the boards.

For software upgrades, 1.36.1 from 2015 is the latest firmware for S2xx units.  Firmware upgrade files along with a complete 1.30 runtime image that will fit on any 512mb flash card are included in the link below. These avoid the previous issues of odd-size/too small flash card.  The upgrade files are untouched with matching SHA-1 checksum and should work on any S2xx unit with a factory 512mb flash card.

Symmetricom Files

*** Files link updated 7/9/21 to publicly shared Google Drive ***

[deepskyridge]

Anyone found a good source for the new iLotus GPS board. I have not been able to find one.

Thanks
Gary

[wje]

I was overjoyed to find this topic, useful information on these is apparently scarce. There are some S250's with the 48VDC supply input showing up on EPray recently, I snagged one.

Mine came with V1.30 installed. I immediately did a hardware mod to supply 5V to the antenna instead of 12V. It's a pretty trivial change, if anyone is interested, I'll post details.

I'm installing a Vectron ocxo, just came today.

One issue, I tried upgrading with the 1.36 update distribution above, not the image, but the actual upgrade file. It fails, logs say 'incorrect hardware version'. Anyone have any clues about this? Meantime, I'll try the image route when I add the ocxo.

BTW, this unit is really easy to hack Linux-wise. I'm surprised Symmetricom didn't lock it down more. Really, a 'settings backup' that's a straight tar of various Linux dirs? But it does make hacking a lot simpler.

Bill

[wje]

Update - neither the 1.36 upgrade path nor the 1.36 image posted here on a Delkin CF work. The image starts loading the OS, then hangs. Guess I'm stuck with 1.30. Status page reports 'Authentic AMD Geode ... 500. This is one of the x86 clones they got from National Semi. Not sure what mfg date is, random stickers inside the box with fairly high rev letters (G, H, etc). Hardware clock version is 1.83. Running sw version is pc_target.chronos.1.667.13.1551430. Any help appreciated. OTOH, ocxo is working fine.

Bill

[SoundTech-LG]

Did you try resetting to defaults first??? Worth a try.

[wje]

Oops, pilot error. The upgrade tar applied fine once I figured out that when the manual said "don't uncompress the tar", that didn't mean "don't unzip the zip file with the tar in it". Duh. Bare tar updated fine. So, I'm now in the ranks of S250 owners with an ocxo upgrade, root login via ssh, and V1.36 sw. Sweet.

[deepskyridge]

I don't seem to be able to get the root hack to work. When I try SSH login it does not know about user root.

I have tried at least twice.

Gary

[TheWizard]

You cannot ssh directly with root user.  Ssh first to the lan-1 IP address with the same admin user/pass credentials as the web gui. Once logged in then enter: root eng sys cat "/dev/null && bash"

The iLotus GPS board can be purchased with credit card from Synergy Systems in San Diego Ca.  https://synergy-gps.com
Part# is: IL-GPS-0030-B

As posted above, the gui firmware update files in the link have to be first unzipped, then apply only the rar file.   

[notfaded1]

Looks like I need to work on my stack of S200's again some more!  This image that will fit on more of the many cards is big plus thanks for linking to a version that can fit easier. 

Bill

[deepskyridge]

Wizard, thanks for the information.

I have my 200 upgraded and working.

Gary

[TheWizard]

NP

To clarify, the linked 1.30 firmware image can be burned to any 512mb CF card (I also tested a few 1gb and 2gb cards and they worked fine) using the included RawCopy tool.....no need to fool around with the weird sizing issues in earlier posts.  For those that obtain S2xx units with dead/missing CF cards, this is needed to get the system booted.  The 1.30 firmware image was copied from a brand-new S250 as a backup. 

From a security perspective, there is no way to verify the integrity (I assure you it's clean) of the 1.30 image I provided, so after getting a S2xx booted it is important to unzip the 1.36 firmware package and use the gui to apply the tar update file. If you have a MicroSemi/Microchip support account, you can verify that the MD5/SHA1 hashes in the zip files are legit and the update tar files are untouched. 

These units run a fairly old version of Linux that has not been patched in quite some time.  However, the way Symmetricom designed the OS is highly customized/specific to their use and hardened in ways that are not dependent on file patching, so I would not worry much about attack surface. 

When a firmware update is run from the gui, the process exchanges private encryption keys which invoke secured check scripts that parse root for cleanup, file signatures, permissions, and other security details.  Anything "extra" in the system gets cleaned out or overwritten during upgrades, so if you have these units providing NTP services to public clients, it might be advisable to periodically re-run the 1.36 update.

I also included the latest S3xx firmware update file in case anyone also has one of those units. Cheers. 

Symmetricom Files

[SoundTech-LG]

Just found one of my CF cards with V. 1.36 on it that is only 510MB easily fitting on the 512 CF cards.

Here it is...   https://www.dropbox.com/s/3g2oi29c4k91afp/V.%201.36%20510MB.imgc?dl=0

It has the Default login credentials except Symmetricom is with the UPPERCASE S
Hope that saves you a few steps!

[SoundTech-LG]

I added another image file for v. 1.36.  This one is completely factory defaulted. When you default the unit, the file size on the card grows to the max size of the CF card. (is that a feature???) This CF card is 512.48 MB. Still possible that a lot of CF cards are at least that big.
So here is the link... 
https://www.dropbox.com/s/p4emcefkge7ipj8/V.%201.36%20Defaulted_512.48MB.imgc?dl=0

[keitho]

I was overjoyed to find this topic, useful information on these is apparently scarce. There are some S250's with the 48VDC supply input showing up on EPray recently, I snagged one.

Mine came with V1.30 installed. I immediately did a hardware mod to supply 5V to the antenna instead of 12V. It's a pretty trivial change, if anyone is interested, I'll post details.

I'm installing a Vectron ocxo, just came today.

One issue, I tried upgrading with the 1.36 update distribution above, not the image, but the actual upgrade file. It fails, logs say 'incorrect hardware version'. Anyone have any clues about this? Meantime, I'll try the image route when I add the ocxo.

BTW, this unit is really easy to hack Linux-wise. I'm surprised Symmetricom didn't lock it down more. Really, a 'settings backup' that's a straight tar of various Linux dirs? But it does make hacking a lot simpler.

Bill

Please post details on your 5V antenna mod!
I just got two s200 units that I intend to use as NTP servers for my network, and I would prefer not to have to buy $300 antennas if I don't have to.

[JoeFloyd]

I have a couple Symmetricom S200 devices which I've updated with GT-8736 GPS/GLONASS timing receivers.  The GT-8736 is drop in replacement for the Motorola M12/M12+ GPS boards which no longer work due to GPS week roll-over.  The software running on the S200 is the latest available.

The GT-8736 are much better GPS receivers than the GT-8036 receivers which were installed by Symmerticom.  The GT-8736 see 10 GPS satellite while the GT-8036 would only see two or three.  I now get valid GPS time and show GPS lock. 

Even with GPS lock I neve see the Hardware Clock status go "Locked".  It is always unlocked and the clock is not updated by GPS.  NTP does update the clock.


I added BNC connectors to the S200 for IRIG, 1 PPS, and 10 MHz and have tried feeding IRIG-B time and date info from an upgraded Symmericom S300-R to the S200.  IRIG shows locked, but once again the hardware clock is never updated and shows "Unlocked".    I'm not sure if I have something configured wrong on the S200, but the same basic configuration works on the S300-R.

A second issue is that upon adding an OCXO and jumpers on JP3 and R121 the S200 (hacked to S250) will sometimes automatically detect the OCXO and update the oscillator setting in the EEPROM, but the 10MHz frequency never reaches 10MHz.  It it always 100 - 1000 Hz off.  The OCXO in the S200 stabilizes at a frequency that is never exactly 10MHz when measures against the 10MHz output form the S300-R (hacked to S350-R) or a Chinese GPSDO which agrees with S300-R to within .001Hz (relative phase drift measurement).  An new exact part VECTRON OCXO as installed from the factory is being used.   I haven't tried looking at the control voltages being generated to adjust the OCXO.  Upon power cycle of the S200 the OCXO appears to not startup or not startup fast enough and the software shows the oscillator type as Unknown.  This also seems to impact the GPS receiver and the GPS receiver is shown as Unknown whenever the oscillator is not detected.

I have removed the OCXO since I was able to track down a couple Symmetricom X72 rubidium frequency standards (used). 

In order to install the X72, I used a break-out board that is being sold by an EEVBLOG member.  There are only six pins to connect.  I haven't been able to find a pinout for the connector on the S200 mainboard, but photos of devices with rubidium standards installed and the cover off gave me enough information to figure out the pins.  When the X72 is installed, the R121 should be unpopulated.  Only J3 should be installed.   The S200 hacked into a S250-R with X72 rubidium does achieve and exact 10MHz output.  The control loop of the S200 appears to be functioning as expected but the rubidium oscillator has 10x the phase drift than the S300-R, and the darn Hardware Clock always remains "Unlocked".  This should only impact NTP and IRIG as far as I know. 

Does anyone have any idea what is going on? Even if the GT-8736 is doing something weird, I would expect the IRIG-B time source would have set the hardware clock.  Is this a software issue?  It would seem so.  The X72 rubidium frequency is exactly 10MHz which is pretty good proof that the FPGA is steering the oscillator.   

Since my goal is to have a working commercial GPSDO I don't have much more I need to do, but it would be great if the OCXO worked as advertised since the X72 rubidium standards have a limited life, are out of production, and the ones I can afford have thousands of hours on them.


FYI, the S300-R I've hacked into an S350-R also had the GT-8036 GPS board and failed GPS lock.  This was replaced with a GT-8736 and I now get GPS lock without any issues.   Unlike the S200, the S300-R does show hardware clock lock.  So, the Gt-8736 does appear to be a drop in replacement and works great in the S300.

Unfortunately, the GT-8736 is out of production and I can't seem to find any for sell.   I paid ~$50US for each GT-8736 from a UK parts distribution company.  A few years ago, several people on the timenuts mailing lists did a group buy of the GT-8736 receivers for ~$25US. 

