Symmetricom S200 Teardown/upgrade to S250

[SoundTech-LG]

Interesting those shell hacks...  spent considerable time with and got nowhere. Not sure if it is a user error or what.

[AlexJackson]

An update on my s200 'upgrade'. Didn't go well for the main reason for the upgrade, the OCXO. I ran into a few 'issues'.

The installation of the new BNC jacks went well, and the holes drilled ok with my old half-dull step bit. I haven't verified the signals yet until I verify the device comes back up with a good lock.

I couldn't cleanly remove the solder from the center pin on the OCXO (pin #2) with a de-soldering bulb (suck or blow). There was something stuck it so I had to use my fine point iron, get it hot and push it through the hole. I did get some crap out of it that didn't want to melt with my iron. That process took 30 minutes. I did get the new oscillator installed. Jumped R121 with jumper and installed a jumper on J3. The whole installation the new oscillator took me 2 hours with all the cascade of issues I encountered with my iron, soldering station, finding my stuff (it was all moved, and I don't have a true "bench"). Lots of running around involved.

Turns out my card reader is messed up so I cant use the 1.36 image to flash the new image to the CF card and I don't own a programmer. Unless if someone knows how to do the root hack with v1.10. (none of the hacks discussed work on 1.10).

updates:
1. The inputs & outputs work great and the system indicates lock when I do a loopback.
2. Turns out, the cord for my card reader was shot, and my partner had an old cord that fit. I was able to image 1.36, and bust out to a terminal and run seeprom to change the oscillator type.

Without J3 jumped, even when set to the OCXO in seeprom, it will show TCXO in the interface and in ssh. Once J3 is installed it shows as OCXO.

So in the end, the upgrade was a success, but v1.36 still doesn't work properly with my vfd and shows several issues. Unless someone has another version of the OS I'll have to remain on v1.10.

[notfaded1]

I never had VFD issues with the 1.36 version that's really strange problem for sure.

[AlexJackson]

Strange indeed... So today I swapped cards and changed the model type from S200 to S250 (since i now have the I/O jacks) and the VFD and status pages on the VFD are still acting strange.

Whether or not if I have a GPS lock, it will show on the first line, "REF:           " & on the second line, "NTP Stratum 1". Sometimes I'll see "REF: Pkt Err" flash frequently on the VFD. The Sync LED will swap between red & green as well as the "Alarm" LED. Even when the Alarm LED is red, no alarms show on the admin page.

I've messed around with it a lot today, and havent been able to suss out whats going on. I'm going to guess my device has some older hardware that the new firmware doesn't like, or the firmware updates also updates firmware on the peripherals such as the VFD.

[TheWizard]

This thread is getting old, but, was very helpful in getting some older Symmetricom S2xx units up and running, so I thought I would summarize and consolidate everything I've learned here.

The key upgrades for most of these units will be software, Vectron MC597X4-040W OCXO, and an upgraded I-Lotus M12MT/IL-GPS-0030-B GPS receiver board.

To install the Vectron OCXO, purchase from ebay or elsewhere, and solder the oscillator in place on the main board. The board is multilayer FR4 glass/epoxy, so you have to carefully put some heat into soldering the OCXO pins to get good connection.  Then bridge R121 with solder to connect the OCXO 10Mhz output and put a jumper on JP3 to disable the TCXO. Ssh into the unit over lan-1 with admin and enter the following command: root eng sys cat "/dev/null && bash"

CD to the /sbin folder and run: ./seeprom

Select option 38 and set oscillator type to 1 for OCXO (0 is TCXO, 2 is X72 Rubidium Osc).  Then select option 4 to update checksum.....this must be done. Type "exit", then type "reboot".  If your firmware also needs updated, you can avoid updating the eprom by simply installing the OCXO first, then running the software update from the web gui.  This will automatically scan the system and set osc type automatically.

