Symmetricom S200 Teardown/upgrade to S250

[SoundTech-LG]

I did a little teardown of the Symmetricom S200 with Rb Osc Option. This unit came to me from the usual online flea mkt, with the description of: all lights lit red.
It was the SMPS. Replace 4 caps on the secondary side.
I then discovered that the real difference between the S200, and the more expensive S250, was the lack of in/out jacks. Everything else appears the same! The FW is the same on these models. Currently version 1.30, and is on the 512 mB CF card. I have cloned image files to create more CF cards.

I know the signals for 1PPS out, and 10mHz out, are there, at the jacks (measured them). All other input signal components seem to be stuffed. Just a check box in the web app to use any of the available reference signals (including input jacks).
So I will soon have the oem AMP jacks installed, and then thoroughly test out. A pretty easy upgrade to S250 model.

The big heatsink and thermal pad over the VIA Eden ESP 400 mHz Processor Samuel 2 http://Https://en.wikipedia.org/wiki/List_of_VIA_Eden_microprocessors

[SoundTech-LG]

So it went well. Not the prettiest cutting of the panel, but it was pretty tough plastic.
You can see the status of the inputs for 10mHz In, and 1PPS In. I just did a loopback from the outputs, so thorough test of out to in.
I also tried the IRIG out/in works flawlessly. Not sure how much more they charged for the S250, but I'm thinking at least $1K.
Nice upgrade.

[jpduffy1]

I picked up a S250i and it has Firmware 1.01 on it.   I tried to dd the CF card from a 256mb one to 512mb card, but now I cant seem to get the system to bootup.   When you cloned the card how did you do it?   Looks like a goofy set of partitions.   

When I compare the two cards they look identical with the exception of the total size of the card.

I have the software update files for 1.11, 1.26 and 1.36.   The update instructions for 1.26 said to load 1.11 on the 256mb card first then transfer it to the larger card boot that then do the 1.26 etc.

Any ideas?

Thanks

- Joe

[SoundTech-LG]

Ok, so you need to use the program HDD Raw Copy Tool. Copy a good booting CF card.

http://www.hddguru.com/software/HDD-Raw-Copy-Tool/

Then you can save the image as a file to your local HD. Then you can make as many spare copies as you like. It will only save it in the original CF card size format.

If you try to copy the image to a larger CF card it will work, but you are still left with the original (smaller) size. The remaining space is inaccessible.

BTW, Do NOT  take Windows suggestion to FORMAT the card!!!  It has a proprietary format on it!

As a favor can you post to DropBox,  the 1.36 version file???   Thanks!

If you need a good, booting CF card, I have the image file on DropBox.

I'd like to see those Symmetricom upgrade instructions too. How did you manage to get the FW? It seems under lock and key at Symmetricom/Microsemi.



 

[SoundTech-LG]

I have uploaded the 512mB bootable V 1.30 CF card image file to DropBox.
You can place on HD and then use HDD Raw Copy to create your bootable CF card.

When I hear from you we can do a file swap.

[SoundTech-LG]

I have determined U40, a DIP 8 93C46 EEPROM, holds all the Configuration for Model #,  S/N, & Oscillator type. Pretty easily re programmed for multiple possible configurations.

[timeguy]

Wow am I glad to have come across this post! I know it is old so I may post separately if it does not revive.

I am new here but also have a Symmetricom S200. I would LOVE to make this modification. Can you let me know what AMP jacks you used for the project? Am I correct in assuming that you simply cut out the panel holes and soldered the jacks to the PCB?

Cheers!

[SoundTech-LG]

The photos here show pretty clearly how it is done. The plastic overlay on the back panel needs to be drilled out (hint: start with tiny bits, and progress to the finished size.) You'll want to re-program U40 too, the eeprom that holds configuration of (old/new)Model, S/N, oscillator type, etc. Easy if you have a programmmer. Once you do that you can swap to another oscillator type, change model #'s, and best of all, gain full functionality of the S250 model, inputs/outputs. 1PPS, 10MHz, IRIG. Have fun. I got the BNC's from Digikey. Last time I looked they were out of stock on those. sorry, I don't recall the p/n, but they have good photos there.

[SoundTech-LG]

Just found it. They only have 1 in stock

https://www.digikey.com/product-detail/en/amphenol-rf-division/031-6577/ARF2115-ND/4037243

[EOC_Jason]

Mouser is showing 369 in stock...

[testpoint1]

please be aware if the X72 firmware version is ealier than 5.x you can not use the 1PPS in signal, the latest seems is 5.08

[Theboel]

Hi SoundTech-LG

Do you have any measurement ?
its look like it use Motorola GPS receiver can You confirm it ?

[testpoint1]

Hi SoundTech-LG

Do you have any measurement ?
its look like it use Motorola GPS receiver can You confirm it ?

looks like the M12 GPS, I ever use it

[SoundTech-LG]

Yes, Motorola M12 / M12+ ... I have also one unit that has a Furuno GPS installed (an early unit though).

The X12s that I have all work with the S200s, and S250s. Not sure if that is a default, or I just have later FW.

[timeguy]

Thank you so much! I do not think I could have found the BNC part number on my own.

I have ordered 3 x ARF031-6577 from Mouser. I can hardly wait for them to arrive next week!

The pictures above are very clear indeed. I was primarily curious if any action was required after soldering the BNC's to the board. I am now understating that I will need to re-program the U40 EEPROM. I have never done something like this before, and do not currently have a programmer, but am willing to buy one and learn.

I did some research and it appears that U40 chip in the S200 is a: M93C46 1Kb Serial Microwire EEPROM.

Would something like this suffice to program it? Or would I require a different kind of programmer?:

https://www.amazon.com/Gikfun-Programmer-CH341A-Burner-EEPROM/dp/B01I1EU9LG?ref_=fsclp_pl_dp_7

Cheers!

[SoundTech-LG]

Not sure on that programmer. Price is certainly right! Most of the commercial programmers are 100's of dollars.
If you just need a 93C46 programmed for your unit, I can do that. PM me.

[remois]

  Hi:

  Does anyone have an update file for versions 1.26 and 1.36 of Symmetricom S200 that you can share?  I bought the S200 sometime ago, but the device has reached end of life and the company has been sold to Microsemi, I could not find where to get the update files.

  Thank you very much in advance,

[timeguy]

I would really appreciate this too. My firmware version is currently 1.26. I would prefer to upgrade to 1.36. I am happy to share 1.26 if it would be helpful?

[SoundTech-LG]

First, you specifically need an Industrial grade CF card (such as the one Symmetricom used in the S200/S250) but one rated at 512MB (but it actually holds a bit more).

Then you need to DL the Utility for cloning CF cards in their entirety here:
https://hddguru.com/software/HDD-Raw-Copy-Tool/    Hint: don't use windows FORMAT on it ever!!!

Once you complete those two steps. Make the full CF card from this Version 1.36  image file here:
https://www.dropbox.com/s/ukg2ehyql6e8bhc/S250%20v1.36%20512mB%20at%20Factory%20Default.imgc?dl=0

Place the CF card in your S200/S250 socket. Turn on and go.

Do not use windows FORMAT ever!!!

[SoundTech-LG]

The reason you need an Industrial Grade 512 MB CF card is that the garden variety CF cards are too small. The clone program will fill them, but run out of room. There is just a bit more data that needs to fit. Industrial grade CF cards seem to have the extra space.

[SoundTech-LG]

you'll want one of these if you don't already...

https://www.amazon.com/Compact-Multi-Reader-Electronic-Computer/dp/B015VEXL8W/ref=sr_1_5?keywords=transcend+cf+card+reader&qid=1554920117&s=gateway&sr=8-5

[8bit]

The Symmetricom/Microsemi SyncServer S200/S250/S300/S350 are the same base system board just with extra/faster/better parts added to it.

I am working on adding an OCXO to my basic S250. It seems there are four steps:
 1) add the OCXO to the board
 2) add the JP3 jumper
 3) install R121 (what value?) to connect the 10Mhz signal
 4) reprogram U40 to change the oscillator type

I have seen MC597X4-040W as a part number for the factory OCXO. It's made by MCCOY/CORNING/VECTRON/OFC (On ebay today for $20).
I have been told that JP3 is need for the system to use optional oscillator (the additional OCXO or Rubidium X72).
I know that R121 connects the OCXO output to the system. The Rubidium connector is already connected and you can just plug in the X72.
Does anyone have a factory OCXO S200/S250/S300/S350 ? I need to know the value of R121 next to the OCXO. Is it Zero Ohms or some small 102 or 104 value?
Does the oscillator type truly have to be reprogrammed to use it? Has anyone tried the /sbin/seeprom program on the system?

The steps for adding a Rubidium X72 are basically the same (no R121 install) but cost more, required custom cables, and the system is picky about the X72 firmware.
Unlike the old TS2100 LPRO-101, the X72 does not require a new dedicated power supply. The X72 can use the 12V from the existing power supply.

The S300/S350 seems to use the newer SA.22c Rubidium module.

Also, FYI, the CompactFlash card seems to be a "Fixed Disk PIO" type CF card and not a normal "Removable DMA" type CF card that everything else uses.
Some CF cards may allow the system to boot and run but then the system generates errors. It's best to use the correct flash card.
You can use a non-industrial CF card but it may fail early. Industrial cards are long life SLC chips with extended temperature ranges and special controllers.
You can connect a normal serial terminal to the console port on the front (9600 8N1) and watch linux start to see if there are problems.

The system has a small 32-bit Linux install on it with the following partition table:
 1: primary: 18 MB (boot kernel)
 2: primary: 8 MB (data)
 4: Extended:
 5: 182 MB (system A)
 6: 182 MB (system B)
 7: 99 MB (temp space for upgrade files)

NONE of the "standard" 512MB CF cards are the same size. The factory Delkin has 1024128 blocks which is rather large for a 512MB card (500MB).
The factory format does not use the full card (about 1M blocks) so you can use a slightly smaller card or a larger card (1GB) and just not fill it.
There does not seem to be a supported way to initialize a blank CF card in the system so you have to start with an image that will boot correctly.
You may be able to boot a USB drive but there is no available code to do that. Just write a working image to a CF card from a PC and USB adapter.

You can make a disk image of the CF card and boot it in VirtualBox.... It needs 4 serial ports, 3 network interfaces, and 2 parallel ports.
You need to attach a virtual serial port to TCP port so you can access the console (just use putty). There's not much you can do with it because of all special hardware the SyncServers have, but it boots.

If you want a quick free backdoor to look around the linux system, just telnet to the S250, login as normal admin to access the restricted shell and run the command:
   root eng sys cat "/dev/null && bash"
With bash running it will timeout after a few minutes and you'll need to connect again.

I have heard that the S200/S250 used two different ETX boards. A 400Mhz VIA C3 with 128MB or a 500Mhz Intel Atom with 256MB.
I'm using the factory 1.36 release with the VIA board. The system does not even use 64MB of memory so upgrading it does nothing (I did it anyway).
If you want to replace the memory, it's a standard PC133 SODIMM (just rip one out of a Cisco 1841).

The S300/S350 uses an Intel 1.6Ghz board with more memory so it's a lot faster (and supports the 1Gig ethernet port and dual flash and more stuff).
The code is different than the S200/S250. The system and kernel are newer for the S300/S350 but the NTP version is 4.2.4p8 for both.