-----

Just in case anyone is interested.  While I had the GT-8036 board installed in the S200 I decoded the serial data stream from the GT-8036 and the Motorola protocol which reports GPS status @@Ha would never show a valid date.  It had the correct time, but the date was completely wrong with too many Zeros.  I believe this is why the S200 would not accept the time and date information from GT-8036 regardless of the mode of the GPS receiver and having 5+ satellites in the timing solution.  The TTL serial data in Motorola binary format  is not hard to decode.  It should be possible to use something like an Arduino or PIC with two UARTS to sit between the GT-8036 and the S200 and patch the @@Ha message to insert the correct date information using a battery backed clock. Since this only updating the date, it doesn't need to be all that accurate as long as the date is set correctly when the time goes past GPS midnight.  I mention this because the replacement M12/M12+ boards are $400US.  If the date is the only thing wrong with the GT-8036 boards it would be worth making a custom Arduino board to intercept and update the serial data.  This is just an idea to fix the GPS Lock issue cheaply.

The GPS Week Rollover issue doesn't impact time or the 1 PPS signal generated by the GT-8036.  The S200 only uses the 1 PPS signal to control the TCXO/OCXO/X72,  so there isn't anything hardware wise that I'm aware of that should care about the GPS date.  The FPGA should only care about the 1 PPS, but I'm pretty sure the software tells the FPGA when GPS lock has occurred and the 1PPS is valid.  Without a valid date, the software never tells the FPGA the 1PPS is valid. I haven't actually tested when the control loop starts steering the oscillator, so take that with a grain of salt.

----

S200/S250 P3 - Rubidium Oscillator connector pinout

From inboard to outboard

1 -  Service / End of Life Pin
2 -  C-field / Frequency Adjustment
3 -  Vpos / 15V
4 -  Vneg / GND
5 -  Vneg / GND
6 -  10Mhz Sine / RF out

The breakout board I ordered matches the pinout from the Symmerticom X72 manual

http://www.rdrelectronics.com/skip/nov/X72.pdf   See page 54


See

Here is a photo of the breakout board.  It has the same schematic as the Symmerticom breakout edge connector board.

See

The pins which are used on the X72 edge board connector are

4  -  Service / End of Life Pin
5  -  C-field / Frequency Adjustment
1  -  Vpos / 15V
7  -  Vneg / GND
8  -  Vneg / GND
16 -  10Mhz Sine / RF out

[testpoint1]

today I also tear down a Rb version of S200, if you just need the 10MHz port, no need to do so many things, just connect a BNC/MMCX cable to X72 interface board. and install the BNC connector to the rear panel.

[JoeFloyd]

Having the NTP, IRIG, and 10MHz out all working is my goal.  All of that works, but the software controlled hardware clock status remains in the unlocked state when using GPS or IRIG.  I can't explain why since the hardware clock is updated to the correct time by the NTP client software and matches what I can read from TTL serial output from the GT-8736.    I haven't tried decoding the IRIG data, but I assume that the S300 hacked to S350 with IRIG outputs is doing what it should.  The S200 hacked to S250 with IRIG inputs locks to the IRIG data which includes date and time information.  But, again, the S200 with IRIG inputs never shows the  hardware clock as locked even though the IRIG status shows locked. 

The GPSDO of Chinese origin is plenty accurate with minimal drift when GPS is locked.   If all I wanted was an accurate and stable 10MHz, the Chinese GPSDO is fine.  If I want to compare frequency standards in order to confirm that the standards are working as expected, I do need independent standards. 

Why do I care?  No good reason other than falling into the rabbit hole of metrology and the physics for cesium and rubidium standards allows me to clear the cobwebs that have formed since I received my physics degree back in the 90s. 

[testpoint1]

Having the NTP, IRIG, and 10MHz out all working is my goal.  All of that works, but the software controlled hardware clock status remains in the unlocked state when using GPS or IRIG.  I can't explain why since the hardware clock is updated to the correct time by the NTP client software and matches what I can read from TTL serial output from the GT-8736.    I haven't tried decoding the IRIG data, but I assume that the S300 hacked to S350 with IRIG outputs is doing what it should.  The S200 hacked to S250 with IRIG inputs locks to the IRIG data which includes date and time information.  But, again, the S200 with IRIG inputs never shows the  hardware clock as locked even though the IRIG status shows locked. 

The GPSDO of Chinese origin is plenty accurate with minimal drift when GPS is locked.   If all I wanted was an accurate and stable 10MHz, the Chinese GPSDO is fine.  If I want to compare frequency standards in order to confirm that the standards are working as expected, I do need independent standards. 

Why do I care?  No good reason other than falling into the rabbit hole of metrology and the physics for cesium and rubidium standards allows me to clear the cobwebs that have formed since I received my physics degree back in the 90s.

I also strange that hardware clock always in "unlocked" status, I checked the white line of No.5 within P3, when the X72 is unlocked, the voltage is high (5V), when X72 is locked, the voltage should be turn to low (low than 0.3V), but still 1.15V; when I disconnect the pin from X72 to S200 motherboard, in the locked status, the level is exact 0V, I only have one S200 in hand, not sure it is X72 or S200 motherboard problem, or design problem.

[dj831]

Hi all, my two cents on that (old) topic ... I found an S250 with a rubidium clock inside, sold as working. Of course, no surprise: no GPS sync. Here's what I did ...

• Firmware upgrade. Either I was extremely lucky, or I don't know, but it was a strightforward process. I did it in a totally different way, knowing my level of competence about Linux (close to ground level), as I did many years ago for a Lantronix server. I used WinHex and made a raw copy to save original Flash Card, a Delkin Devices CFX512I4G1-DAAEG00 with v1.26 running on it. I took the first 512Mb card I had, a 512Mb Sandisk SDCFJ, I restored the image, and voilà, it worked like a charm. I then performed the upgrade with the tar file found several posts earlier, and done, v1.36. I Did the same on the original flash, same result: S250 runs on v1.36

• Power supply. Not an upgrade in itself, but I noticed that it is nearly indentical of those found in old Cisco 2500/2600/1800 routers. Note though that if your symmetricom supply fails and you want to use one of these Cisco power supplies, you need to keep casing, and simply swap electronic board (it misses drilling on cisco supplies). Note also that it won't work for rubidium version, since 12V rail wattage of Cisco supplies is lower than wattage of Symmetricom supply

• GPS module. I performed tests with the original Pentair (GT-8031) module here: https://www.eevblog.com/forum/metrology/symmetricom-syncserver-s350-furuno-gt-8031-timing-gps-gps-week-rollover/. That module will never work again in an S200/300. The only way that could perhaps make it work again would be to intercept ZDA frame sent by GT-8031 (TX) to MSP430, and replace date (2003 for example) by adding rollover offset. It would need an extra microcontroller handling one COM port (RX from GT-8031, TX to MSP430). BTW too much complicated. Thus, I ordered an HD-8736 module from EHOL Design thru eBay (the easiest way, even if I'm in France too). Their module is the Furuno GT-8736, modded with an extra regulator to make it work on a wide range of devices (3.3V or 5V). The module was slightly to tall, but issue was easily solved by adding 2.5mm washers between standoffs and module. It works, but you must set 'dynamic' mode in References/GPS menu. Note that they purchased the very last stock of a distributor, hence the availability of the module still in 2023. Important notice: rollover of the GT-8736 is in 2032.

• Antenna. Finding a 12V antenna is a nightmare. I purchased back in 2016 a PCTEL GPS-TMG-HR-26NCM (26dB GPS Timing Antenna). Datasheet rates it for 5V, but usable till 12V. It works like a charm. For those wanting to use a 5V only antenna, be aware that power supply of antenna is not managed by Furuno module, but by an LT4254 on the main board. You can't change supply of that component, since its minimum supply is a bit above 10V. You could though try to use a 6.8V/1.3W zener diode in series with L1 inductor (27µH), to lower voltage of antenna without impacting the LT4254

I've attached some pictures, if it helps 

[NA5WH]

Good day.  I've had my modded S200 running for.... feels like ever now...

One problem I've had off and on was that periodically the front display would be garbled. I don't seem to have a picture of that at the moment, but it was fairly short-lived and infrequent, would last half a day or so and be fine for many days.

Last week it went bad. I am so used to looking down and seeing the current UTC time and after coming home from work it was frozen display with a time hours old at that point. Unit was completely unresponsive to front controls (LEDs still work, NTP light comes on etc).  Verified that web and ntp on it were still going fine (they were/still are), and while I don't have anything serious on my 10 mhz loop, my RS sig-gen still thinks its getting a good 10 mhz...  so left it to sit thinking it would come back after a few days. No luck.  And ending a year+ uptime, I powered it down, and back up... front panel display and controls worked fine (but of course usual wait for it to be totally happy for gps lock etc). But next day I get what is shown below (something half-way between two different messages), and again unresponsive to front panel buttons but LEDs are fine. Its now been another day and still showing that.  I assume there must be some chip controlling the VFD and controls that is likely to blame. Just curious if anyone run across this before that might save a bit of troubleshooting time on it.

Only other mod I have on it is replacing the original GPS with an "i-lotus" IL-GPS-0030-B in May 2021.  I didnt seem to have any issue with the Sept 2022 issue.

[dj831]

If you need to replace your VFD module, it is orderable from Farnell, with different firmware, if it helps (Farnell code 1495427, with a deadline of 19 weeks). But do not forget to check power supply capacitors first (or replace supply with one removed from a Cisco 2500/2600/1800 router, if you don't have Rb oscillator).

[Kets_One]

To anyone needing an original Furuno GT8736, i have one laying around.
Please send me a message if you're interested.

Module is sold. Please do not message me about this anymore

[phollens]

Good Morning.  I have picked up an S250i, which I didn't notice was a model without the GPS card.  I have found some GPS cars to buy, however, I am not clear which mini RF connector is on the motherboard.  I know that the connector on the GPS card is a MMCX, but the one on the board does not look like it is the same size.  Any help would be appreciated.


 I have an X99 on the way for it.  It appears to have the same pinout as the X72.  There is an eBay auction with an ST2-Rb module with the X99, and the breakout board  says x72/X99.

I also have an X99 in my 8040C, so that should help me figure it out if it is not 100%.

Thanks for the time.