The factory Motorola/Furuno/M12 GPS board has a rollover date in September of 2022. The I-Lotus (IL-GPS-0030-B) is a direct compatible replacement and costs $65 and is good for 20 years from the date of the sticker on the board. Simply remove 4-screws and swap the boards.

For software upgrades, 1.36.1 from 2015 is the latest firmware for S2xx units.  Firmware upgrade files along with a complete 1.30 runtime image that will fit on any 512mb flash card are included in the link below. These avoid the previous issues of odd-size/too small flash card.  The upgrade files are untouched with matching SHA-1 checksum and should work on any S2xx unit with a factory 512mb flash card.

Symmetricom Files

*** Files link updated 7/9/21 to publicly shared Google Drive ***

[deepskyridge]

Anyone found a good source for the new iLotus GPS board. I have not been able to find one.

Thanks
Gary

[wje]

I was overjoyed to find this topic, useful information on these is apparently scarce. There are some S250's with the 48VDC supply input showing up on EPray recently, I snagged one.

Mine came with V1.30 installed. I immediately did a hardware mod to supply 5V to the antenna instead of 12V. It's a pretty trivial change, if anyone is interested, I'll post details.

I'm installing a Vectron ocxo, just came today.

One issue, I tried upgrading with the 1.36 update distribution above, not the image, but the actual upgrade file. It fails, logs say 'incorrect hardware version'. Anyone have any clues about this? Meantime, I'll try the image route when I add the ocxo.

BTW, this unit is really easy to hack Linux-wise. I'm surprised Symmetricom didn't lock it down more. Really, a 'settings backup' that's a straight tar of various Linux dirs? But it does make hacking a lot simpler.

Bill

[wje]

Update - neither the 1.36 upgrade path nor the 1.36 image posted here on a Delkin CF work. The image starts loading the OS, then hangs. Guess I'm stuck with 1.30. Status page reports 'Authentic AMD Geode ... 500. This is one of the x86 clones they got from National Semi. Not sure what mfg date is, random stickers inside the box with fairly high rev letters (G, H, etc). Hardware clock version is 1.83. Running sw version is pc_target.chronos.1.667.13.1551430. Any help appreciated. OTOH, ocxo is working fine.

Bill

[SoundTech-LG]

Did you try resetting to defaults first??? Worth a try.

[wje]

Oops, pilot error. The upgrade tar applied fine once I figured out that when the manual said "don't uncompress the tar", that didn't mean "don't unzip the zip file with the tar in it". Duh. Bare tar updated fine. So, I'm now in the ranks of S250 owners with an ocxo upgrade, root login via ssh, and V1.36 sw. Sweet.

[deepskyridge]

I don't seem to be able to get the root hack to work. When I try SSH login it does not know about user root.

I have tried at least twice.

Gary

[TheWizard]

You cannot ssh directly with root user.  Ssh first to the lan-1 IP address with the same admin user/pass credentials as the web gui. Once logged in then enter: root eng sys cat "/dev/null && bash"

The iLotus GPS board can be purchased with credit card from Synergy Systems in San Diego Ca.  https://synergy-gps.com
Part# is: IL-GPS-0030-B

As posted above, the gui firmware update files in the link have to be first unzipped, then apply only the rar file.   

[notfaded1]

Looks like I need to work on my stack of S200's again some more!  This image that will fit on more of the many cards is big plus thanks for linking to a version that can fit easier. 

Bill

[deepskyridge]

Wizard, thanks for the information.

I have my 200 upgraded and working.

Gary

[TheWizard]

NP

To clarify, the linked 1.30 firmware image can be burned to any 512mb CF card (I also tested a few 1gb and 2gb cards and they worked fine) using the included RawCopy tool.....no need to fool around with the weird sizing issues in earlier posts.  For those that obtain S2xx units with dead/missing CF cards, this is needed to get the system booted.  The 1.30 firmware image was copied from a brand-new S250 as a backup. 