[SoundTech-LG]

It sounds as if you have spent considerable time with these. One thing I noticed was your mention of using a larger CF card, such as a 1GB you mentioned. I could never get that to work. It would take the full 512k+ image ok, but would not boot the system at all, like a 512k Industrial would.

[8bit]

I added the OCXO to my S250 this weekend. It was quick and easy.

JP3 disables the default 10Mhz TCXO. That clock is only used for timing (not CPU or network).
If you disable the TCXO and boot the system it will be unhappy and say it has an unknown timing clock, as expected.

I soldered in the new OCXO. Added a jumper at R121 to connect the output to the system and restarted. It was happy again meaning it now had a 10Mhz clock source.
The web page and other utilities still say it has a TCXO. I connected to the box with telnet, logged in, and used the shell hack to gain non-privileged access to Linux.
Then I was able to run the /sbin/seeprom program and change the oscillator from 0 (default TCXO) to 1 (OCXO) and reprogram the checksum at the same time.
No need to remove and manually reprogram U40. If you add the RB clock the value is 2.

I rebooted again and the S250 is happy with its new oscillator. The web page correctly shows the system is configured with an OCXO.

[SoundTech-LG]

U40 is so easy to program...  can't see why all that additional effort is worth it.

[notfaded1]

This is great stuff!  I just got a 1520-200-rb.  It boots up and I can get it DHCP address but I can't reach the webpage or telnet or ssh to it.  I'm not sure what's going on but I'm going to get a new 512M card and reader for PC and make a new OS for it and try that.  I can't get it lock onto any GPS satellites at all even though it says antenna is ok.  Mine has the factory x72 in it.  It's currently got 1.11 version on it.  I'm going put newer fresh OS saved on a new 512 CF card to hopefully get it going correctly and allow me to get to webpage and set it up right.  The fact that I can see ntp packets on the status page and it picks up a DHCP address makes me think it is on the network but no webpage and no ping of the ip or ability to ssh or telnet to it.  I have ordered a USB to db9 serial cable because that was my next place to try when I found my old friends here at EEVBlog.  Idk why I didn't look here first!  Fingers crossed but you guys give me hope and since I have an original 1520-200-rb I gotta get this baby working.  Mine has the gt-8031f in it and x72 rubidium occillator.

Thanks,

Bill

[notfaded1]

Looks like mine is just like yours... 1520-200-rb!  I want the new Jack's too!  Gotta have the all the 250 outputs!
Just ordered the industrial 512mb CF card and 4 of the dual RF Connectors / Coaxial Connectors BNC RA DBL ISOL 50 Ohm Backplate Valox from mouser:
https://www.mouser.com/ProductDetail/523-31-6577

I couldn't do this without my friends here at EEVBlog!  Mega props!
Bill

[notfaded1]

Here the inside of mine... My pics are so big and high res from my pixel phone only one attachment will fit.  Pixel takes great photos though.  Blow up the picture you can read everything.  I ordered one of those dji osmo 2 gimbals because I'm convinced now the pixel phone cameras are the best for pics and video... Even better than many video cameras and even full body cameras.

Bill

[notfaded1]

please be aware if the X72 firmware version is ealier than 5.x you can not use the 1PPS in signal, the latest seems is 5.08

Can you update x72 firmware?

[SoundTech-LG]

Your greatest effort will be finding FW, and how to perform the upgrade. Microsemi / Microchip will be of NO help. You might ask Mark (TexasPyro) he knows quite a bit about these...

[notfaded1]

I'm not sure how important the 1PPS IN is actually... what's the main purpose of that if you already have GPS sync and the RB running?  For the 1 PPS IN to be of value it has to have better pull-range than the current sync'd oscillator correct?

And the typical system oscillator pull-ranges are:

TCXO 1E-6 (1 ppm)
OCXO 5E-7 (0.5 ppm)
Rubidium 1E-9 (1 ppb)

I'm not sure how you'd ever need the 1PPS in unless it was coming from a cesium clock or something?

Thanks again,

Bill

[notfaded1]

Does anyone know if there's a way to identify the newer x72 rubidium occillators that may have newer firmware?  By label or something?  I've noticed they don't all have same labels on them.  It'd be nice if there's a known newer one to buy.

Bill

[texaspyro]

Your greatest effort will be finding FW, and how to perform the upgrade. Microsemi / Microchip will be of NO help. You might ask Mark (TexasPyro) he knows quite a bit about these...

Once upon a time there was a guy offering to upgrade X72's on Ebay for around $30.   But he warned that not all units could be upgraded and if it didn't work the unit would be bricked.

[notfaded1]

I tried an industrial Delkin Devices 512MB CF card from the same manufacturer as my unit has... the Raw Copy didn't work because the image file says it's 524MB and the 512MB card has only a little over 500MB of usable space... so it cuts out around 92% as it can't write anymore?  I'm going to try a one gig industrial card for the heck of it because the only issue seems to be the size of the 512MB card.  I even tried using HDCopy to make an image of my current card and writing it back out to the new 512MB CF and it's just a little bit too big as well for the other card.  It seems the size on these cards varies greatly. 

Bill

[SoundTech-LG]

yup.  Does your new (to you) Industrial Delkin 512 have a matching part # ?
These cards are larger for sure. If you can get a 1GB card to work, I would be very surprised, and impressed. If that was the case, shouldn't any larger card work? No. Please let us know the results.

[notfaded1]

I'll let you know as soon as the 1Gig CF card comes and I try it... the image posted here says it's 524MB in HD Guru... i'm not sure how you got that to fit on a 512MB CF card which is around 500MB.  I can't believe buying the same brand 512MB Delkin industrial card didn't work for me.  I do have another 1520-S200 coming from ebay that works so it'll hopefully have a good card in it.  I really want to get this image here for 1.36 working somehow but so far I don't have any card it'll fit on which is a real bummer.  I did get a usb to 9 pin serial adapter and got into the command line.  The version 1.11 running on my machine won't allow running the cat command.  I can go into "eng" and "sys" but running "cat" to try and get bash running just says command not found.  I tried doing the "http on" command and it runs but I can't reach the webserver or ping the server's IP at all on my network.  This is very strange because I see the display saying ntp packets are incrementing on status display.  The S200 says it's acquired an IP with DHCP and it gets the mask and gateway without issue.  I think the problem is this version 1.11 maybe.  From the command line I do see it knows it's an S200 and also knows it has the rubidium oscillator.  Fingers crossed the second S200 I bought has a newer version of code on it.  I still want to find some blank cards that will work.  If someone wants to sell a working CF with 1.36 on it I'll pay.  Or if someone knows a source of industrial 512MB CF's that really work I'd like that too.  I'll check the part number on my Delkin 512MB CF tonight when I get home from work.

Oh also on another note I did get the stacked jacks in the mail from mouser.  I bought 4 pairs before I bought the second S200 server.  I suppose I could put the extra one on one of the sets of pads on the second S200 when it comes.  They weren't exactly cheap but I bought an extra one just in case I messed one up soldering them in.  Shouldn't be a problem... I've got a Metcal MX5000 soldering station.  They use only Metcal soldering stations in our factories here at work... they work for space applications soldering under a scope so I figured it would work for me too!  I highly recommend them.  You can get the older MX5000 now for a decent price on ebay if you look around now that the MX5020 and now MX5050 have come out.  I bought an extra hand piece so I can have two irons with different tips running.

Thanks again SoundTech-LG and others here,

Bill

[SoundTech-LG]

Spent many hours with the limitations inherent in using CF cards in this hardware. I found generally the Symmetricom supplied Delkin 512 MB cards (that will hold at least 524MB) are no problem. I think I did find one type Transcend Industrial that would work. How to know if it will...  you just have to try. I believe Symmetricom made sure Delkin used a certain spec of CF for these units. I guess you have to try making your 1GB CF with the 524GB image on it, but doubtful it will work.

[testpoint1]

Does anyone know if there's a way to identify the newer x72 rubidium occillators that may have newer firmware?  By label or something?  I've noticed they don't all have same labels on them.  It'd be nice if there's a known newer one to buy.

Bill

one american guy can do the upgrade, charge 25 usd, you need to ship to him, but your X72's SN maybe later than 05xxxxxxxxx.

[SoundTech-LG]

Hard to know much about him, without info on him...

[testpoint1]

Hard to know much about him, without info on him...

PM you already.

[notfaded1]

Thanks a million SoundTech-LG, testpoint1 and everyone for that matter.  Well I took delivery of the second 1520-s200 today.  The good news is it's running v1.30 and I can reach the webserver on it for the first time!  I still can't believe a copy of the this working CF v1.30 won't fit on the delkin industrial 512mb CF card I bought but it's just too small... ain't never gonna work.  I'll try the 1G card when it comes but from what you've told me... it's probably not promising.  The only reason I can guess is these little VIA MB's these are made from have a bios and firmware that doesn't support 1G CF I suppose?  It seems like a bigger CF card should work with binary image written out to it... unless the hardware doesn't support the size of the CF card.  That's the only thing I can think would be a reason.  I wouldn't even know where to begin thinking about how to upgrade the firmware on the VIA motherboards BIOS in this embedded computer inside these Symmetricom Sync Servers!  It's possible there's a way but right now I'm going to try the gig card when it comes and keep searching for a source of 512MB CF industrial cards that have enough room.  There are really almost none on ebay from the USA... most are all from China you can find.  So it's like russian roulette... pull the trigger on the auction then wait for the slow boat to show up and hopefully... maybe it'll be right!!!  What a PITA.  If I find a good source I'm going to buy a lot of them and stash them for upgrading these symmetricom sync server because they're awesome little units!  Ironically I've found some of the rubidium oscillators they use in the newer s300 and s350 sync server cheaper than the x72 rubidium oscillators used in the s200 and s250.  Go figure!  Has anyone hacked away on the S300/S350 flavor yet?

Thanks again everyone... I wouldn't have gotten as far as I have if not with help from my brothers here at eevblog.         

I'll post pics of the non working same brand Delkin Industrial CF card so others can avoid my pitfall.

Bill

[notfaded1]

Here's the back of the bad Delkin 512mb CF card that's too small dag nabbit!

[notfaded1]

And the front...

Bill

[notfaded1]

On a better note... these came in the mail from Mouser the other day!   

[notfaded1]

Oh!  BTW... other great info... the v1.30 does allow running other unix command my v1.11 DID NOT!  I can run cat, rm, and cp now!  The newer version has many additional commands in the sys level of commands.  You can enter "eng" for engineering:

9 ? eng
10 ? ?
--------------------------------
Commands
--------------------------------
ACT
ALA
CLK
ETH
FTP
GPS
IP4
IP6
IPA
LFR
MODEM
NTP
OSC
REF
SNMP
SYS
TCO
intrinsic help
--------------------------------
11 ?

or "sys" for system:

11 ? sys
12 ? ?
--------------------------------
Commands
--------------------------------
CAT
CP
DAEMON
DISPLAYINIT
HALT
HTTP
HWREV
MODELNUMBER
OPTEXT
OPTIONS
REBOOT
RESTOREDFLT
RM
SAVECURRENT
SERIALNUMBER
SWVERSION
UPDATECRC
intrinsic help
--------------------------------
13 ?