Patrick

[dj831]

Hi Patrick, perhaps the picture on previous page can help you  Two questions, though: do you still have the white cable in your S250? And second question: what GPS card did you find? That question since there's not much choices left these days ...

I too received an S250 without any options last week, but since that one is intended to be used only as an NTP server, I'm just upgrading the TXCO to an OXCO, ordered few days ago from China. Last but not least, perhaps it could be less expensive to build your own breakout board, since manufacturers like JLCPCB are very cheap 

Hope it helps.

[phollens]

There was no coax cable because the S250i doesn't have a GPS module.(That is what the 'i' at the end means)   I found an i-lotus module on AliExpress and it is on its way from China.  I have also been looking at the Hoel HD-8736 board from France.  You can find them on the on-line flea market with item number 134477429692.  I saw on some previous posts here that that card maybe didn't work as well as the i-lotus board in these systems though.

ProStudio Connection did have 2 i-lotus boards up until today.  I didn't want to pay close to  $300 for one though.

The fine people that have the HD-8736 board for sale that I referred to above let me know that the needed cable is an MCX male to MMCX male.  They gave me a samtec part number of RF174-02SP1-03RP1-0152.  Digi-key has them in stock.

I have also ordered 2 of the X72 breakout boards from South Korea, but I have not heard when they might be shipped yet. 


Patrick

[phollens]

I got the cable in from Digikey, and having to do it again I would have gone with right angle connections on both ends.  It does work, but it sets off my OCD.  The part number of the cable with both right angle connectors is RF174-02RP1-03RP1-0152.

I changed the model number to the regular S250 and I now have a GPS tab in references.  It  is giving me an open antenna warning along with a status of 'Acquiring Signal' in the GPS status tab.

I am just waiting on my PCTEL 40dB antenna and my N to BNC cable now.  I will let you know how it goes.

[phollens]

I was able to get the i-lotus GPS module installed and everything looks fine except that I still don't have GPS as an option under the Hardware Clock section.  I am thinking that it is not enough to change the model number on the S250i to get it to use the GPS time. 

Update:  I was able to get it to pick up the GPS as a HW Clock by doing a factory reset. 
Note:  You have to set everything back up from scratch.  If you restore a backup it removes GPS as a HW clock source.


Update 2:  The i-lotus board that I got from China appears to have the week number rollover bug.  It is saying that it is 2004.



Patrick

[deepskyridge]

I have a S350 that I put a i-lotus board in and it had the same problem, replaced it with one of the Heol boards from France and it is working fine for a couple of months now.

Gary

[dj831]

An update about M12 card: the HEOL card based on GT-86 is no longer available (the rebadged GT-8736 + a regulator). The good news is that they now sale a compatible card based on GT-88. That card contains a GT-88, a voltage regulator, and a serial to USB converter (CP2102 from Silabs). This time, the card is based on their own design, thus not being dependant on providers (apart Furuno with the GT-88 module). Note that firmware of the GT-88 is not standard, since by default, GT-88 uses eSip format, and not Motorola.

I had the luck to get that card, since the last GT-8736 card available on eBay was NLA - they sent me that one instead. For those who'd like to purchase one, eBay item is 134842120193. 145€ (including VAT) is not cheap, but the GT-88 from Mouser isn't either (103.80€ with VAT). And no risk about fake iLotus on AliExpress (fake, like most of ICs made from unobtainium that are curiously available on AliExpress  ).

Despite mine looks like a proto (SW jumper is not used, all three pins are soldered with a LED wire, and original choice of D2 was apparently too light), it works like a charm, either in Survey and in Dynamic mode. As a simple test, I had all LEDS green (=synced) in both modes after c.a. 14 minutes (from cold start each time).

Let's hope that helps users of fake iLotus

[nesnet]

I just received two HEOL GT-88 boards to rehab an ailing Symmetricom S200 and S300. They are plug & play... and currently I have them running into a Symmetricom antenna mounted in a closet (with no view of the sky), through a Symmetricom 1:2 splitter. They are both receiving 5-8 satellites consistently... this will improve as soon as we move them over to the outside antenna. Very sensitive receiver.

The two boards saved us a ton of money... because the manufacturer's response to mitigate the issue was "buy new time servers, they are not upgradable" -- at a total combined cost of nearly $12,000 (configured to our requirements).

Dealing with HEOL was a pleasure. I received excellent advice from a very knowledgeable individual (all through email), the boards arrived promptly in six days from order date via USPS (allowing two days for U.S. Customs processing in NY), took less than five minutes to install - and synced up quickly. We are working on another project - a Symmetricom ExactTime (ET-6000). They have a solution for that too, and the board was just shipped.

We have our Network Time Servers back at a fraction of the cost of replacing them with two new units. I didn't know HEOL existed prior to reading your post. Thanks.

[dj831]

You're welcome

Note that these devices (S200 & S300 series) ***could*** be affected by 2038 bug, AKA Y2KE38 superbug or Epochalypse (source: Wikipedia): date is coded on signed 32 bits. When clock reaches 03:14:08 UTC on 19 January 2038, there is an overflow (011111111 11111111 11111111 11111111 to 10000000 00000000 00000000 00000000), and clock displays 13 december 1901). This is a known bug of Linux, as it obviously uses Unix time representation.

I'm absolutely unsure about this, as I do not know how date is coded inside S200/300 series, but I doubt that Symmetricom wanted that their devices would last that long

Perhaps that's a thing that I could ask to EHOL, sine they knows very well these series, and have a GPS simulator.

[nesnet]

Now I have one more thing to worry about.

HEOL never disclosed a possible 2038 bug that would impact my equipment. So let me understand, in 14 years from now, I'll have to purchase another board from them? Outrageous. They should have disclosed this theoretical failure prior to the sale. I think I should withdraw my strong endorsement of their product. This GT-88 upgrade board is going to fail in 5,330 days?

I'm going to be very annoyed on January 19, 2038... when I demand a full refund or replacement board.

Thanks again, for the heads up on this egregious oversight.

Seriously, I hope the word gets out about their products. They do a great job, and I'll wager that a lot of people could save a collective truckload of money upgrading their Symmetricom (Microsemi) boat anchors.

I wonder how other vendors are handling this? I know it's not a great sales tactic, but disclosure that an upgrade path exists would have been appreciated and helpful. Imagine companies or government agencies with 20+ time servers being told to scrap them and start over. I do know that EndRun Technologies provides an upgrade service for their GPS-based products. We had two Meridian units factory upgraded.

[dj831]

Hi, no, this is NOT your EHOL card that may fail in 2038 - yours shoud last 'till c.a. 2044, i.e. rollover issue common to all GPS - but your S200/S300, due to the way it was programmed (Unix time). That being said, EHOL is one of the too few manufacturers that offers a reliable fix to GPS bug: redesign of the M12 board. Furthermore, they are fully able to fix their GT88 firmware, since they built it (unlike Furuno GT-8736)

There are Linux genious in that forum that own S200/S300 too, let's hope that at least one may answer that question. Meanwhile, I'm gonna ask O. Descoubes (EHOL) if he did the test with his GPS simulator.

---------

Edit: sorry, I missed your humour - a problem when you're not a native English or American  . But seriously, I still ask O. Descoubes and I let you know. And true, they do a tremendous job!

[nesnet]

Olivier is the person I communicated with (and is also solving my Symmetricom ExactTime ET-6000 problem). Very knowledgeable individual, who answers email in real-time. Does he sleep? I'm in NY, sending him questions at 5:30p and he answers. Isn't it 11:30p there?

Or is Olivier an AI bot?

[dj831]

Hi again, I've just asked him the question. And I asked him too if it is possible to change time system to another one (Galileo for example). And no, it's 19:23 here (GPS CET time )

[nesnet]

We have a Symmetricom S300 with Amazon Alexa built-in (it's a $2000 factory option). When I asked it for the time in Paris, it gave me the wrong answer. Maybe it's the new board.

Does anyone know what the latest software build is for the S300? I contacted Symmetricom a/k/a Microsemi and no one ever got back to me (what a surprise). It is currently at 2.80.1

Incidentally, I have a rant about your country. The last time I was in Paris (July 25, 2019) it was 107 degrees F (41.6 C) with at least 150% humidity. All the major roads were barricaded because the Tour de France was arriving the following day, and your President was attending. Military personnel on every corner. Not very tourist friendly. Spent three glorious weeks in your country that year, return every couple of years.

[dj831]

Hi, glad that you liked France But what often foreign people say about our country is that France is lovely ... apart French people (Yes, we could be much more friendly with tourists and foreign people . Sadly, it is much worse in Southern France - and not only with foreign people

About software for the S300, version 2.83 was uploaded to Google drive (user TheWizard). I cannot hely you further, since I own an S200 (OXCO upgraded) and an S250 (Rubidium factory installed).

Bonne journée !

[dj831]

Hi Nesnet, I confirm: Olivier is NOT an AI bot, he gave me a 'real' answer He (the HEOL team) tested their own servers only, and not the S200/300 series. That being said, if I had to purchase an NTP / GPS time server, I would probably purchase it from HEOL, just because they offer a real support unlike some companies (any resemblance is purely coincidental  ).

Interestingly, he sent me the Furuno GT-88 specifications protocols: the eSIP, of course, but also the M12 that I was not able to find on Furuno' site (or I was too tired/lazy/whatever else to be able to find it). I may be able to test some day the Galileo reception of the GT-88 or whatever that does not have a 10 bit week date coding, i.e. whatever else than GPS protocol.

Hence my question: is there someone browsing that topic owning a GPS simulator would be kind enough to test an S200 or S300 beyond january 2038?

Thanks! 

[nesnet]

How do I access 2.83 on his Google drive? I appreciate the information about the update availability. Thanks.

If it is confidential, pls PM me.

[nesnet]

I have heard, for years, that the French had no use for tourists... particularly Americans... an attitude I have never encountered on many business trips -- and a few vacations. It all depends on how you interact with people, IMO.

I can tell you that it's easier to communicate with French citizens than it is to get information from the U.S.-based micro semi company that manufactures network time servers. If you're fortunate enough to get a human to respond, it usually results in why they can't help you, or that the minimum factory charge is $1,000 [USD] for anything... and that you need to submit answers to about a hundred questions to use their website... ultimately to be turned down.

I was, formerly, a big supporter of their products -- and encouraged a number of colleagues to purchase them. That ship has sailed.

[dj831]

Hi, really sad to see that such big companies are so proud not to condescent to 'loose their time' to speak to individuals. Despicable attitude, IMHO.

Anyway, we are lucky enough that Eevblog exists, a place where information is not kept private and hidden from 'allmighy gods' in these companies And since data is shared by everyone to everyone, here's the link from previous page: https://drive.google.com/drive/folders/1fY7BdK7xM6wBncqCQfSFv5qZsb5m014i. The file was not shared by me, but by TheWizard (credits to him).

Hope it helps

[nesnet]

Thanks.

Just received two Symmetricom XLi SAASM (Govt spec'd) anti-jam GPS receivers. Haven't had a chance to evaluate them yet. Information is not forthcoming from the manufacturer, and very little data is publicly available. More to follow when I dig into them.

They were likely very expensive when new. It's a XLi on steroids. Complete with HTTP screens that are marked in red "Official Use Only".

If anyone can provide information, it would be appreciated.

[testpoint1]

I have the Force 22E, there is no week rollover problem for it, you just test it if exists the problem, others no need to care, it is not for Civilian use.

[JoeFloyd]

If anyone is looking for a reasonably price active L1/L2 GPS antenna, this E-Bay listing has such an antenna listed for a reasonable price.  (< $30US)   The Antenna is an Antcom 1g1215a-xsc-1-pc-RoHS-G which says that it is tolerant of LNA voltages from 2.5v to 24v.

https://datasheet.datasheetarchive.com/originals/crawler/antcom.com/9ec044cf132c90fd9bd7bbcf3b40c318.pdf

This antenna has a female SMA connector.

https://www.ebay.com/itm/324689951643

This is not my listing so buy at your own risk.

[DavidKo]

Some experience from my side. The device I have bought was without CF card. I can confirm, that no-DMA card is necessary. But double check the datasheet. Mine from Mouser Apacer *-NRG was according to description non-DMA which is not true. It need to be *NDNR* - but I cannot confirm that it will work. Other option is Delkin CE51TQMF3-F1000-D, today 9pcs available only in Newark US shop ~USD28, but their EU price 109EUR is a bad joke (F1 should be for non-removable, non DMA - datasheet available at Digikey). So I have kept searching and found Delkin CFX01GE8D1-DAAEG00 on ebay - I checked the photos of Delkin cards  and found one that seem to be OK, no remarks in description. I can confirm that this 1GB type works(datasheet).

I have replaced original GPS with HEOL. The antenna I have bought from Ali.

I want to try add OCXO, but I was not able to find Vectron MC597X4-040W. Do someone have the datasheet for Vectron or experience with different OCXO type? The pin layout seem to be common type, so different manufacturer OCXO can be used.

[tverbeure]

I was able to buy a pristine S200 at the local flea market and I'm trying to do all the upgrades that have been described here.

It came with the 1.26 software version, and it uses an AMD Geode processor board.

The Good:

• Making a copy of the 512MB flash card to a $14 white label 512MB "Industrial" flash card from Amazon was not an issue at all. I bought this one: https://www.amazon.com/dp/B07HL5F1VX
• It was also no issue to install version 1.36. Many here in this thread mention that v1.36 requires a special sized flash card that's a little bit larger than 512MB. For some reason, that's not the case for me.
• I was able to get root ssh access using the instructions earlier in this thread.
• The GPS sees either 9 or 10 satellites.

The Bad:

• The unit comes with a GT-8031H GPS module, so it has the rollover bug problem.
• It took ages to get GPS to work. There might be some bad contact somewhere? It's working fine now, but before it did, I get "Timing GPS Source" alarms, which pretty mean that the GPS module wasn't working at all.
• It never goes into "Status: Locked" state.

What I did different: I used Linux instead of Windows to do all operations. No need for HDD Raw Copy, I just used "dd" to archive the flash card file system. Also, when I plug in the flash drive in my Linux machine, I can access the file system as if it's native. It looks like this at the root:

tom@zen:/media/tom$ ll
total 13
drwxr-x---+  7 root root 4096 Mar 17 11:57 ./
drwxr-xr-x   3 root root 4096 Jul 14  2021 ../
drwxr-xr-x   4 root root 1024 Dec  8  2010 _boot/
drwxr-xr-x  18 root root 1024 Dec  8  2010 _fsroot1/
drwxr-xr-x  18 root root 1024 Dec  8  2010 _fsroot2/
drwxr-xr-x   2 root root 1024 Jan  2  2006 _persist/
drwxr-xr-x   2   99  503 1024 Jan  2  2006 _tmparea/

And when I do "sudo du -m -s" there, I get this:

tom@zen:/media/tom$ sudo du -m -s .
[sudo] password for tom:
140   .

So the flash drive contains 140MB. Again, I don't understand where that 512MB-is-not-enough issue was coming from?
One thing I did notice: when you upload the wrong file to upgrade (e.g. when uploading the .zip file instead of the .tar file), then that file won't get deleted. You can either delete it through the web interface, or, when logged in as root, by deleting all the files in "/mnt/upgrade".

Going to the biggest issue: the status remains in "unlocked mode". Any idea why that's might happen? How long does one typically need to wait until you're getting into locked mode? My TM4313 GPSDO goes into "track" mode after a few minutes. Maybe this thing needs a much longer time?

I'm using a Symmetricom 150-615 down/up converter (https://www.microsemi.com/existing-parts/parts/138272#overview), but I don't think that should matter.

Attached are some status screens...

[Astralix]

Hi!

Got my S250 in the mail today and inspected it. Unfortunately a no-options unit, so no OCXO and no Rubidium reference. It's GPS is a Furuno GT-8031F module, need to figure out, if it shows a date. For now, I do not have any 12V antenna, but I will hook it up to my GPS splitter and let the old GPS reference power the antenna.

This unit seems not to receive any satellites. It is mounted to a GPS antenna splitter from SV1AFN that is powered by 5V from another receiver that works fine. The S250 is connected passively, so my 5V antenna will survive
Unfortunately the S250 doesn't see any satellite nor does it lock to anything. Status says: Antenna: Good, Satellites: 0.
I'll probably opt for one of the modern replacements from France.

Only big question i have:
Is there any datasheet of the original MC597X4-040W OCXO? I could not find any details about it's precision, regulation voltage and such.

Because I want to use the system as my lab 10MHz reference, I'd prefer higher stability and better phase noise from a good OCXO over the ramping up and down of a TCXO and the high maintenance cost of an old used Rubidium reference.
So I'd like to adopt a OCXO in the lower ppb range.

[Astralix]

Seems like all of you have their units running... I still have an issue, so may be someone's willing to help a bit?

I have the S250 receiving GPS with it's Furuno receiver. I use a BIAS-T to cut out the 12V and supply external 5V to the Symmetricom 58532A antenna.
The Furuno seems to need quite a signal, so I have set up a crude but working configuration...

Antenna -> 30m cable -> BIAS-T 5V -> 50M..4G 13dB amp -> active 4-way splitter -> S250

The problem I still have is, that the 10MHz output of the S250 is still in "tracking mode". It does not lock to the GPS. The 10MHz output is is tracking +/- 10kHz up and down.
The counter is set to its internal high stability OCXO, the input is driven by an R&S SMIQ 03B set to external reference. It's external reference is connected to the 10MHz ouput of the S250.

Can anyone confirm that behavior, or if that goes away with the Huel PCB installed? Are there special setting required to get the TCXO synced to the 1PPS?

Thanks!

[DavidKo]

I think that this is already described in pages before. Your unit will not work on GPS. You need GPS module update. Same was on my side, after installation of Heol design module the unit is locking to GPS. I do not remember the exact rollover date when Furuno stopped working, but I think that it is also mentioned in the thread.

[Astralix]

Interesting, as the 1PPS signal is not related to the date information. That is sort of dumb design.
I'll test my old Trimble GPSDO, if that is still working, as these modules had been supplied with different GPS receivers, including some Furuno types.
Would be an interesting test as the modules are still sold on eBay.

[DavidKo]

I speak only about GPS. 1PPS, 10MHz or NTP should work without upgrade. You only need to configure it, but I have never tried to use different source that GPS or ntp.

[Astralix]

Hi!

No, that is the reference sources for the time server. It is not the outgoing reference clocks for something else.
The 10MHz output clock is tracking, i.e. the control loop is trying to sync the clock to the GPS, but the GPS delivers no reference.
Probably the 1PPS signal is missing and so the control loop is open.

I have another issue, as the 58532A antenna is only receiving L1 band. As the antenna position is not very optimal, it gets in trouble if there are not enough GPS satellites in sight. I guess that will be much better with a multi-band antenna and the modern module replacement.

[Johnny B Good]

Hi!

Got my S250 in the mail today and inspected it. Unfortunately a no-options unit, so no OCXO and no Rubidium reference. It's GPS is a Furuno GT-8031F module, need to figure out, if it shows a date. For now, I do not have any 12V antenna, but I will hook it up to my GPS splitter and let the old GPS reference power the antenna.

This unit seems not to receive any satellites. It is mounted to a GPS antenna splitter from SV1AFN that is powered by 5V from another receiver that works fine. The S250 is connected passively, so my 5V antenna will survive
Unfortunately the S250 doesn't see any satellite nor does it lock to anything. Status says: Antenna: Good, Satellites: 0.
I'll probably opt for one of the modern replacements from France.

Only big question i have:
Is there any datasheet of the original MC597X4-040W OCXO? I could not find any details about it's precision, regulation voltage and such.

Because I want to use the system as my lab 10MHz reference, I'd prefer higher stability and better phase noise from a good OCXO over the ramping up and down of a TCXO and the high maintenance cost of an old used Rubidium reference.
So I'd like to adopt a OCXO in the lower ppb range.

 I started my diy gpsdo adventures some five years ago with my very first ocxo (a 13MHz cmos output ocxo) that I'd picked up at (afaicr) the 2019 Blackpool NARSA mobile radioham rally for a mere £4.