The newer linux dist is actually less secure than the old one...

Bill

[notfaded1]

It sounds as if you have spent considerable time with these. One thing I noticed was your mention of using a larger CF card, such as a 1GB you mentioned. I could never get that to work. It would take the full 512k+ image ok, but would not boot the system at all, like a 512k Industrial would.

I've been able to get v1.36 to boot on a 1G compact flash card.  It's a:
Lexar
Professional
Compact Flash
with Write Acceleration
1GB
133x Speed it also has a Wa on lower right corner.  I'll post a pic of the card shortly.

[notfaded1]

It sounds as if you have spent considerable time with these. One thing I noticed was your mention of using a larger CF card, such as a 1GB you mentioned. I could never get that to work. It would take the full 512k+ image ok, but would not boot the system at all, like a 512k Industrial would.

Weird thing I had issues with many 512M CF cards trying to get them to boot but the 1GB one I used did boot up v1.36.  I still haven't found a 512MB card that can fit the v1.36 image.

Bill

[notfaded1]

yup.  Does your new (to you) Industrial Delkin 512 have a matching part # ?
These cards are larger for sure. If you can get a 1GB card to work, I would be very surprised, and impressed. If that was the case, shouldn't any larger card work? No. Please let us know the results.

The one Delkin card I bought that's too small even for the v1.30 image or even an older image I have says DDiCF51-U and 29094-1816 on the back of it.  You can see I've been trying a LOT of them.  These things are finicky.  /sbin/seeprom does work in the limited bash shell.  You can change the serial number and model number as well.

Bill

[SoundTech-LG]

Well that is certainly quite curious...  are you using HDD Raw Copy Tool to write the file image?

[notfaded1]

Well that is certainly quite curious...  are you using HDD Raw Copy Tool to write the file image?

Yes I used Raw Copy... same program.

Bill

[SoundTech-LG]

Sounds as if any size CF card should work then, as long as it's bigger than 512 MB 

[notfaded1]

I sincerely hope so ST but the way one of mine doesn't like the 512M card with an image that fits make me think either there's something wrong with one of mine or they are just really flaky with CF cards?  The 1G was the only card I could find that could boot 1.36 at all.  I'll have to look if any of my original 512M CF from factory are big enough for that image.  I'm also going to try my working 1G 1.36 in my other unit that's currently running 1.30 and is my main hooked up unit right now.  The eeprom editing tool works when you are in bash in sys mode without a hitch.  I'm interested in adding more x72 to more units without it and converting them to s250's.  It's an approximately 300$ upgrade by itsself.  I have 4 pairs of the dual BNC's now and have been procrastinating drilling into the back of the case(s)... have you taken the whole motherboard out of a unit yet before?  Another update since I switched from my cheap tiny cable GPS 12V antenna and got a real symmetricom antenna and it made all the difference.  Without it even mounted on my roof and just sitting in the first floor window sill between two tall houses I get 3-5 SATS all day long!  I can't stress how much this was different.  Now I'm looking Active GPS Splitters... OMG it's more C notes!

Bill

[SoundTech-LG]

The Symmetricom/HP splitters work great...  I use them for my S250s and SecureSync and 9483 Netclock units as well.

Don't stress about taking out the motherboard...  piece of cake. Just be careful, and take your time.
Drilling out the back is just the plastic overlay, the metal holes are there already. Just use a tiny drill, and work your way up to the final size to lessen cracking of the plastic.

[NA5WH]

Snagged a S200 for a decent price, but had to order out the appropriate.  Went ahead and did the physical mods and added the jacks....   got the PPS (50% duty cycle) and the irig-b signal... both looks awesome, but not the 10 mhz..... just slight noise..   thought it was just the lack of receiver antenna... but yeah.. no luck today...    and I had put all the screw in retainers in...... 

Guess its time to go surfing for the signal...  had hoped not to have to do any more special mods... but such is life... ^_^

[SoundTech-LG]

Hi,

Sorry to hear you do not see the !0M signal. the first thing I did before touching anything was to probe at the pads for the connectors for the signals. They were all there. Then I proceeded to add in the jacks. You might want to check for open/short...

[NA5WH]

yeah...... its going to be a short... where I don't know...... because its going to be one of those days.... flip her guts open and she's all "here is your 10 mhz right here.. its all good"  *sighs*

edit:
Adding some additional photos, in case it is useful for someone looking at the 48V DC version, and/or the OXCO version.

[SoundTech-LG]

Well I had not seen a 48V version, nor the OCXO version, so thanks!  Nice photos.
Will be nice to know what you find!

[notfaded1]

Like SoundTech-LG I hadn't seen the 48V or OCXO.  Mine are both standard AC and one is the base model and the other is the Rb.  We're always open to more info about the Syncservers!  I keep one running right next to my bench as an additional reference.  It's got an easy to read display from some distance.  Did you drill out your case and if so how?

Bill

[NA5WH]

I was a bit naughty about removing the plastic covering the holes... I first drilled open from the inside with I think a 1/8th or maybe a bit bigger, as centered as possible. Then used a self-centering stepped-hole bit to open it up to the bnc size. It did remove the 'flat', but really its not like the bnc is going to rotate by any real margin, and the pain of trying to remove the plastic was not worth it.  Add the securing screws and can't tell a bit. 

Don't think I have a good photos of the input, but basically it has diversity of two 48-volt power supplies.   Little surprised to see a different GPS board from the ones on the thread. . It feels weird that my itty-bitty Ublox 7 receiver seems to be more sensitive with a lower-power pre-amp antenna than this board. But I do know ublox is not intended for timing purposes.

Downside is now I want to make a frequency counter and figure out if I can make something that resolves the IRIG-B time-code... its really interesting to see the waveform.

[notfaded1]

Thanks for showing your drilling... that's where I'm at now.  It looks good with the BNC locking bolts screwed down onto them.  I'm curious if you used any other compact flash cards and the version you are running?  I've had all kinds of fun with that.

[NA5WH]

Yeah if I had not tried to use a sharp knife thing before just using the right tool, I wouldn't have chipped the plastic color as much....   so think just using the step bit and going with the flow is the right way.

As for version, right now shows  1.36 Release version,  and hardware clock version 1.83

I don't have anything to write or read that kind of flash card. So have not attempted to convert it to the S250 software or anything.  I think the only thing that misses out on is syncing to input of 10mhz, etc....  which currently I dont have anything "better" in accuracy.

[notfaded1]

Yeah if I had not tried to use a sharp knife thing before just using the right tool, I wouldn't have chipped the plastic color as much....   so think just using the step bit and going with the flow is the right way.

As for version, right now shows  1.36 Release version,  and hardware clock version 1.83

I don't have anything to write or read that kind of flash card. So have not attempted to convert it to the S250 software or anything.  I think the only thing that misses out on is syncing to input of 10mhz, etc....  which currently I dont have anything "better" in accuracy.

If you connect to the serial port you can change the hardware model to S250... it's good to know the outputs are there even if you don't make the change though.  Thanks for that.  The hard part is finding a flash card that can hold the later software and boot.  I've tried many options and many don't work.

[smgvbest]

I was doing some hacking and have now enabled root logon via SSH
if there is a easier way feel free to tell me I wasting my time.  And yes I know you can get a console port @ 9600 baud but ssh is nicer


otherwise

perform a backup and do a save-as to get a backup downloaded
open the backup in a zip until such as 7-zip
inside you will see config-1.2.tar.gz
open this in 7zip
then open config-1.2.tar in 7zip
you now have 2 directories
/etc
/var
go into /etc
open and edit shadow (the password file)
the root account looks like this
root:*:14012::::::
the * mean root can not logon
change to
root:$1$uV2.fU1.$UFcRU1rZDB5NJElVrwIR11:14012::::::
that will give root same password as admin (ie symmetricom)
save
if prompted to update the backup file do so
now go to /etc/ssh
edit sshd_config
find
PermitRootLogin no
change to
PermitRootLogin yes
save file
if prompted to update the backup file do so
close the archive
if prompted to update the backup file do so
go to the wizard and restore using the backup file you just updated

[smgvbest]

FWIW,

/sbin/seeprom  as root lets you read and set EEPROM values



/home/fpgademo lets you read and set FPGA values



Also,
From what I can decern the week number roller over occurs in the FPGA.
anyone good as reversing bitcode???

[8bit]

There are at least four locations where the system can have trouble with dates:
 1) GPS: All the boards have a WNRO issue. Sometimes the software can account for it and extend the date.
 2) Linux: This is a 32-bit system. We are closer to 2038 than Y2K!
 3) Symmetricom code: FPGA and other unknown internals.
 4) NTP: This version is getting older by the minute. Without the source for the FPGA driver and hardware clock you can't update it.

There are at least two GPS boards used in the systems: The Motorola M12+T (mostly older) and The Furuno GT-8031 (mostly newer R version).

I have a GPS simulator so I can throw some dates at it and see what happens (Linux, NTP, IRIG, some utilities).

I tried the newer GT-8736 as a drop-in replacement and it "mostly" worked. The other one to try is the Synergy/i-Lotus, but I don't have one yet.

[notfaded1]

FWIW,

/sbin/seeprom  as root lets you read and set EEPROM values

(Attachment Link)

/home/fpgademo lets you read and set FPGA values

(Attachment Link)

Also,
From what I can decern the week number roller over occurs in the FPGA.
anyone good as reversing bitcode???

Thanks for the true root hack!  You could run the seeprom without root before and admin but root is better for other things to investigate more hacks.  I'm going to root mine too now!  That was smart using the products own config file save feature to edit the shadow file!  So easy duh!  I never even looked at the saved config... I didn't know it contained the shadow file from /etc.

Bill

[SoundTech-LG]

All very interesting stuff!!  Now if i can get enough confidence to try some of this. Very grateful for all this info!!!

[notfaded1]

All very interesting stuff!!  Now if i can get enough confidence to try some of this. Very grateful for all this info!!!

What we need is a solution for the compact flash cards that work every time.  I've tried a few and it's a total crap shoot and most don't work.  I had some luck with the one Gig card.  I may try some more of them vs. more 512MB ones.

[SoundTech-LG]

Looking back through my posts here, I do see I might have used 1 GB card successfully as well. Forgot about that. Have you tried multiple 1 GB cards, or just the one?

[notfaded1]

Looking back through my posts here, I do see I might have used 1 GB card successfully as well. Forgot about that. Have you tried multiple 1 GB cards, or just the one?

I've tried just one so far with some success.  I've found with 1.36 it boots and runs but I've had issues with the webserver on it for some reason.  Now that the real root method was posted I may root it to do more lower level testing on the NIC in the unit.  With real root I'll be able to edit files and do things I couldn't do with admin account.  I'll be able to troubleshoot the webserver much better.

Once I get a good 1.36 version that boots off 1G card and fully works I'll post it.