 I was really looking to buy a 10MHz unit but, rather surprisingly, no one else had thought to bring any to their table of wares so when I spotted this only example of an ocxo of any type amongst a rather eclectic collection of 'junk', I was so desperate to acquire an ocxo that I took a punt on it after persuading the seller to reduce his £5 asking price to the £4 I paid for it.

 I had a vague notion that I'd be able to generate a 10MHz square wave locked to its 13MHz with a bit of TTL trickery to allow me to start experimenting with a home brewed 10MHz gpsdo reference. Indeed, this vague notion did prove to be true and so was able to breadboard a gpsdo using the uBlox M8N I'd previously purchased a couple months earlier to act as a (high jitter) calibration frequency reference by which to check (and if necessary adjust) a Kenwood TS140s HF transceiver that had last been calibrated against the then receivable WWVB broadcast some thirty or more years ago (rather gratifyingly, the transceiver proved to still be in calibration after all those years).

 Anyhow, the only problem I had with this "CQE" 13MHz ocxo was the lack of any pin out and supply voltage requirements data. The best I could find was for a 12v 10MHz Vectron datasheet. This confirmed the pin out but left me guessing as to whether it was a 5 or 12 volt part. Since this was my one and only example of an ocxo, I played it safe and tested it with 5 volts. It had a rather sluggish (5 to 10 seconds or so) startup to even show its 13MHz output on the breadboard's "5 volt" (actually 4.85v) before stabilising to a 4v p2p square wave trace some 7 or 8 minutes later when the peak current draw of 280mA finally subsided to 180mA or so. At that time, I did not yet possess a variable lab bench supply to experiment with so played it safe by running it off a Vcc of 5.14v where it sprang into life within just one second of powering it up.

 In the meantime, I kept searching for a datasheet with no luck other than discovering a UK based ebay seller offering the 10MHz sine output versions for just a fiver each (still without any voltage specification in their description). Despite this, I bought three to try out, followed by placing an order for another four before alerting the EEVblog membership to this cheap source of 10MHz ocxos

 My impression at that time had been that they were of a much higher quality than most other low priced ocxos being sold on ebay. An impression that eventually proved to be justified when I spotted this teardown video

https://youtu.be/zkzMtLyqju4?t=852

 Where the ocxo being used in this Symmetricom time and frequency receiver showed the exact same DOC1478 number (as well as the blue circular sticker with similar nn/n code (presumably a date code) as the ones stuck to my own set of ocxos).  I believe these "CQE" marked ocxos were originally an AEL product.

 Having now obtained more than a single sample of the 10MHz unit I felt I could take a chance on destroying one with a 12 volt "overvolting" test and proved that they were indeed a 12v part. One big clue that this would most likely be true was the fact that they were even more sluggish in producing an output than the 13MHz unit had been, even when powered from a 5.1v rail.

 By then, I'd already had the 13MHz ocxo fitted into my MK I gpsdo and running off its 5.14v rail so didn't immediately test it with a 12v supply. I left that until I'd made up a MK II version before stripping the MK I down to retrieve its ocxo for testing. I'd have preferred to keep the MK I intact to compare against the MK II but its construction had made it difficult to isolate the Vcc pin from the rest of the circuitry without virtually stripping it all apart anyway.

 Incidentally, all seven of these 10MHz units had measured within a millivolt of 5.128v on their reference pins (according to my Mestek DM91A 9999 counts hand held meter) versus the 3.2 ish volts reading from the 13MHz when powered from a 5 volt supply (in retrospect, another big clue that it too was a 12v part). I did eventually get round to doing the 12v test on this unit, by which time I couldn't care less about burning it out (it had served its purpose and would never ever be used in a 10MHz gpsdo ever again - too much TTL generated noise on the Vcc rail without resorting to an add-on 10MHz crystal filter to get rid of the close in spurs and their harmonics).

 I tried a tin eye image search with no luck but you might do better by cropping out an individual ocxo from the attached image file.

[Astralix]

Hi!

It should not be too big of a deal to drop in a different OCXO. There are a few high quality brands and prices reach from 85USD into 1800USD per piece. The Symmetricom S250 never had an dual-oven Trimble OCXO even you probably could throw it in as the DAC voltage is 0..5V I guess. There are 3ppb and 2pbb below 200USD available that fit the original mounting holes. But I need to know the pulling range and the pulling voltage range. If the pulling range is far different or the center voltage is 2.00V instead of 2.50V the regulation loop may go nuts.
The available OCXOs can be ordered in variants like control voltage is 0..4V or 1..4V, 1..5V, 0..5V and different center voltages.

I can't see anyone having tested the behavior so I may try hacking in a HP OCXO from my 10 MHz distribution boards or spend 85USD in the name of science. I can record the voltage versus the frequency that the unit is trying to control with.
Reminds me that I even own an HP PLL Analyzer, that I never used before in my life... Should be fun!

[Johnny B Good]

 I rather doubt the tuning rate would be much of an issue with these ocxos (casual observation during the initial lock in phase, after the gps receiver module had achieved a lock with the minimum of 4 good gps svs suggested a positive tuning rate of ~3Hz/volt). The required tuning voltage for 10MHz ranged from a high of 4.49 down to a low of 2.34 volts (this last being the one I used in the MK II gpsdo which has drifted down by just 15mV over the past two or three years).

 A recent test using a bench meter on its Hi-Z setting (10G ohms) suggests an infinite dc impedance on the EFC pin. Most likely simply something like a 10MR/100nF LPF connection to the the reverse biased varactor tuning diode which consequently accounts for the positive tuning rate (as is typical of virtually every electronically tuned XO regardless of whether they're just a tunable xo (Siglent 1000 and 2000 AWG series), a tcxo or an ocxo).

 Also noteworthy is the use of input clamp diodes to limit the EFC tuning voltage between ground and Vcc. I remember testing that  5 volt powered 13MHz ocxo using a 9v battery (with a 10K current limiting resistor) to see if it would tune past the 5 volt limit. It didn't so I concluded it must have had clamping diodes. This test btw had been inspired by the Vectron datasheet's mention of a 10v upper tuning range voltage limit.

 I don't recall repeating a similar test with the 12 volt powered 10MHz units (most likely because the worst case requirement was safely below the 5 volt limit of the PLL's output giving me no urgent cause to check this out). However, having now mentioned this, I'll repeat this 9v tuning test on the 4.49v ocxo some time soon to check out my clamping diodes hypothesis

 The point I was trying to make was that if you happen to chance upon a seller offering these ocxos at a sensible price (sub 30 dollars), they'd be worth taking a punt on (assuming the seller has a decent 95 + % rating of course).

 Also worth mentioning is the fact that the oscillator output must be unbuffered since my injection locking to an external 10MHz source in the one I'd used to upgrade my cheap Feeltech FY6600 only worked by injecting into its output pin, that plus the fact that I had to add a 100 ohm resistor across the output of the MK II's ocxo to eliminate a puzzling jitter on the resulting square wave output from the 74HC14 no matter how I trimmed the mid voltage bias on the gate's input pin (I'd connected directly via a 1nF cap without any load in order to get the maximum voltage swing into the 74HC14).

 I guess the oscillator had been designed with a 50 ohm loading in mind (possibly including a 75 ohm loading requirement) to prevent clipping induced jitter effects such as the one I'd experienced where it had taken the form of a change in duty cycle every alternate cycle. The 100 ohm had been chosen as a compromise between highest possible voltage swing without this peculiar jitter effect. At least one other EEVBlog member had also reported a similar peculiarity with another brand of sine wave output ocxo which vanished when he tried my solution.

 In retrospect, a better choice of resistor would have been 75 ohm. I had made a crude test of the output impedance of these ocxos and got figures ranging from a high of 90 ohms down to a low of 76 ohms, hence my choosing the 100 ohm option as an initial compromise value which seemed to be sufficient to eliminate this weird jitter behavior on the first try.

 One other thing worthy of mention is the useable voltage range these will function with. If you don't need the thermally stabilised voltage reference, you can use 6 to 13.2v (tested to a maximum of 14 volts btw) otherwise it's 11.5 to 13.2 volts if you need the 5.128 or so volt reference. Since the heater current is limited to a maximum of 280mA, a lower voltage can ease the initial startup power requirements at the expense of warm up time before it starts bouncing up and down as it over and undershoots the oven target temperature.

 In the end it makes no difference to the time they take to reach a sufficiently stable temperature some 20 minutes or so regardless of whether you use 5.5 or 13.2 volts. In your case, you've no such option to change the ocxo's supply voltage but in a DIY gpsdo project this can be an important consideration with regard to the power ratings of a 2.6 to 5.5v input boost to 12v output converter module feeding both the ocxo and a buck converter  module powering the 5 volt logic rail all powered from a 2.1A continuous rated 24v max input buck converter supplying it and a float charged at 3.85v protected LiPo cell that happens to have completely discharged to its cut off point.

 Using three dc-dc converters like this allows me to power the MK II from a minimum of 4.5v (below the cut off point of a battery bank) to a maximum of 24v (5 to 15 volt 10 watt rated wallwarts and 19 to 22 volt laptop charging bricks for example).

 I've no doubt you're wondering why I've gone to so much trouble but the long and short of it is that I was getting totally pissed off by the ocxo's oven controller's boot up behavior in response to even the briefest of supply interruptions (whether those caused by a wallwart  swap over or a cable rerouting exercise or the 10 to 20ms interruption when using the type of power bank that can act like a UPS (feeding the gpsdo via a 5 to 12v boost converter).

 The problem in this case being due to the oven controller's "Shoot first, ask questions later." startup algorithm where it blindly assumes a literally cold oven startup requiring the maximum heating current to reach operational temperature before it checks whether such an extreme response is really necessary. In this case the result is a massive overshoot, followed by the inevitable under/overshooting that requires another ten minutes before the PLL stands any chance of winning this game of chasing "Will o' the Wisp". The two or three seconds for the gps receiver to regain lock is tolerable enough but the disruption caused by the ocxo's hot startup behavior is anything but.

 I modified the 5 to 12v boost converter to 'paper over the' deficiency of a battery bank's brief interruption during any power source changeover or loss of its input power but realised this still didn't solve the problem caused by swapping out to another power source or a supply lead rerouting exercise so opted for the internal back up "battery" solution using one of a couple of LiPo cells I'd acquired for free.

 I only needed a mere 5 minutes of autonomy which could have been served with a couple of expensive 200F supercaps so it was a 'no-brainer' to make use of what I already had to hand, landing up with even only a 60% charged LiPo cell providing some 110 minutes of autonomy (now reduced to 90 minutes with the GNSS/RTK multiband timing antenna upgrade. Still an order of magnitude more than I required.

 Since I had to add a third dc-dc converter to the power train, I took the opportunity to extend the low voltage input limit from 6.8 down to 4.5 volts to maximise the benefit of all this radical modification effort.

 Anyway, there you have it : all you really need to know (and then some!) about these "CQE" ocxos should you chance upon a cost effective source.

[Astralix]

John,

a big thank you for all the details about your experiments! I totally agree about your findings and will inherit them to shorten my trail of experiments to adopt a different OCXO into my S250. I did not think about the real speed limiting factor of the control loop, which is the GNSS reference, not the OCXO.

The design of the S250 has a series resistor planned, even people using a retrofit original OCXO just bridged it. If I opt for a new OCXO, I could optimize the signal with a matching serial resistance. But it is still intriguing to use one of the low hours double oven OXCO from the LTE development system powered by the 12V supply meant for the Rubidium reference.

The goal should be to compile your detailed information and my practical approach into something that is repeatable for everyone to revive his S2xx / 3xx / 6xx units. It will take a few weeks from now on, due to workload and holidays, but with the Huel GNSS replacement arrived, the S250 will "unlock" all it's capabilities again.

[dj831]

Hi there,

Apparently, I missed a lot of things on that 'official' S200/300 thread (I don't know why notifications were turned off...). Anyway:

• For those who need to install an OCXO on their S200/S250, I had success with a cheap OCXO found on FleaBay: the Vectron C4550A1-0213. However, buyers's beware: purchasing them is a lottery. Of the 8 I purchased, one is perfect (hardly no drift), 3 drift in their limits, 3 drift too much (off limits then), and one is stellar on how much it drifts - totally unuseable. Chinese seller was either a moron or makes everything possible not to send you replacement parts (I gave up with him). Testing method: the 10MHz clock output of my PM6685R (Rb) feeds my PM6680, and I ran Timelab for 24 hours, after a warm-up of several hours. I adjusted EFC for all 4550's, sometimes several times, and I let run the whole thing. Note that EFC is set with a trim pot and a 4.096V reference. The PM6680R was checked against my S250 with an Rb inside (factory installed)
• I recently purchased an S300 for cheap, with a faceplate slightly damaged, but still useable, but with no power supply inside. In a previous post, i guessed that a Cisco power supply should fit. And it fits. I saw the original power supply of an S300 with an Rb inside on a blog, and it outputs +15V (a Cisco one outputs only 12V). As I have no Rb inside that S300, I still decided to test it, and it works like a charm - absolutely no issues so far.
• S200, S250,S300 and S350 owners (i.e. almost everyone reading that topic : BEWARE of original power supply! As the display in my cheap S300 was in pristine condition, I decided to swap it with my second S250, with OCXO added in it (the S300 is intended as an NTP server, so no need of a nice display ). While tearing down the S250, I noticed a slightly bulged Nichicon capacitor. As it would have been a shame to leave it this way, I replaced it. Surprise: it had popped up from the bottom - unnoticeable until the replacement. So, please take 5 minutes to check capacitors of your power supplies

I purchased since a 53132A from a nice German seller, and I will use it with one of my FE5680A in an enclosure as frequency reference, to replace the PM6680 and 6685R, though I'm building an option 010 for it, with a 10811 inside (no more used crap oscillators ).

Hope it helps.

[Astralix]

Question for the group...

There are three options to replace the old Furno module:
1) ~300€ The more expensive ProStudio Connection module with FPGA and what not.
2) ~170€ The French Heol Design module that, at least on the picture does not show any lable on the GPS module.
3) ~90€ An original LEA-M8F ublox module and some sort of self built controller for initialization, if required at all.

As my focus is on 10MHz reference clock output, not an accurate time of my server, it is interesting to see, that Heol tells about a 100ns jitter of their 1PPS signal, ProStudio says 2..6ns and ublox specifies their M8F module around <5ppb.

I know that the jitter will not be reflected 1:1 to the 10MHz output as it is dampened by the 10MHz OCXO regulation loop.

Any thoughts on that?

[dj831]

Hi, if it helps ...:

3) I would go for a LEA-M8T, since it is timing oriented. And such a thing should exists, since an eBay seller sells upgraded S200/S250/S300/S350 with a LEA module in it. BTW, a home built module with a LEA module in it should give full control over GPS offset (and why not, store that offset on an external socketed DIL EEPROM, and reprogram it 20 years later )
4) ~240€, an original GT-8736, NOS from eBay (186459605590), that should stop working in circa 2035 (it was built in 2016). Anyway, I still don't know if S200/S300 series can still run past 2038.

About your question, actual HEOL module is made from a Furuno GT-88, with specific firmware as this module does not officially support M12 protocol as per datasheet - but support it though, since this module works flawlessly. And I have a datasheed with M12 protocol for the GT-88. About jitter, why don't ask Olivier Descoubes from HEOL? He is reachable via support contact, if it helps, and should answer you.

That being said, I never checked the PPS output, since I never needed it - only the 10 MHz out for reference purposes, and NTP server for the 300. But 100ns seems huge and very strange.

[Astralix]

LEA-M8T and M8F are for timing purposes.
The F also includes a direct external (VC)OCXO PLL control without any DAC needed. You can just tack the OCXO to the M8F and you're good to go if you only need a precision reference clock.

For the HEOL modules, if they are using GT-88 modules, the jitter is specified with 4.5ns. High probability that Heol specifies something else, likely the timing messages, not the 1PPS pulse? I'll ask them and then we see.

[Astralix]

Question...

Does anyone know exactly the model number and firmware release the Symmetricom Rubidium reference shall be?
There are a few out there in the bay.

And I read about a guy who can update the firmware in these modules if required, but I cannot find a contact or the firmware itself for trying to do that myself...

For now it is just theoretical, as the Heol Design GPS upgrade was stolen from my front door, so I have to wait till the second one comes in. And after it has been plugged, I want to experiment with some OCXOs. But I may get in contact with someone who is able to build and re-fill rubidium modules what opens up almost endless options

[tusentack]

Hi I have a Symmetricom S200 with Rubidium Oscillator that I have sucsessfully upgrade with a new GPS-module.

My problem is that I can not get the (hardware clock status) to Lock. It stands as Unlocked all the Time under the timing. The GPS input is locked and the gps is the current sync source. The GPS time i valid and the Antenna status is good. I sync to 9 satellites. I have tried to do a factory reset and I also tried to reinstall the image to the card but it does not solve the problem the hardware clock do not lock. Does any one have any help or advice to what I should do to get the Hardwareclock to Lock.

I have attached pictures from the unit.

Thanks

[dj831]

Hi, I just powered my S300 with antenna not viewing satellites, and though S300 is acquiring satellite (no satellites in view), hardware clock is locked. So:

• Can you check logs and see if you see something?
• Did you upgrade device by yourself, i.e. replaced the oscillator by an Rb one?
  
• Can you SSH the device, and retrieve hardware settings (same program used to tell device that hardware has changed)?

Worst case: Rb oscillator dead. For the X72/X99, I don't know, bur for the SA.22c, there is a 'Service' pin that tells the oscillator is EOL. Since most, if not all, Rb oscillator has an 'health' pin, I guess that if it exists, the S200 detects that Rb is dying. Another idea: Rb oscillator is bad, and DAC is out of range to adjust EFC pin of X72/X99 and reports the issue.

Note that these are ideas only, and I may be totally wrong. But are a good start for investigations 

[tusentack]

Hi thanks for the help.

Here are the answers.

Can you check logs and see if you see something?

I am attaching the messeges logs. Maybe you can see whats wrong?

Did you upgrade device by yourself, i.e. replaced the oscillator by an Rb one?

The Oscillator was there when I bought the unit. The only upgrade I did was the GPS-card.


Can you SSH the device, and retrieve hardware settings (same program used to tell device that hardware has changed)?

I can SSH into the unit but I do not know the commands to see the hardware settings.


Thanks

[dj831]

Hi,

Jun 13 04:35:03 SyncServer alarm: Thu Jun 13 02:35:03 2024  Alarm 1715693008: Type: Timing Source Lower Accuracy Input Alarm, Class: Timing, Level: Notify, Action: Clear Alarm, Flags: 0x4
Jun 13 09:23:37 SyncServer alarm: Thu Jun 13 07:23:37 2024  Alarm 1715693009: Type: Timing Oscillator DAC Range Alarm, Class: Timing, Level: Notify, Action: Raise Alarm, Flags: 0x4

=> Does that mean you had no alarm for circa 5 hours (i.e. that the SyncServer worked flawlessly)?

Jun 13 09:23:38 SyncServer alarm: Thu Jun 13 07:23:38 2024  Alarm 1715693010: Type: Timing Oscillator DAC Range Alarm, Class: Timing, Level: Notify, Action: Raise Alarm, Flags: 0x4

=> Can you monitor DAC output of S200 (or EFC / C-field input of X72 - reply #118 of that topic)? You may have either a timing issue from GPS (but I never had any problem with the two HEOL cards I own, they are reliable), either your X72 started drifting significantly.
=> DO check service the pin too (reply #118 of that topic too).

If it helps, you have all details about seeprom utility given by Sandra from post #62 onwards, but you may not need it since you didn't change any hardware (apart GPS card that is plug & play)

Note: I may not be able to answer you prior July,1st 

[Astralix]

Finally, the Heol Design module has arrived and works fine for now. There is an issue with my antenna but the new one was not available when I tried ordering it.

I tried the Acquisition Mode that the switched to Position Hold the next day. That looks nice, but it shows 0 satellites and also does not show any satellite in the GPS overview.
So, to get an overview myself, I switched to Dynamic Mode and I'll report on that.