[smgvbest]

On the CF CARDs,   on thing I've noticed is it's mine went looking at the boot screen started to do a fsck saying it wasn't clean and that lasted allong time.
wondering if it's possible that what is happening to others.   I pulled the card and i'm going to load it up onto linux and run a fsck there then try to boot again
here's the partitian table from the 512MB drive that is in my S250

Code: [Select]

root@SyncServer:/dev/discs/disc0# fdisk /dev/discs/disc0/disc

Command (m for help): p

Disk /dev/discs/disc0/disc: 524 MB, 524353536 bytes

17 heads, 60 sectors/track, 1004 cylinders
Units = cylinders of 1020 * 512 = 522240 bytes

                Device Boot    Start       End    Blocks   Id  System
/dev/discs/disc0/part1               1          35       17820   83  Linux // boot
/dev/discs/disc0/part2              36          51        8160   83  Linux  // persist
/dev/discs/disc0/part4              52         979      473280    5  Extended
/dev/discs/disc0/part5              52         416      186120   83  Linux  // root image 1
/dev/discs/disc0/part6             417         781      186120   83  Linux  // root image 2
/dev/discs/disc0/part7             782         979      100950   83  Linux // /mnt/upgrade
also it looks like TimeToHC12d is the main glue peice between the RTC maintained by the GPS/FPGA combo and Linux.


Does anyone have a extra Furuno GT-8031F laying around I could purchase from you?

[SoundTech-LG]

All great work, and info!!!  524 MB...  I take it this is version 1.36
have the Furuno, but it is installed in my S250/S200 modified.

[notfaded1]

This isn't exactly cost effective but they're selling whole GPSDO units that have a GT-8031G in them:
https://www.ebay.com/itm/1x-Symmetricom-GPSDO-10MHz-1PPS-w-shield-GT-8031-Note-/312277068872

I'm not sure I understand his note about switches either... the post above in thread about looking for a substitute sounded promising too... I'd love to replace my GT-8031 with something better.  Most of the newer boards in the GT family don't use "NMEA like" protocol it looks like after checking their current products.  The newer products use a binary protocol.

This one has an GT-8031F board on it:
https://www.ebay.com/itm/1x-RCGD-M-GPSDO-10MHz-1PPS-w-GT-8031/312306276819

B

[SoundTech-LG]

Hi,
Well I got brave and tried it...  thought I had it down.
got Invalid command.
Not sure what I am doing wrong...

[SoundTech-LG]

So after a long tinkering around it appears that maybe the modified file is not getting uploaded back into the system. Not sure. Still trying to make this work.
Question...  should a new backup file saved after uploading the modified one, include all the changes? or, do defaults overwrite those changes each time it gets saved?

[smgvbest]

its possible the zip file is not getting updated.  make sure to exit out of the zip file so it saves then come back in and verify the change is still there.
a backup made will include all changes to /etc so this would be in the backup

[SoundTech-LG]

Hi, thank you for your reply. I have checked the backup file after modification. All changes are there. After uploading it, it gives the Invalid command after trying the first line in the list of commands you provided. Additionally...  if I make a new backup file, none of the changes are there... it reverts back to the defaults.  I am using version 1.36 on the CF card, if that may make a difference. What version are you using?

[smgvbest]

I'm on 1.36

[smgvbest]

To enable sftp
edit /etc/ssh/sshd-config
change
Subsystem      sftp    /usr/lib/openssh/sftp-server
to
Subsystem       sftp    /usr/libexec/sftp-server

next

edit /etc/services
change
sftp           115/tcp
to
#sftp           115/tcp

restart sshd thru GUI or
/etc/init.d/ssh restart

[SoundTech-LG]

Hi,
After I make those changes, save the file, open it and verify correct, close it, restart sshd in the GUI, load the backup file,  I still get Invalid Command. If I make a new backup file from the Wizard none of the changes are there either. It is interesting, and a bit frustrating playing around with it though

[SoundTech-LG]

According to NIST there are some vulnerabilities to be aware of with earlier versions of the software...

https://nvd.nist.gov/vuln/search/results?form_type=Basic&results_type=overview&query=symmetricom&queryType=phrase&search_type=all

[SoundTech-LG]

and here is the main screen just in case it looks different...

[smgvbest]

According to NIST there are some vulnerabilities to be aware of with earlier versions of the software...

https://nvd.nist.gov/vuln/search/results?form_type=Basic&results_type=overview&query=symmetricom&queryType=phrase&search_type=all

The software on many of these older time servers have many vulnerabilities
1.3.6 has these versions of some of the most visible packages

inux SyncServer 2.4.20_mvl31-pc_target.chronos.1.670.15.1061924 #2 Thu Apr 16 19:26:14 PDT 2015 i686 unknown
MontaVista linux


ntpd - NTP daemon program - Ver. 4.2.4p8
Server version: Apache/2.0.63
OpenSSH_5.5p1, OpenSSL 1.0.0 29 Mar 2010

[smgvbest]

and here is the main screen just in case it looks different...

For reference here's mine

[smgvbest]

Hi,
After I make those changes, save the file, open it and verify correct, close it, restart sshd in the GUI, load the backup file,  I still get Invalid Command. If I make a new backup file from the Wizard none of the changes are there either. It is interesting, and a bit frustrating playing around with it though

Just for reference, i did the SFTP changes after I had already made the SSH changes for ROOT.   while it should work editing the zip file and loading the back up i did not test that
I've actually restored mine to a point prior to the changes and did my steps again and it worked fine.

 

[SoundTech-LG]

The main difference is the older model processor Samuel. I have a few of those units too, but I somehow doubt that would change anything...

[SoundTech-LG]

I might have to take a break from it for a while.   I'm sure I've done something wrong... although the tar file contents are looking good to go. Just does not work. I'm really just a hardware guy, so who knows. It sure looks great what you were able to do!

[smgvbest]

I might have to take a break from it for a while.   I'm sure I've done something wrong... although the tar file contents are looking good to go. Just does not work. I'm really just a hardware guy, so who knows. It sure looks great what you were able to do!

Can you PM me and send me your file? 
if you can put on a google or other drive where I can grab it I'll take a look

[SoundTech-LG]

Hi Sandra,

Left you the link via PM.

Thanks!
Martin

[smgvbest]

Has anyone looked at upgrading a S250 to a S350?
some of the items I note.
1. different CPU board
2. 2x CF Cards
3. U36/U37 Populated
4. Gigabit Eth Port
5. Alarm Relays
6. Back up Radio
sure theres more.

does anyone have a dump of the 2 CF Cards is the S350?
anyone have teardown photo's?

[8bit]

While upgrading my S200 to a S250/OCXO I also worked on the CF cards and the OS and looked at some of the differences to the S350.

While the S2xx and S3xx look very similar and were clearly based on the same design, they are NOT the same board as I thought before. The S3xx does not have space for the on-board OCXO and uses a different connector to support the off-board RB or OCXO. The S3xx also has a different power supply (looks better). The S3xx also includes the Gig-E chip and the connector for the T1/E1 timing card. It looks like the S2xx could support the alarm relay card and the modem card (but never did). There are also some extra options for military use.

They both support the same 32-bit X86 PC controllers but the S3xx uses a faster CPU with more memory. Even the oldest system with only 128MB RAM should be fine. The newer S2xx came with 256MB RAM and the S3xx have at least 512MB RAM. While the RAM is a standard SODIMM and upgradable, there's little point in doing so. Upgrading the CPU (or PC card) would not change the timing performance as that is handled by the FPGA hardware and not the CPU. A faster CPU would help system response and NTP performance. The S2xx systems are not very fast. The S3xx systems are not much faster.

While the S2xx and S3xx seem to use the same FPGA setup they run different code and seem to be connected a little differently.

It seems they (symmetricom) were working on a unified code release and set of system options for the S2xx/S3xx. I would guess they gave up as it was good enough and then soldout to Microsemi who ended the product development in favor of newer systems (the S600/S650 modeler).

The S2xx software does not require the OPTIONS or OPTEXT to be set (they are just 0) and the web page uses the model number (S200 or S250) to set some features. All the circuitry seems to be the same for the S200 and S250 except for the extra 6 BNC connectors. The oscillator hardware (TCXO/OCXO/RB) seems to be the only real option in the eeprom.

The S3xx use the OPTIONS and OPTEXT to set the hardware/software options present in the system (including hidden features). You can set ALL options from the "root eng" menu including oscillator and model number. No need for root shell.

For the S2xx there is only one 512MB flash card. On the S3xx there are two 512MB flash cards but they are not mirrored. In the S3xx, the first card (hda) has the same setup as the S2xx and the 2nd card (hdc) is just for the database storage unique to the S3xx software.

The stock S3xx software does run on the S2xx system basically unmodified and includes the provision to use a single 1GB flash card with an extra partition for the database storage (or just don't start the DB). I'll have to test the different FPGA code, currently I'm still running the S250 FPGA code. You can reflash between the versions from the root shell.

I loaded the S3xx software on a 1G CF card and setup the 8th extended partition as the rest of the storage (Linux EXT3) and the system is happy. I set the hardware options so it shows working features (also added the easy/cheap OCXO upgrade and BNC connectors to the S200):
 MODELNUMBER S350
 OPTEXT 0x00000027
 OPTIONS 0x000019C9

The S3xx software is a little newer with some extra features. It uses the 2.6 kernel rather than 2.4 but NTP is the same old version.

As for a new working CompactFlash card.... It needs to be NON-REMOVABLE/IDE-MODE AND NON-DMA (and large enough to hold the partitions). Using the wrong type of card should not damage the system but it won't boot. Using a removable CF card generally won't boot at all. Using a non-removable (hard disk) but DMA card will generate errors and won't finish booting. Some cards claim to support full auto-detection of all options but don't count on it working. You can connect the serial console to watch the system boot (9600-8-N-1).

Apacer makes several cards that work. The 512MB or 1G cards from the CFIII or CF5 line work (I am using them). Speed is not important as the system tops out at about 1.6MBytes/sec (extra slow PIO speed). You can get the cards new from DigiKey or Mouser. The CFIII have a better write endurance but are slower (not that it matters). The S2xx and the S3xx boot cards are not written to a lot. The secondary S3xx card is mounted read-write.

The Apacer CF5 cards are obsolete and may be hard to find new. The Apacer CFIII cards are older but still seem to be available new. The newer Apacer CF6 cards should work but I have not tested them.

Extended Temp 512MB CF5: AP-CF512MR9NS-ETNDNRB ($34)
Extended Temp 1G CF5: AP-CF001GR9NS-ETNDNRB
Standard Temp 512MB CF5: AP-CF512MR9NS-NDNRB
Standard Temp 1G CF5: AP-CF001GR9NS-NDNRB

Extended Temp 512MB CFIII: AP-CF512ME3NR-ETNDNRQ ($33)
Extended Temp 1GB CFIII: AP-CF001GE3NR-ETNDNRQ ($47)
Standard Temp 512MB CFIII: AP-CF512ME3NR-NDNRQ ($26)
Standard Temp 1GB CFIII: AP-CF001GE3NR-NDNRQ ($35)

DigiKey has a good number of the Apacer CFIII 1GB ET cards (AP-CF001GE3NR-ETNDNRQ). You can use the 1GB card as a direct replacement for the 512MB card and just not use the extra space. As the card is formatted for Linux you can change the partition size but not the layout (partition numbers) and it will still work correctly. The partitions just need to be large enough to hold the data. I copied a S350 card to the new 1G CF card and booted it in the S250. Then using a root shell and cfdisk I added the 8th partition with EXT3 format and it's a happy box.