I also added an Abacron 10MHz reference OCXO (AOCJY3A-10.000MHZ-E). It is a 5V type with CMOS output. Fron what I read from Jonny, I set a 68R resistor at R121. Next I set JP3. Finally I changed the shadow file to gain root access and used seeprom to configure the oscillator type. After a reboot, the system still shows TCXO in all the places, and for a while it also had the DS3 lit, the LED besides the TCXO. Now that DS3 is off, but the DS2 near the OCXO is not lit. I checked the OCXO output and it has a nice stable square wave 10MHz signal.

Probably I need to wait until the system has got some sats to lock onto and trim the OCXO, I guess?

Does anyone use a battery for the Heol Module to get faster AOS?

[Edit]
This morning I have GPS reporting 8 satellites but the timing source is still unlocked.
The oscillator is still shown as TCXO and there are still precision alarms in the log.

Jun 17 07:25:40 SyncServer httpd: Mon Jun 17 05:25:40 2024  Alarm 1718563484: Type: System Config Change Alarm, Class: System, Level: Notify, Action: Raise Alarm, Flags: 0x4
Jun 17 07:25:50 SyncServer alarm: Mon Jun 17 05:25:50 2024  Alarm 1718563485: Type: Timing Quality 1e-5 Alarm, Class: Timing, Level: Notify, Action: Clear Alarm, Flags: 0x14
Jun 17 07:26:09 SyncServer alarm: Mon Jun 17 05:26:09 2024  Alarm 1718563486: Type: Timing Quality 1e-5 Alarm, Class: Timing, Level: Notify, Action: Raise Alarm, Flags: 0x14
Jun 17 07:28:46 SyncServer alarm: Mon Jun 17 05:28:46 2024  Alarm 1718563487: Type: Timing Quality 1e-5 Alarm, Class: Timing, Level: Notify, Action: Clear Alarm, Flags: 0x14
Jun 17 07:28:49 SyncServer alarm: Mon Jun 17 05:28:49 2024  Alarm 1718563488: Type: Timing Quality 1e-6 Alarm, Class: Timing, Level: Notify, Action: Clear Alarm, Flags: 0x14
Jun 17 07:28:52 SyncServer alarm: Mon Jun 17 05:28:52 2024  Alarm 1718563489: Type: Timing Quality 1e-6 Alarm, Class: Timing, Level: Notify, Action: Raise Alarm, Flags: 0x14
Jun 17 07:28:55 SyncServer alarm: Mon Jun 17 05:28:55 2024  Alarm 1718563490: Type: Timing Quality 1e-5 Alarm, Class: Timing, Level: Notify, Action: Raise Alarm, Flags: 0x14
Jun 17 07:29:45 SyncServer alarm: Mon Jun 17 05:29:45 2024  Alarm 1718563491: Type: Timing Quality 1e-4 Alarm, Class: Timing, Level: Notify, Action: Raise Alarm, Flags: 0x14
Jun 17 07:30:28 SyncServer alarm: Mon Jun 17 05:30:28 2024  Alarm 1718563492: Type: Timing Quality 1e-4 Alarm, Class: Timing, Level: Notify, Action: Clear Alarm, Flags: 0x14
Jun 17 07:31:26 SyncServer alarm: Mon Jun 17 05:31:26 2024  Alarm 1718563493: Type: Timing Quality 1e-5 Alarm, Class: Timing, Level: Notify, Action: Clear Alarm, Flags: 0x14
Jun 17 07:31:36 SyncServer alarm: Mon Jun 17 05:31:36 2024  Alarm 1718563494: Type: Timing Quality 1e-5 Alarm, Class: Timing, Level: Notify, Action: Raise Alarm, Flags: 0x14

I switched the GPS to Position Hold mode now to test if that helps, but for now the timing source is still NTP instead of GPS.

[Johnny B Good]

Finally, the Heol Design module has arrived and works fine for now. There is an issue with my antenna but the new one was not available when I tried ordering it.

I tried the Acquisition Mode that the switched to Position Hold the next day. That looks nice, but it shows 0 satellites and also does not show any satellite in the GPS overview.
So, to get an overview myself, I switched to Dynamic Mode and I'll report on that.

I also added an Abacron 10MHz reference OCXO (AOCJY3A-10.000MHZ-E). It is a 5V type with CMOS output. Fron what I read from Jonny, I set a 68R resistor at R121. Next I set JP3. Finally I changed the shadow file to gain root access and used seeprom to configure the oscillator type. After a reboot, the system still shows TCXO in all the places, and for a while it also had the DS3 lit, the LED besides the TCXO. Now that DS3 is off, but the DS2 near the OCXO is not lit. I checked the OCXO output and it has a nice stable square wave 10MHz signal.

 Just to address the issue of connecting a cmos output ocxo directly to a logic gate input, there's no need to connect a load resistor like there is with most sine output types. They're designed to connect directly to a logic gate input (just keep the connecting trace/wire short - just a centimeter or three). 

[Astralix]

A little update...

I had moved things around a bit and, bridged the R121 resistor and checked the OCXO to be seated correctly (I socketed it, as it was quite expensive).
I checked around in the menus and with GPS in "Hold Position Mode" it still showed "unlock". Then I tried "Dynamic Mode" again, but till now there is no lock, GT88 is still trying to find satellites.

It also continues to insist on having a TCXO.
It also refuses to lock onto an external 10MHz reference frequency...

Checking the Alarm page I got some errors, a script spread lines across the screen about "S350" is not supported. So I made a factory reset and hacked my way back to seeprom as described above. seeprom was showing option 9 as "S350" so I changed that to "S250" and rewrote the CRC with option 4.

Progress!
Again a reboot and now the Alarm page is back working and the system shows "OCXO".
It also locks to my generator applying 10MHz sine at 0dBm (it starts locking at -7.6dBm what is ~93mV into 50 Ohm)

So now I wait until it has locked to some satellites.

[Edit] Progress Nr. 2!
I got some doubts about my Symmetricom antenna and decided to flip it with the Chinese non name one, I got many years ago, when starting experimentiing with GPS.
What should I say... The Symmetricom is dead! With the Chinese no name I got a list of satellites in minutes and the timing source for GPS states "locked".

Now I need to wait till after work, so I can verify the 10MHz to be roack stable.

[testpoint1]

Hi I have a Symmetricom S200 with Rubidium Oscillator that I have sucsessfully upgrade with a new GPS-module.

My problem is that I can not get the (hardware clock status) to Lock. It stands as Unlocked all the Time under the timing. The GPS input is locked and the gps is the current sync source. The GPS time i valid and the Antenna status is good. I sync to 9 satellites. I have tried to do a factory reset and I also tried to reinstall the image to the card but it does not solve the problem the hardware clock do not lock. Does any one have any help or advice to what I should do to get the Hardwareclock to Lock.

I have attached pictures from the unit.

Thanks

the X72 is not locked, please check the locked indication pin (white wire), if the level is low after power on more than 5 minutes, that means Rb locked.

[Astralix]

Probably final update on OXCO upgrade:

If you want to upgrade hold-over precision or want to use the S2xx as a 10MHz reference for your RF lab, but you miss the OCXO in your unit...
You can use an Abacron LLC type AOCJY3A-10.000MHZ-E solder in the 0 Ohms bridge, set the feature in the EEPROM and it works.

I got the OCXO lock with the Franch made Heol Design GPS module if it is set to "Dynamic Mode". I had too many things waiting on the bench to be aligned for frequency, so I could not again test "Position Hold Mode". Initially I tried that, but never got it locked. But later I discovered a defect in my GPS antenna.

In my special configuration I also need a GPS splitter that is powered by the antenna supply. So, there are two DC BIAS-T modules back-to-back, connected by a 5V LDO. Working perfectly and enough power left for an optional in-line amplifier / filter. But I have constantly 5...8 satellites with -113dBm or better with the cheap Chinese antenna. The new Antenna arrived, but has a different mounting diameter...

[testpoint1]

Probably final update on OXCO upgrade:

If you want to upgrade hold-over precision or want to use the S2xx as a 10MHz reference for your RF lab, but you miss the OCXO in your unit...
You can use an Abacron LLC type AOCJY3A-10.000MHZ-E solder in the 0 Ohms bridge, set the feature in the EEPROM and it works.

I got the OCXO lock with the Franch made Heol Design GPS module if it is set to "Dynamic Mode". I had too many things waiting on the bench to be aligned for frequency, so I could not again test "Position Hold Mode". Initially I tried that, but never got it locked. But later I discovered a defect in my GPS antenna.

In my special configuration I also need a GPS splitter that is powered by the antenna supply. So, there are two DC BIAS-T modules back-to-back, connected by a 5V LDO. Working perfectly and enough power left for an optional in-line amplifier / filter. But I have constantly 5...8 satellites with -113dBm or better with the cheap Chinese antenna. The new Antenna arrived, but has a different mounting diameter...

for the GPS splitter, the best one is Mini-circuits ZB3PD-0dB-1+, no need power supply, the unit will use the power from the active antenna port; and, you can select a good antenna for the Symmetricom, I tested several antenna (and more than 30 pcs in stock), but I am in US, can not ship to you.

[Astralix]

Hi!

Thank you for the (impossible) offer, but you are right, shipping from the US is horror. I do have a nice working splitter from SV1AFN:
https://www.sv1afn.com/en/gnss-gps/-7.html
And I also use his TCXO driven GPSDO-2.

I need a new fixture for the Sparcfun GPS antenna but need to figure out the right thread metrics and pole size. Will order that next week.

I can't find any ZB3PD-0dB-1+ over here, but as I said, the SV1AFN splitter is an active one and works fine. With my BIAS-T -> 12V to 5V LDR -> BIAS-T construct everything works totally smooth!

[testpoint1]

Hi!

Thank you for the (impossible) offer, but you are right, shipping from the US is horror. I do have a nice working splitter from SV1AFN:
https://www.sv1afn.com/en/gnss-gps/-7.html
And I also use his TCXO driven GPSDO-2.

I need a new fixture for the Sparcfun GPS antenna but need to figure out the right thread metrics and pole size. Will order that next week.

I can't find any ZB3PD-0dB-1+ over here, but as I said, the SV1AFN splitter is an active one and works fine. With my BIAS-T -> 12V to 5V LDR -> BIAS-T construct everything works totally smooth!

the ZB3PD-0dB-1+ only 25 USD in Ebay, I checked its internal circuit, it will use the active GPS port's power (that one using maximum vlotage), and pass it to antenna.

[tverbeure]

I wrote blog post that describes the steps to configure a SyncServer S200 as an NTP server, how to install the BNC connectors, how to make a backup of the flash drive etc.

https://tomverbeure.github.io/2024/07/14/Symmetricom-S200-NTP-Server-Setup.html

Most of the contents won't be new to the readers of this forum thread since I learned a lot by reading things here, but for those who are getting started it puts everything together in an organized way.

I also have a blog post in the works that describes how I got the original Furuno 8031 GPS module to work for much cheaper than buying a replacement GPS module, by using a custom interposer PCB that configures the GPS module correctly at power-on time.

[Neoname]

For reference, the Symmetricom S200 & S300 are looking for a Motorola M12+ / iLotus M12M GNSS receiver that outputs "Motorola 9600 baud". This very old protocol is unsupported by most modern GNSS chips, so an intermediary chip usually is used to emulate. In Synergy Systems offerings, this is a PIC24FJ128, for Jackson Labs they use a "32-bit ARM Cortex".

The "drop-in" main options for GNSS receivers without the WNRO problem (that I know of) are:

1) Heol HD-8737, using a Furuno GT-88-C3B

2) Synergy Systems SSR-6Tf+, using u-blox LEA-6T-1 https://synergy-gps.com/synergy-products/ssr-6t-gps-receiver/

3) Synergy Systems SSR-M8, using u-blox LEA-M8T-0 https://synergy-gps.com/synergy-products/ssr-m8-multi-gnss-precision-timing-receiver/

4) Jackson Labs Technologies "M12M replacement" receiver, using a u-blox M8T (I have not tested this) https://www.jackson-labs.com/index.php/products/m12m_receiver

Having tried both the SSR-6Tf+ and the HD-8737, the SSR-6Tf+ seems to lock from cold in half the time!! to the HD-8737 and have slightly better signal reception as well. This is relevant to me as my antenna is in an awful position with marginal signal, but cannot be relocated. As an experiment, I deliberately put the antenna in an even worse site and gave each GNSS receiver 15 mins twice to see how both performed with terrible signal. The HD-8737 hovered between 2-3 satellites seen, and on occasions dropped out completely. The SSR-6Tf+ consistently saw 5-6. I make no comment as to the relative stability or accuracy of the receivers, but in the case of poor signal reception the SSR-6Tf+ is the clear winner. I will try the SSR-M8 soon.

Synergy Systems told me that they were aware of the new u-blox NEO-F10T and the even higher accuracy LEA-F9T, and were evaluating them but no products were available yet.

I also saw some comments from someone in this thread about being unable to access the web interface. Note that the web interface is only available on LAN1, which on the S300 is the SECOND port. The FIRST physical port with GbE is actually considered LAN4 with the LAN4 MAC address as printed on the case sticker.

[Neoname]

I was doing some hacking and have now enabled root logon via SSH
if there is a easier way feel free to tell me I wasting my time.  And yes I know you can get a console port @ 9600 baud but ssh is nicer


otherwise

perform a backup and do a save-as to get a backup downloaded
open the backup in a zip until such as 7-zip
inside you will see config-1.2.tar.gz
open this in 7zip
then open config-1.2.tar in 7zip
you now have 2 directories
/etc
/var
go into /etc
open and edit shadow (the password file)
the root account looks like this
root:*:14012::::::
the * mean root can not logon
change to
root:$1$uV2.fU1.$UFcRU1rZDB5NJElVrwIR11:14012::::::
that will give root same password as admin (ie symmetricom)
save
if prompted to update the backup file do so
now go to /etc/ssh
edit sshd_config
find
PermitRootLogin no
change to
PermitRootLogin yes
save file
if prompted to update the backup file do so
close the archive
if prompted to update the backup file do so
go to the wizard and restore using the backup file you just updated

(Attachment Link)

Thanks for this, this was very helpful.

The Symmetricom S200 & S300 normally only support its own self-signed SSL X.509 certificates normally. Even the S600 only allows you to upload your own SSL certificates if you pay more for the optional "Security Protocol License".

Using your backup method & 7-zip, you can replace the following files with your own X.509 and private key, and the S300 at least has no problem with it.
config-2.0.tar.gz\config-2.0.tar\etc\apache\ssl.crt\server.crt
config-2.0.tar.gz\config-2.0.tar\etc\apache\ssl.key\server.key

However, the apache/openssl installed is too old (on a S300 running 2.83.2) to support anything higher than TLS1.0. Support for TLS1.0 is deprecated from most modern browsers as too archaic.

Adding to config-2.0.tar.gz\config-2.0.tar\etc\apache\httpd.conf  "SSLProtocol all +TLSv1.1" or "+TLSv1.2" causes the webserver to fail to load.

Does anyone have any idea how to update the apache/openssl webserver? I have very little Linux experience.

[tverbeure]

I just pushed a blog post that discusses a WNRO fix by using an interposer: https://tomverbeure.github.io/2024/08/18/Fixing-the-Symmetricom-S200-GPS-Week-Number-Rollover-Problem.html.

With this, I can keep on using the original Furuno GT-8031 at a cost that is less than $30.

[dj831]

Hi, excellent job  Just a question: wouldn't it be much simpler to reprogram the DSP in the board (for someone who knows DSP assembly or C)? Furthermore, ISCP pins are already in place, IIRC.

[Astralix]

Hi!

Unfortunately I need my single unit for my lab to work without interruption. And all the units that were available cheap over here in Germany were sold out.
But if I come across a second unit, I will definitely try to upgrade the Linux on the system. Everything needed for that should be on the box.

It also relies on a bigger FPGA and that bit stream is probably not easy to upgrade, but it also may not be necessary if the drivers and applications around it are well enough understood.
It is very likely that the PLL and VCOCXO control is done in that FPGA and as these work fine, there is no need to change. Also it will probably handle the fail-over from GPS to VCOCXO / RB and also combine all the external sources as well as providing all outputs for the external connections without any real software control needed.

If the programmer of the functional applications around web services, NTP and such didn't modify basic structures like kernel drivers and so on, it may also be possible to upgrade the whole Linux and just keep the old applications just going.
What I mean is, that if they used /dev/ttySx for accessing the UART to the GPS module and did not write a code that accesses the CPU internal register to communicate with the GPS, the only thing a new Linux needs to do, is providing the same /dev/ttySx to the same physical serial port and the software still works.

And I bet there are specialists available here in the forum, that will provide some nice modern web interface

But I checked, there are currently no S200 or S250 available that are affordable for such an experiment and the need the one I have running 24/7

[tverbeure]

Hi, excellent job  Just a question: wouldn't it be much simpler to reprogram the DSP in the board (for someone who knows DSP assembly or C)? Furthermore, ISCP pins are already in place, IIRC.

It would be more elegant, but for somebody who has never seen an MSP430 in his live, it definitely wouldn't be simpler.

[dj831]

Thanks for all these explanations  You're right about cheap S200/250/300/350, not easy to find some these days. I was luck enough to find in April 2023 an S250 with an Rb oscillator ($405 w/o brokerage and shipping), an S250 last year in France for 200€ (no options), and few months ago, an S300 ($75) missing its power supply, but I installed a 1800 Cisco power that works flawlessly. All three almost work: I miss an EHOL card for one, and I still have to replace the VFDs.

Anyway, since design or Linux hack are time-consuming, the easiest way is to use a 1:1 card replacement (EHOL card works pretty fine here in France), and spare time for other projects 

[Astralix]

The Linux hack isn't probably that difficult. To boot up a modern Linux may take a rainy Saturday evening.
The problem is, that my unit has to work.

I agree that the HEOL card does work flawlessly and they a re doing a great support, even outside of France. The money to safe compared to the time that needs to be spent for an adapter board, doesn't sum up for me. So I would buy the HEOL card again.

May be, if I have some work out of the lab, I can create a secondary boot card for testing. The cards I use to revive R&S FSxx and ZVxx do not work out of the box with a copied image.

[Neoname]

Astralix - Does it actually need a modern linux version, or could apache & openssl be updated in place?

[Astralix]

That is a question I cannot answer for you...

My unit is sitting inside a network that is hidden behind a firewall and does not allow any access from the outer world. So theoretically, there is no matter in wasting any time to secure the unit.
On the other hand, network breaches are often reversed so hacking a PC, telnetting into an insecure device and installing some tools to breach more and more of the network.

Exchanging some certificates only gets rid of these annoying pop-ups in your browser accessing the device, but does not in any way improve network security.

I have not checked if any of the known security vulnerabilities apply to kernel, bootloader or any service running on the unit. But in remember that the used ntpd service is outdated, the web service is outdated, the ssh service is outdated and the kernel is old too.

Does it need to be changed in a secure environment? May be not. Does it make lots of fun to hack yourself into a system to a degree where you can even build your own uboot and kernel? Definitely yessss!!

[electromaticboy]

Hi all,
New member, first time posting after many many years following the EEVBlog on Youtube.
Got a dead Symmetricom S200 from work, replaced a couple of bulged caps in the power supply and seems to work fine but I have no use for it. Comes with SanDisk 256MB CF card, firmware v1.01 and TXCO oscillator. I'm in the UK so if anyone wants it, please send me a DM and we'll sort something out (like you send a shipping label, a small voluntary donation to my local Hackspace and I'll send it across). If no interest, I'll put it on fleabay.
Cheers!
Tom

[carver]

the ZB3PD-0dB-1+ only 25 USD in Ebay, I checked its internal circuit, it will use the active GPS port's power (that one using maximum vlotage), and pass it to antenna.

I found a box with lot of new Mini-Circuits ZB3PD-0dB-1+ in the warehouse
(spares for Lucent/Alactel-Lucent Base Station) .
Do you have any PDF for them?
Thanks.