[notfaded1]

Would you post a link to the 1G image you are using on your S200 series that works?  I've also spent a lot of time working on this and I'm interested in seeing the S350 code run on an S200 1G card.

Bill

[SoundTech-LG]

wow, great work, great info!!! 

If you have an image for the 1gB CF for the the S250 I would love a copy.

Thanks!

[timenuttie123]

While the S2xx and S3xx look very similar and were clearly based on the same design, they are NOT the same board as I thought before. The S3xx does not have space for the on-board OCXO and uses a different connector to support the off-board RB or OCXO

I have a follow up question to 8bit's comment about the S3XX being different from S2XX. Does the S300 have the precut holes in the chassis for the 3 BNC connectors and the corresponding circuit traces on the board for soldering them?

I am considering getting a used S300, and I'd like to make sure I can at least use PPS OUT (timing inputs would be nice too, but I don't care as much).

TIA!

[8bit]

I only have the original TS2100, S350, S200, and S250 units but not an original S300. Most have had power supply failures (some sparks and smoke).

I would think the S300 and S350 would have the same metal chassis and so the S300 should have all the punched holes but a different sticker covering them.
From a manufacturing perspective it's cheaper to have one or two versions rather than different ones for every single variation (there are many).

This PDF shows the S300 with the holes as you want:
 https://www.microsemi.com/document-portal/doc_download/133336-syncserver-s300-datasheet

It's also an interesting photo as it shows a different S3xx main board that does include on-board space of the OCXO unlike the ones I have. It does have the T1 header, the 2nd CF slot, GigE, and different RB connector so it's definitely a S3xx board. I don't know if they made any S200/S300 without the electronics needed for the S250/S350 connections.

I used a heat gun to soften (not melt) the plastic and then a sharp thin knife to cut the plastic to match the holes. Others have used a drill. Without heating the plastic a drill seems better...the plastic sticker is rather thick and strong.

[notfaded1]

I just bought one of the last 512M cards from mouser... both Digikey and Mouser say they are now backordered.  I was going to order two from mouser but it said an item is backordered so I reduced it to 1.

[notfaded1]

Thanks for the tip 8bit... my problem has always been finding cards that will boot correctly or be big enough.  I've had lots of trials that failed... many of us have.

[timenuttie123]

I just got two of these from Amazon (I have S300):

https://www.amazon.com/gp/product/B00J8SS9M6/ref=ppx_yo_dt_b_asin_title_o03_s00?ie=UTF8&psc=1

I used "dd" on Linux to copy the original 512MB cards onto the new ones, then installed them back and everything worked right the first shot.

Next: root hack & sftp hack.

[AlexJackson]

I had posted to this earlier but deleted it for not having anything major to contribute.

I also have a base s200 device that Ive had for a few years. I was able to get mine to work on a Transcend 1GB 80x card I had from my old Watchguard XTM 5 firewall. I've also tried the 1.36 disk image linked earlier in the thread and while it worked, it had a number of bugs in the VFD. First was a strange flickering between various bits of text "invalid address" and blank spaces on the hardware clock status "page" on the VFD. Also, when it finally synced/locked over GPS (I have the symmetricom 12v antenna), I got either "REF:    " or "REF: Pkt Err". Further testing shown that even without an antenna or network link, it would lock and sync and show Stratum 1. Loading the image on the factory card also yields very strange intermittent errors in the admin pages. I have since rolled back to 1.10. I did ask around if there other versions available, but I haven't found anything or heard back.

However what I'm really after ultimately is the more advancing timing oscillators and outputs that are lacking on the s200. So I've decided to probe around my s200 with my "new" scope (ds1054z) Ive only used a couple times and see if adding the jacks would even work (especially at 15 bucks each). Gives me a reason to probe something. And yes, I found the signals, 10MHz signal, PPS & IRIG. I have a few other items that can use PPS.

With that said, mine only has the TCXO, and I've ordered a Vectron MC597X4-040W that was shown fitted to an OCXO version earlier in the post as well. Regarding installing R121, to me it looks like its just a jumper and not so much a resistor. To my old eyes the pictures look like the value is "000" but I can barely read/do smd stuff to begin with.

I still have yet to dive into mine much more than some probing and CF card testing. I have several other 512MB cards that don't work either because they're too small. I also havent ordered the bnc connectors at this time, that will probably come next week.

[AlexJackson]

I know I'm totally late to this show. My Vectron OCXO showed up today. It wasn't supposed to be here until Friday. I might have me a nice little project for later tonight or even the long weekend (if I have one). I dont yet have the bnc connectors, but im going to go ahead and drill for them.

From what I seen from the pictures @NA5WH, It appears that R121 is labelled "000" so I'm going to say this is a jumper. So I'm pretty much going to be following in the footsteps of @8bit with the s200 to s250 mod. Sadly, I'm stuck on v1.10 because I couldn't get any of the shell hacks to take, but ill try it with the linked v1.36 to run the seeprom program then ill probably have to go back to 1.10 unless it fixes my VFD issues on 1.36 (not likely).

[SoundTech-LG]

Interesting those shell hacks...  spent considerable time with and got nowhere. Not sure if it is a user error or what.

[AlexJackson]

An update on my s200 'upgrade'. Didn't go well for the main reason for the upgrade, the OCXO. I ran into a few 'issues'.

The installation of the new BNC jacks went well, and the holes drilled ok with my old half-dull step bit. I haven't verified the signals yet until I verify the device comes back up with a good lock.

I couldn't cleanly remove the solder from the center pin on the OCXO (pin #2) with a de-soldering bulb (suck or blow). There was something stuck it so I had to use my fine point iron, get it hot and push it through the hole. I did get some crap out of it that didn't want to melt with my iron. That process took 30 minutes. I did get the new oscillator installed. Jumped R121 with jumper and installed a jumper on J3. The whole installation the new oscillator took me 2 hours with all the cascade of issues I encountered with my iron, soldering station, finding my stuff (it was all moved, and I don't have a true "bench"). Lots of running around involved.

Turns out my card reader is messed up so I cant use the 1.36 image to flash the new image to the CF card and I don't own a programmer. Unless if someone knows how to do the root hack with v1.10. (none of the hacks discussed work on 1.10).

updates:
1. The inputs & outputs work great and the system indicates lock when I do a loopback.
2. Turns out, the cord for my card reader was shot, and my partner had an old cord that fit. I was able to image 1.36, and bust out to a terminal and run seeprom to change the oscillator type.

Without J3 jumped, even when set to the OCXO in seeprom, it will show TCXO in the interface and in ssh. Once J3 is installed it shows as OCXO.

So in the end, the upgrade was a success, but v1.36 still doesn't work properly with my vfd and shows several issues. Unless someone has another version of the OS I'll have to remain on v1.10.

[notfaded1]

I never had VFD issues with the 1.36 version that's really strange problem for sure.

[AlexJackson]

Strange indeed... So today I swapped cards and changed the model type from S200 to S250 (since i now have the I/O jacks) and the VFD and status pages on the VFD are still acting strange.

Whether or not if I have a GPS lock, it will show on the first line, "REF:           " & on the second line, "NTP Stratum 1". Sometimes I'll see "REF: Pkt Err" flash frequently on the VFD. The Sync LED will swap between red & green as well as the "Alarm" LED. Even when the Alarm LED is red, no alarms show on the admin page.

I've messed around with it a lot today, and havent been able to suss out whats going on. I'm going to guess my device has some older hardware that the new firmware doesn't like, or the firmware updates also updates firmware on the peripherals such as the VFD.

[TheWizard]

This thread is getting old, but, was very helpful in getting some older Symmetricom S2xx units up and running, so I thought I would summarize and consolidate everything I've learned here.

The key upgrades for most of these units will be software, Vectron MC597X4-040W OCXO, and an upgraded I-Lotus M12MT/IL-GPS-0030-B GPS receiver board.

To install the Vectron OCXO, purchase from ebay or elsewhere, and solder the oscillator in place on the main board. The board is multilayer FR4 glass/epoxy, so you have to carefully put some heat into soldering the OCXO pins to get good connection.  Then bridge R121 with solder to connect the OCXO 10Mhz output and put a jumper on JP3 to disable the TCXO. Ssh into the unit over lan-1 with admin and enter the following command: root eng sys cat "/dev/null && bash"

CD to the /sbin folder and run: ./seeprom

Select option 38 and set oscillator type to 1 for OCXO (0 is TCXO, 2 is X72 Rubidium Osc).  Then select option 4 to update checksum.....this must be done. Type "exit", then type "reboot".  If your firmware also needs updated, you can avoid updating the eprom by simply installing the OCXO first, then running the software update from the web gui.  This will automatically scan the system and set osc type automatically.

The factory Motorola/Furuno/M12 GPS board has a rollover date in September of 2022. The I-Lotus (IL-GPS-0030-B) is a direct compatible replacement and costs $65 and is good for 20 years from the date of the sticker on the board. Simply remove 4-screws and swap the boards.

For software upgrades, 1.36.1 from 2015 is the latest firmware for S2xx units.  Firmware upgrade files along with a complete 1.30 runtime image that will fit on any 512mb flash card are included in the link below. These avoid the previous issues of odd-size/too small flash card.  The upgrade files are untouched with matching SHA-1 checksum and should work on any S2xx unit with a factory 512mb flash card.

Symmetricom Files

*** Files link updated 7/9/21 to publicly shared Google Drive ***

[deepskyridge]

Anyone found a good source for the new iLotus GPS board. I have not been able to find one.

Thanks
Gary

[wje]

I was overjoyed to find this topic, useful information on these is apparently scarce. There are some S250's with the 48VDC supply input showing up on EPray recently, I snagged one.

Mine came with V1.30 installed. I immediately did a hardware mod to supply 5V to the antenna instead of 12V. It's a pretty trivial change, if anyone is interested, I'll post details.

I'm installing a Vectron ocxo, just came today.

One issue, I tried upgrading with the 1.36 update distribution above, not the image, but the actual upgrade file. It fails, logs say 'incorrect hardware version'. Anyone have any clues about this? Meantime, I'll try the image route when I add the ocxo.

BTW, this unit is really easy to hack Linux-wise. I'm surprised Symmetricom didn't lock it down more. Really, a 'settings backup' that's a straight tar of various Linux dirs? But it does make hacking a lot simpler.

Bill

[wje]

Update - neither the 1.36 upgrade path nor the 1.36 image posted here on a Delkin CF work. The image starts loading the OS, then hangs. Guess I'm stuck with 1.30. Status page reports 'Authentic AMD Geode ... 500. This is one of the x86 clones they got from National Semi. Not sure what mfg date is, random stickers inside the box with fairly high rev letters (G, H, etc). Hardware clock version is 1.83. Running sw version is pc_target.chronos.1.667.13.1551430. Any help appreciated. OTOH, ocxo is working fine.

Bill

[SoundTech-LG]

Did you try resetting to defaults first??? Worth a try.

[wje]

Oops, pilot error. The upgrade tar applied fine once I figured out that when the manual said "don't uncompress the tar", that didn't mean "don't unzip the zip file with the tar in it". Duh. Bare tar updated fine. So, I'm now in the ranks of S250 owners with an ocxo upgrade, root login via ssh, and V1.36 sw. Sweet.

[deepskyridge]

I don't seem to be able to get the root hack to work. When I try SSH login it does not know about user root.

I have tried at least twice.

Gary

[TheWizard]

You cannot ssh directly with root user.  Ssh first to the lan-1 IP address with the same admin user/pass credentials as the web gui. Once logged in then enter: root eng sys cat "/dev/null && bash"

The iLotus GPS board can be purchased with credit card from Synergy Systems in San Diego Ca.  https://synergy-gps.com
Part# is: IL-GPS-0030-B

As posted above, the gui firmware update files in the link have to be first unzipped, then apply only the rar file.   

[notfaded1]

Looks like I need to work on my stack of S200's again some more!  This image that will fit on more of the many cards is big plus thanks for linking to a version that can fit easier. 

Bill

[deepskyridge]

Wizard, thanks for the information.

I have my 200 upgraded and working.

Gary

[TheWizard]

NP

To clarify, the linked 1.30 firmware image can be burned to any 512mb CF card (I also tested a few 1gb and 2gb cards and they worked fine) using the included RawCopy tool.....no need to fool around with the weird sizing issues in earlier posts.  For those that obtain S2xx units with dead/missing CF cards, this is needed to get the system booted.  The 1.30 firmware image was copied from a brand-new S250 as a backup. 

From a security perspective, there is no way to verify the integrity (I assure you it's clean) of the 1.30 image I provided, so after getting a S2xx booted it is important to unzip the 1.36 firmware package and use the gui to apply the tar update file. If you have a MicroSemi/Microchip support account, you can verify that the MD5/SHA1 hashes in the zip files are legit and the update tar files are untouched. 

These units run a fairly old version of Linux that has not been patched in quite some time.  However, the way Symmetricom designed the OS is highly customized/specific to their use and hardened in ways that are not dependent on file patching, so I would not worry much about attack surface. 

When a firmware update is run from the gui, the process exchanges private encryption keys which invoke secured check scripts that parse root for cleanup, file signatures, permissions, and other security details.  Anything "extra" in the system gets cleaned out or overwritten during upgrades, so if you have these units providing NTP services to public clients, it might be advisable to periodically re-run the 1.36 update.

I also included the latest S3xx firmware update file in case anyone also has one of those units. Cheers. 

Symmetricom Files

[SoundTech-LG]

Just found one of my CF cards with V. 1.36 on it that is only 510MB easily fitting on the 512 CF cards.

Here it is...   https://www.dropbox.com/s/3g2oi29c4k91afp/V.%201.36%20510MB.imgc?dl=0

It has the Default login credentials except Symmetricom is with the UPPERCASE S
Hope that saves you a few steps!

[SoundTech-LG]

I added another image file for v. 1.36.  This one is completely factory defaulted. When you default the unit, the file size on the card grows to the max size of the CF card. (is that a feature???) This CF card is 512.48 MB. Still possible that a lot of CF cards are at least that big.
So here is the link... 
https://www.dropbox.com/s/p4emcefkge7ipj8/V.%201.36%20Defaulted_512.48MB.imgc?dl=0

[keitho]

I was overjoyed to find this topic, useful information on these is apparently scarce. There are some S250's with the 48VDC supply input showing up on EPray recently, I snagged one.

Mine came with V1.30 installed. I immediately did a hardware mod to supply 5V to the antenna instead of 12V. It's a pretty trivial change, if anyone is interested, I'll post details.

I'm installing a Vectron ocxo, just came today.

One issue, I tried upgrading with the 1.36 update distribution above, not the image, but the actual upgrade file. It fails, logs say 'incorrect hardware version'. Anyone have any clues about this? Meantime, I'll try the image route when I add the ocxo.

BTW, this unit is really easy to hack Linux-wise. I'm surprised Symmetricom didn't lock it down more. Really, a 'settings backup' that's a straight tar of various Linux dirs? But it does make hacking a lot simpler.

Bill

Please post details on your 5V antenna mod!
I just got two s200 units that I intend to use as NTP servers for my network, and I would prefer not to have to buy $300 antennas if I don't have to.

[JoeFloyd]

I have a couple Symmetricom S200 devices which I've updated with GT-8736 GPS/GLONASS timing receivers.  The GT-8736 is drop in replacement for the Motorola M12/M12+ GPS boards which no longer work due to GPS week roll-over.  The software running on the S200 is the latest available.

The GT-8736 are much better GPS receivers than the GT-8036 receivers which were installed by Symmerticom.  The GT-8736 see 10 GPS satellite while the GT-8036 would only see two or three.  I now get valid GPS time and show GPS lock. 

Even with GPS lock I neve see the Hardware Clock status go "Locked".  It is always unlocked and the clock is not updated by GPS.  NTP does update the clock.


I added BNC connectors to the S200 for IRIG, 1 PPS, and 10 MHz and have tried feeding IRIG-B time and date info from an upgraded Symmericom S300-R to the S200.  IRIG shows locked, but once again the hardware clock is never updated and shows "Unlocked".    I'm not sure if I have something configured wrong on the S200, but the same basic configuration works on the S300-R.

A second issue is that upon adding an OCXO and jumpers on JP3 and R121 the S200 (hacked to S250) will sometimes automatically detect the OCXO and update the oscillator setting in the EEPROM, but the 10MHz frequency never reaches 10MHz.  It it always 100 - 1000 Hz off.  The OCXO in the S200 stabilizes at a frequency that is never exactly 10MHz when measures against the 10MHz output form the S300-R (hacked to S350-R) or a Chinese GPSDO which agrees with S300-R to within .001Hz (relative phase drift measurement).  An new exact part VECTRON OCXO as installed from the factory is being used.   I haven't tried looking at the control voltages being generated to adjust the OCXO.  Upon power cycle of the S200 the OCXO appears to not startup or not startup fast enough and the software shows the oscillator type as Unknown.  This also seems to impact the GPS receiver and the GPS receiver is shown as Unknown whenever the oscillator is not detected.

I have removed the OCXO since I was able to track down a couple Symmetricom X72 rubidium frequency standards (used). 

In order to install the X72, I used a break-out board that is being sold by an EEVBLOG member.  There are only six pins to connect.  I haven't been able to find a pinout for the connector on the S200 mainboard, but photos of devices with rubidium standards installed and the cover off gave me enough information to figure out the pins.  When the X72 is installed, the R121 should be unpopulated.  Only J3 should be installed.   The S200 hacked into a S250-R with X72 rubidium does achieve and exact 10MHz output.  The control loop of the S200 appears to be functioning as expected but the rubidium oscillator has 10x the phase drift than the S300-R, and the darn Hardware Clock always remains "Unlocked".  This should only impact NTP and IRIG as far as I know. 

Does anyone have any idea what is going on? Even if the GT-8736 is doing something weird, I would expect the IRIG-B time source would have set the hardware clock.  Is this a software issue?  It would seem so.  The X72 rubidium frequency is exactly 10MHz which is pretty good proof that the FPGA is steering the oscillator.   

Since my goal is to have a working commercial GPSDO I don't have much more I need to do, but it would be great if the OCXO worked as advertised since the X72 rubidium standards have a limited life, are out of production, and the ones I can afford have thousands of hours on them.


FYI, the S300-R I've hacked into an S350-R also had the GT-8036 GPS board and failed GPS lock.  This was replaced with a GT-8736 and I now get GPS lock without any issues.   Unlike the S200, the S300-R does show hardware clock lock.  So, the Gt-8736 does appear to be a drop in replacement and works great in the S300.

Unfortunately, the GT-8736 is out of production and I can't seem to find any for sell.   I paid ~$50US for each GT-8736 from a UK parts distribution company.  A few years ago, several people on the timenuts mailing lists did a group buy of the GT-8736 receivers for ~$25US. 

-----

Just in case anyone is interested.  While I had the GT-8036 board installed in the S200 I decoded the serial data stream from the GT-8036 and the Motorola protocol which reports GPS status @@Ha would never show a valid date.  It had the correct time, but the date was completely wrong with too many Zeros.  I believe this is why the S200 would not accept the time and date information from GT-8036 regardless of the mode of the GPS receiver and having 5+ satellites in the timing solution.  The TTL serial data in Motorola binary format  is not hard to decode.  It should be possible to use something like an Arduino or PIC with two UARTS to sit between the GT-8036 and the S200 and patch the @@Ha message to insert the correct date information using a battery backed clock. Since this only updating the date, it doesn't need to be all that accurate as long as the date is set correctly when the time goes past GPS midnight.  I mention this because the replacement M12/M12+ boards are $400US.  If the date is the only thing wrong with the GT-8036 boards it would be worth making a custom Arduino board to intercept and update the serial data.  This is just an idea to fix the GPS Lock issue cheaply.

The GPS Week Rollover issue doesn't impact time or the 1 PPS signal generated by the GT-8036.  The S200 only uses the 1 PPS signal to control the TCXO/OCXO/X72,  so there isn't anything hardware wise that I'm aware of that should care about the GPS date.  The FPGA should only care about the 1 PPS, but I'm pretty sure the software tells the FPGA when GPS lock has occurred and the 1PPS is valid.  Without a valid date, the software never tells the FPGA the 1PPS is valid. I haven't actually tested when the control loop starts steering the oscillator, so take that with a grain of salt.

----

S200/S250 P3 - Rubidium Oscillator connector pinout

From inboard to outboard

1 -  Service / End of Life Pin
2 -  C-field / Frequency Adjustment
3 -  Vpos / 15V
4 -  Vneg / GND
5 -  Vneg / GND
6 -  10Mhz Sine / RF out

The breakout board I ordered matches the pinout from the Symmerticom X72 manual

http://www.rdrelectronics.com/skip/nov/X72.pdf   See page 54


See

Here is a photo of the breakout board.  It has the same schematic as the Symmerticom breakout edge connector board.

See

The pins which are used on the X72 edge board connector are

4  -  Service / End of Life Pin
5  -  C-field / Frequency Adjustment
1  -  Vpos / 15V
7  -  Vneg / GND
8  -  Vneg / GND
16 -  10Mhz Sine / RF out

[testpoint1]

today I also tear down a Rb version of S200, if you just need the 10MHz port, no need to do so many things, just connect a BNC/MMCX cable to X72 interface board. and install the BNC connector to the rear panel.

[JoeFloyd]

Having the NTP, IRIG, and 10MHz out all working is my goal.  All of that works, but the software controlled hardware clock status remains in the unlocked state when using GPS or IRIG.  I can't explain why since the hardware clock is updated to the correct time by the NTP client software and matches what I can read from TTL serial output from the GT-8736.    I haven't tried decoding the IRIG data, but I assume that the S300 hacked to S350 with IRIG outputs is doing what it should.  The S200 hacked to S250 with IRIG inputs locks to the IRIG data which includes date and time information.  But, again, the S200 with IRIG inputs never shows the  hardware clock as locked even though the IRIG status shows locked. 

The GPSDO of Chinese origin is plenty accurate with minimal drift when GPS is locked.   If all I wanted was an accurate and stable 10MHz, the Chinese GPSDO is fine.  If I want to compare frequency standards in order to confirm that the standards are working as expected, I do need independent standards. 

Why do I care?  No good reason other than falling into the rabbit hole of metrology and the physics for cesium and rubidium standards allows me to clear the cobwebs that have formed since I received my physics degree back in the 90s. 

[testpoint1]

Having the NTP, IRIG, and 10MHz out all working is my goal.  All of that works, but the software controlled hardware clock status remains in the unlocked state when using GPS or IRIG.  I can't explain why since the hardware clock is updated to the correct time by the NTP client software and matches what I can read from TTL serial output from the GT-8736.    I haven't tried decoding the IRIG data, but I assume that the S300 hacked to S350 with IRIG outputs is doing what it should.  The S200 hacked to S250 with IRIG inputs locks to the IRIG data which includes date and time information.  But, again, the S200 with IRIG inputs never shows the  hardware clock as locked even though the IRIG status shows locked. 

The GPSDO of Chinese origin is plenty accurate with minimal drift when GPS is locked.   If all I wanted was an accurate and stable 10MHz, the Chinese GPSDO is fine.  If I want to compare frequency standards in order to confirm that the standards are working as expected, I do need independent standards. 

Why do I care?  No good reason other than falling into the rabbit hole of metrology and the physics for cesium and rubidium standards allows me to clear the cobwebs that have formed since I received my physics degree back in the 90s.

I also strange that hardware clock always in "unlocked" status, I checked the white line of No.5 within P3, when the X72 is unlocked, the voltage is high (5V), when X72 is locked, the voltage should be turn to low (low than 0.3V), but still 1.15V; when I disconnect the pin from X72 to S200 motherboard, in the locked status, the level is exact 0V, I only have one S200 in hand, not sure it is X72 or S200 motherboard problem, or design problem.

[dj831]

Hi all, my two cents on that (old) topic ... I found an S250 with a rubidium clock inside, sold as working. Of course, no surprise: no GPS sync. Here's what I did ...

• Firmware upgrade. Either I was extremely lucky, or I don't know, but it was a strightforward process. I did it in a totally different way, knowing my level of competence about Linux (close to ground level), as I did many years ago for a Lantronix server. I used WinHex and made a raw copy to save original Flash Card, a Delkin Devices CFX512I4G1-DAAEG00 with v1.26 running on it. I took the first 512Mb card I had, a 512Mb Sandisk SDCFJ, I restored the image, and voilà, it worked like a charm. I then performed the upgrade with the tar file found several posts earlier, and done, v1.36. I Did the same on the original flash, same result: S250 runs on v1.36

• Power supply. Not an upgrade in itself, but I noticed that it is nearly indentical of those found in old Cisco 2500/2600/1800 routers. Note though that if your symmetricom supply fails and you want to use one of these Cisco power supplies, you need to keep casing, and simply swap electronic board (it misses drilling on cisco supplies). Note also that it won't work for rubidium version, since 12V rail wattage of Cisco supplies is lower than wattage of Symmetricom supply

• GPS module. I performed tests with the original Pentair (GT-8031) module here: https://www.eevblog.com/forum/metrology/symmetricom-syncserver-s350-furuno-gt-8031-timing-gps-gps-week-rollover/. That module will never work again in an S200/300. The only way that could perhaps make it work again would be to intercept ZDA frame sent by GT-8031 (TX) to MSP430, and replace date (2003 for example) by adding rollover offset. It would need an extra microcontroller handling one COM port (RX from GT-8031, TX to MSP430). BTW too much complicated. Thus, I ordered an HD-8736 module from EHOL Design thru eBay (the easiest way, even if I'm in France too). Their module is the Furuno GT-8736, modded with an extra regulator to make it work on a wide range of devices (3.3V or 5V). The module was slightly to tall, but issue was easily solved by adding 2.5mm washers between standoffs and module. It works, but you must set 'dynamic' mode in References/GPS menu. Note that they purchased the very last stock of a distributor, hence the availability of the module still in 2023. Important notice: rollover of the GT-8736 is in 2032.

• Antenna. Finding a 12V antenna is a nightmare. I purchased back in 2016 a PCTEL GPS-TMG-HR-26NCM (26dB GPS Timing Antenna). Datasheet rates it for 5V, but usable till 12V. It works like a charm. For those wanting to use a 5V only antenna, be aware that power supply of antenna is not managed by Furuno module, but by an LT4254 on the main board. You can't change supply of that component, since its minimum supply is a bit above 10V. You could though try to use a 6.8V/1.3W zener diode in series with L1 inductor (27µH), to lower voltage of antenna without impacting the LT4254

I've attached some pictures, if it helps 

[NA5WH]

Good day.  I've had my modded S200 running for.... feels like ever now...

One problem I've had off and on was that periodically the front display would be garbled. I don't seem to have a picture of that at the moment, but it was fairly short-lived and infrequent, would last half a day or so and be fine for many days.

Last week it went bad. I am so used to looking down and seeing the current UTC time and after coming home from work it was frozen display with a time hours old at that point. Unit was completely unresponsive to front controls (LEDs still work, NTP light comes on etc).  Verified that web and ntp on it were still going fine (they were/still are), and while I don't have anything serious on my 10 mhz loop, my RS sig-gen still thinks its getting a good 10 mhz...  so left it to sit thinking it would come back after a few days. No luck.  And ending a year+ uptime, I powered it down, and back up... front panel display and controls worked fine (but of course usual wait for it to be totally happy for gps lock etc). But next day I get what is shown below (something half-way between two different messages), and again unresponsive to front panel buttons but LEDs are fine. Its now been another day and still showing that.  I assume there must be some chip controlling the VFD and controls that is likely to blame. Just curious if anyone run across this before that might save a bit of troubleshooting time on it.

Only other mod I have on it is replacing the original GPS with an "i-lotus" IL-GPS-0030-B in May 2021.  I didnt seem to have any issue with the Sept 2022 issue.

[dj831]

If you need to replace your VFD module, it is orderable from Farnell, with different firmware, if it helps (Farnell code 1495427, with a deadline of 19 weeks). But do not forget to check power supply capacitors first (or replace supply with one removed from a Cisco 2500/2600/1800 router, if you don't have Rb oscillator).

[Kets_One]

To anyone needing an original Furuno GT8736, i have one laying around.
Please send me a message if you're interested.

Module is sold. Please do not message me about this anymore

[phollens]

Good Morning.  I have picked up an S250i, which I didn't notice was a model without the GPS card.  I have found some GPS cars to buy, however, I am not clear which mini RF connector is on the motherboard.  I know that the connector on the GPS card is a MMCX, but the one on the board does not look like it is the same size.  Any help would be appreciated.


 I have an X99 on the way for it.  It appears to have the same pinout as the X72.  There is an eBay auction with an ST2-Rb module with the X99, and the breakout board  says x72/X99.

I also have an X99 in my 8040C, so that should help me figure it out if it is not 100%.

Thanks for the time.

Patrick

[dj831]

Hi Patrick, perhaps the picture on previous page can help you  Two questions, though: do you still have the white cable in your S250? And second question: what GPS card did you find? That question since there's not much choices left these days ...

I too received an S250 without any options last week, but since that one is intended to be used only as an NTP server, I'm just upgrading the TXCO to an OXCO, ordered few days ago from China. Last but not least, perhaps it could be less expensive to build your own breakout board, since manufacturers like JLCPCB are very cheap 

Hope it helps.

[phollens]

There was no coax cable because the S250i doesn't have a GPS module.(That is what the 'i' at the end means)   I found an i-lotus module on AliExpress and it is on its way from China.  I have also been looking at the Hoel HD-8736 board from France.  You can find them on the on-line flea market with item number 134477429692.  I saw on some previous posts here that that card maybe didn't work as well as the i-lotus board in these systems though.

ProStudio Connection did have 2 i-lotus boards up until today.  I didn't want to pay close to  $300 for one though.

The fine people that have the HD-8736 board for sale that I referred to above let me know that the needed cable is an MCX male to MMCX male.  They gave me a samtec part number of RF174-02SP1-03RP1-0152.  Digi-key has them in stock.

I have also ordered 2 of the X72 breakout boards from South Korea, but I have not heard when they might be shipped yet. 


Patrick

[phollens]

I got the cable in from Digikey, and having to do it again I would have gone with right angle connections on both ends.  It does work, but it sets off my OCD.  The part number of the cable with both right angle connectors is RF174-02RP1-03RP1-0152.

I changed the model number to the regular S250 and I now have a GPS tab in references.  It  is giving me an open antenna warning along with a status of 'Acquiring Signal' in the GPS status tab.

I am just waiting on my PCTEL 40dB antenna and my N to BNC cable now.  I will let you know how it goes.

[phollens]

I was able to get the i-lotus GPS module installed and everything looks fine except that I still don't have GPS as an option under the Hardware Clock section.  I am thinking that it is not enough to change the model number on the S250i to get it to use the GPS time. 

Update:  I was able to get it to pick up the GPS as a HW Clock by doing a factory reset. 
Note:  You have to set everything back up from scratch.  If you restore a backup it removes GPS as a HW clock source.


Update 2:  The i-lotus board that I got from China appears to have the week number rollover bug.  It is saying that it is 2004.



Patrick

[deepskyridge]

I have a S350 that I put a i-lotus board in and it had the same problem, replaced it with one of the Heol boards from France and it is working fine for a couple of months now.

Gary

[dj831]

An update about M12 card: the HEOL card based on GT-86 is no longer available (the rebadged GT-8736 + a regulator). The good news is that they now sale a compatible card based on GT-88. That card contains a GT-88, a voltage regulator, and a serial to USB converter (CP2102 from Silabs). This time, the card is based on their own design, thus not being dependant on providers (apart Furuno with the GT-88 module). Note that firmware of the GT-88 is not standard, since by default, GT-88 uses eSip format, and not Motorola.

I had the luck to get that card, since the last GT-8736 card available on eBay was NLA - they sent me that one instead. For those who'd like to purchase one, eBay item is 134842120193. 145€ (including VAT) is not cheap, but the GT-88 from Mouser isn't either (103.80€ with VAT). And no risk about fake iLotus on AliExpress (fake, like most of ICs made from unobtainium that are curiously available on AliExpress  ).

Despite mine looks like a proto (SW jumper is not used, all three pins are soldered with a LED wire, and original choice of D2 was apparently too light), it works like a charm, either in Survey and in Dynamic mode. As a simple test, I had all LEDS green (=synced) in both modes after c.a. 14 minutes (from cold start each time).

Let's hope that helps users of fake iLotus

[nesnet]

I just received two HEOL GT-88 boards to rehab an ailing Symmetricom S200 and S300. They are plug & play... and currently I have them running into a Symmetricom antenna mounted in a closet (with no view of the sky), through a Symmetricom 1:2 splitter. They are both receiving 5-8 satellites consistently... this will improve as soon as we move them over to the outside antenna. Very sensitive receiver.

The two boards saved us a ton of money... because the manufacturer's response to mitigate the issue was "buy new time servers, they are not upgradable" -- at a total combined cost of nearly $12,000 (configured to our requirements).

Dealing with HEOL was a pleasure. I received excellent advice from a very knowledgeable individual (all through email), the boards arrived promptly in six days from order date via USPS (allowing two days for U.S. Customs processing in NY), took less than five minutes to install - and synced up quickly. We are working on another project - a Symmetricom ExactTime (ET-6000). They have a solution for that too, and the board was just shipped.

We have our Network Time Servers back at a fraction of the cost of replacing them with two new units. I didn't know HEOL existed prior to reading your post. Thanks.

[dj831]

You're welcome

Note that these devices (S200 & S300 series) ***could*** be affected by 2038 bug, AKA Y2KE38 superbug or Epochalypse (source: Wikipedia): date is coded on signed 32 bits. When clock reaches 03:14:08 UTC on 19 January 2038, there is an overflow (011111111 11111111 11111111 11111111 to 10000000 00000000 00000000 00000000), and clock displays 13 december 1901). This is a known bug of Linux, as it obviously uses Unix time representation.

I'm absolutely unsure about this, as I do not know how date is coded inside S200/300 series, but I doubt that Symmetricom wanted that their devices would last that long

Perhaps that's a thing that I could ask to EHOL, sine they knows very well these series, and have a GPS simulator.

[nesnet]

Now I have one more thing to worry about.

HEOL never disclosed a possible 2038 bug that would impact my equipment. So let me understand, in 14 years from now, I'll have to purchase another board from them? Outrageous. They should have disclosed this theoretical failure prior to the sale. I think I should withdraw my strong endorsement of their product. This GT-88 upgrade board is going to fail in 5,330 days?

I'm going to be very annoyed on January 19, 2038... when I demand a full refund or replacement board.

Thanks again, for the heads up on this egregious oversight.

Seriously, I hope the word gets out about their products. They do a great job, and I'll wager that a lot of people could save a collective truckload of money upgrading their Symmetricom (Microsemi) boat anchors.

I wonder how other vendors are handling this? I know it's not a great sales tactic, but disclosure that an upgrade path exists would have been appreciated and helpful. Imagine companies or government agencies with 20+ time servers being told to scrap them and start over. I do know that EndRun Technologies provides an upgrade service for their GPS-based products. We had two Meridian units factory upgraded.

[dj831]

Hi, no, this is NOT your EHOL card that may fail in 2038 - yours shoud last 'till c.a. 2044, i.e. rollover issue common to all GPS - but your S200/S300, due to the way it was programmed (Unix time). That being said, EHOL is one of the too few manufacturers that offers a reliable fix to GPS bug: redesign of the M12 board. Furthermore, they are fully able to fix their GT88 firmware, since they built it (unlike Furuno GT-8736)

There are Linux genious in that forum that own S200/S300 too, let's hope that at least one may answer that question. Meanwhile, I'm gonna ask O. Descoubes (EHOL) if he did the test with his GPS simulator.

---------

Edit: sorry, I missed your humour - a problem when you're not a native English or American  . But seriously, I still ask O. Descoubes and I let you know. And true, they do a tremendous job!

[nesnet]

Olivier is the person I communicated with (and is also solving my Symmetricom ExactTime ET-6000 problem). Very knowledgeable individual, who answers email in real-time. Does he sleep? I'm in NY, sending him questions at 5:30p and he answers. Isn't it 11:30p there?

Or is Olivier an AI bot?

[dj831]

Hi again, I've just asked him the question. And I asked him too if it is possible to change time system to another one (Galileo for example). And no, it's 19:23 here (GPS CET time )

[nesnet]

We have a Symmetricom S300 with Amazon Alexa built-in (it's a $2000 factory option). When I asked it for the time in Paris, it gave me the wrong answer. Maybe it's the new board.

Does anyone know what the latest software build is for the S300? I contacted Symmetricom a/k/a Microsemi and no one ever got back to me (what a surprise). It is currently at 2.80.1

Incidentally, I have a rant about your country. The last time I was in Paris (July 25, 2019) it was 107 degrees F (41.6 C) with at least 150% humidity. All the major roads were barricaded because the Tour de France was arriving the following day, and your President was attending. Military personnel on every corner. Not very tourist friendly. Spent three glorious weeks in your country that year, return every couple of years.

[dj831]

Hi, glad that you liked France But what often foreign people say about our country is that France is lovely ... apart French people (Yes, we could be much more friendly with tourists and foreign people . Sadly, it is much worse in Southern France - and not only with foreign people

About software for the S300, version 2.83 was uploaded to Google drive (user TheWizard). I cannot hely you further, since I own an S200 (OXCO upgraded) and an S250 (Rubidium factory installed).

Bonne journée !

[dj831]

Hi Nesnet, I confirm: Olivier is NOT an AI bot, he gave me a 'real' answer He (the HEOL team) tested their own servers only, and not the S200/300 series. That being said, if I had to purchase an NTP / GPS time server, I would probably purchase it from HEOL, just because they offer a real support unlike some companies (any resemblance is purely coincidental  ).

Interestingly, he sent me the Furuno GT-88 specifications protocols: the eSIP, of course, but also the M12 that I was not able to find on Furuno' site (or I was too tired/lazy/whatever else to be able to find it). I may be able to test some day the Galileo reception of the GT-88 or whatever that does not have a 10 bit week date coding, i.e. whatever else than GPS protocol.

Hence my question: is there someone browsing that topic owning a GPS simulator would be kind enough to test an S200 or S300 beyond january 2038?

Thanks! 

[nesnet]

How do I access 2.83 on his Google drive? I appreciate the information about the update availability. Thanks.

If it is confidential, pls PM me.

[nesnet]

I have heard, for years, that the French had no use for tourists... particularly Americans... an attitude I have never encountered on many business trips -- and a few vacations. It all depends on how you interact with people, IMO.

I can tell you that it's easier to communicate with French citizens than it is to get information from the U.S.-based micro semi company that manufactures network time servers. If you're fortunate enough to get a human to respond, it usually results in why they can't help you, or that the minimum factory charge is $1,000 [USD] for anything... and that you need to submit answers to about a hundred questions to use their website... ultimately to be turned down.

I was, formerly, a big supporter of their products -- and encouraged a number of colleagues to purchase them. That ship has sailed.

[dj831]

Hi, really sad to see that such big companies are so proud not to condescent to 'loose their time' to speak to individuals. Despicable attitude, IMHO.

Anyway, we are lucky enough that Eevblog exists, a place where information is not kept private and hidden from 'allmighy gods' in these companies And since data is shared by everyone to everyone, here's the link from previous page: https://drive.google.com/drive/folders/1fY7BdK7xM6wBncqCQfSFv5qZsb5m014i. The file was not shared by me, but by TheWizard (credits to him).

Hope it helps

[nesnet]

Thanks.

Just received two Symmetricom XLi SAASM (Govt spec'd) anti-jam GPS receivers. Haven't had a chance to evaluate them yet. Information is not forthcoming from the manufacturer, and very little data is publicly available. More to follow when I dig into them.

They were likely very expensive when new. It's a XLi on steroids. Complete with HTTP screens that are marked in red "Official Use Only".

If anyone can provide information, it would be appreciated.

[testpoint1]

I have the Force 22E, there is no week rollover problem for it, you just test it if exists the problem, others no need to care, it is not for Civilian use.

[JoeFloyd]

If anyone is looking for a reasonably price active L1/L2 GPS antenna, this E-Bay listing has such an antenna listed for a reasonable price.  (< $30US)   The Antenna is an Antcom 1g1215a-xsc-1-pc-RoHS-G which says that it is tolerant of LNA voltages from 2.5v to 24v.

https://datasheet.datasheetarchive.com/originals/crawler/antcom.com/9ec044cf132c90fd9bd7bbcf3b40c318.pdf

This antenna has a female SMA connector.

https://www.ebay.com/itm/324689951643

This is not my listing so buy at your own risk.

[DavidKo]

Some experience from my side. The device I have bought was without CF card. I can confirm, that no-DMA card is necessary. But double check the datasheet. Mine from Mouser Apacer *-NRG was according to description non-DMA which is not true. It need to be *NDNR* - but I cannot confirm that it will work. Other option is Delkin CE51TQMF3-F1000-D, today 9pcs available only in Newark US shop ~USD28, but their EU price 109EUR is a bad joke (F1 should be for non-removable, non DMA - datasheet available at Digikey). So I have kept searching and found Delkin CFX01GE8D1-DAAEG00 on ebay - I checked the photos of Delkin cards  and found one that seem to be OK, no remarks in description. I can confirm that this 1GB type works(datasheet).

I have replaced original GPS with HEOL. The antenna I have bought from Ali.

I want to try add OCXO, but I was not able to find Vectron MC597X4-040W. Do someone have the datasheet for Vectron or experience with different OCXO type? The pin layout seem to be common type, so different manufacturer OCXO can be used.

[tverbeure]

I was able to buy a pristine S200 at the local flea market and I'm trying to do all the upgrades that have been described here.

It came with the 1.26 software version, and it uses an AMD Geode processor board.

The Good:

• Making a copy of the 512MB flash card to a $14 white label 512MB "Industrial" flash card from Amazon was not an issue at all. I bought this one: https://www.amazon.com/dp/B07HL5F1VX
• It was also no issue to install version 1.36. Many here in this thread mention that v1.36 requires a special sized flash card that's a little bit larger than 512MB. For some reason, that's not the case for me.
• I was able to get root ssh access using the instructions earlier in this thread.
• The GPS sees either 9 or 10 satellites.

The Bad:

• The unit comes with a GT-8031H GPS module, so it has the rollover bug problem.
• It took ages to get GPS to work. There might be some bad contact somewhere? It's working fine now, but before it did, I get "Timing GPS Source" alarms, which pretty mean that the GPS module wasn't working at all.
• It never goes into "Status: Locked" state.

What I did different: I used Linux instead of Windows to do all operations. No need for HDD Raw Copy, I just used "dd" to archive the flash card file system. Also, when I plug in the flash drive in my Linux machine, I can access the file system as if it's native. It looks like this at the root:

tom@zen:/media/tom$ ll
total 13
drwxr-x---+  7 root root 4096 Mar 17 11:57 ./
drwxr-xr-x   3 root root 4096 Jul 14  2021 ../
drwxr-xr-x   4 root root 1024 Dec  8  2010 _boot/
drwxr-xr-x  18 root root 1024 Dec  8  2010 _fsroot1/
drwxr-xr-x  18 root root 1024 Dec  8  2010 _fsroot2/
drwxr-xr-x   2 root root 1024 Jan  2  2006 _persist/
drwxr-xr-x   2   99  503 1024 Jan  2  2006 _tmparea/

And when I do "sudo du -m -s" there, I get this:

tom@zen:/media/tom$ sudo du -m -s .
[sudo] password for tom:
140   .

So the flash drive contains 140MB. Again, I don't understand where that 512MB-is-not-enough issue was coming from?
One thing I did notice: when you upload the wrong file to upgrade (e.g. when uploading the .zip file instead of the .tar file), then that file won't get deleted. You can either delete it through the web interface, or, when logged in as root, by deleting all the files in "/mnt/upgrade".

Going to the biggest issue: the status remains in "unlocked mode". Any idea why that's might happen? How long does one typically need to wait until you're getting into locked mode? My TM4313 GPSDO goes into "track" mode after a few minutes. Maybe this thing needs a much longer time?

I'm using a Symmetricom 150-615 down/up converter (https://www.microsemi.com/existing-parts/parts/138272#overview), but I don't think that should matter.

Attached are some status screens...