From a security perspective, there is no way to verify the integrity (I assure you it's clean) of the 1.30 image I provided, so after getting a S2xx booted it is important to unzip the 1.36 firmware package and use the gui to apply the tar update file. If you have a MicroSemi/Microchip support account, you can verify that the MD5/SHA1 hashes in the zip files are legit and the update tar files are untouched. 

These units run a fairly old version of Linux that has not been patched in quite some time.  However, the way Symmetricom designed the OS is highly customized/specific to their use and hardened in ways that are not dependent on file patching, so I would not worry much about attack surface. 

When a firmware update is run from the gui, the process exchanges private encryption keys which invoke secured check scripts that parse root for cleanup, file signatures, permissions, and other security details.  Anything "extra" in the system gets cleaned out or overwritten during upgrades, so if you have these units providing NTP services to public clients, it might be advisable to periodically re-run the 1.36 update.

I also included the latest S3xx firmware update file in case anyone also has one of those units. Cheers. 

Symmetricom Files

[SoundTech-LG]

Just found one of my CF cards with V. 1.36 on it that is only 510MB easily fitting on the 512 CF cards.

Here it is...   https://www.dropbox.com/s/3g2oi29c4k91afp/V.%201.36%20510MB.imgc?dl=0

It has the Default login credentials except Symmetricom is with the UPPERCASE S
Hope that saves you a few steps!

[SoundTech-LG]

I added another image file for v. 1.36.  This one is completely factory defaulted. When you default the unit, the file size on the card grows to the max size of the CF card. (is that a feature???) This CF card is 512.48 MB. Still possible that a lot of CF cards are at least that big.
So here is the link... 
https://www.dropbox.com/s/p4emcefkge7ipj8/V.%201.36%20Defaulted_512.48MB.imgc?dl=0

[keitho]

I was overjoyed to find this topic, useful information on these is apparently scarce. There are some S250's with the 48VDC supply input showing up on EPray recently, I snagged one.

Mine came with V1.30 installed. I immediately did a hardware mod to supply 5V to the antenna instead of 12V. It's a pretty trivial change, if anyone is interested, I'll post details.

I'm installing a Vectron ocxo, just came today.

One issue, I tried upgrading with the 1.36 update distribution above, not the image, but the actual upgrade file. It fails, logs say 'incorrect hardware version'. Anyone have any clues about this? Meantime, I'll try the image route when I add the ocxo.

BTW, this unit is really easy to hack Linux-wise. I'm surprised Symmetricom didn't lock it down more. Really, a 'settings backup' that's a straight tar of various Linux dirs? But it does make hacking a lot simpler.

Bill

Please post details on your 5V antenna mod!
I just got two s200 units that I intend to use as NTP servers for my network, and I would prefer not to have to buy $300 antennas if I don't have to.

[JoeFloyd]

I have a couple Symmetricom S200 devices which I've updated with GT-8736 GPS/GLONASS timing receivers.  The GT-8736 is drop in replacement for the Motorola M12/M12+ GPS boards which no longer work due to GPS week roll-over.  The software running on the S200 is the latest available.

The GT-8736 are much better GPS receivers than the GT-8036 receivers which were installed by Symmerticom.  The GT-8736 see 10 GPS satellite while the GT-8036 would only see two or three.  I now get valid GPS time and show GPS lock. 

Even with GPS lock I neve see the Hardware Clock status go "Locked".  It is always unlocked and the clock is not updated by GPS.  NTP does update the clock.


I added BNC connectors to the S200 for IRIG, 1 PPS, and 10 MHz and have tried feeding IRIG-B time and date info from an upgraded Symmericom S300-R to the S200.  IRIG shows locked, but once again the hardware clock is never updated and shows "Unlocked".    I'm not sure if I have something configured wrong on the S200, but the same basic configuration works on the S300-R.

A second issue is that upon adding an OCXO and jumpers on JP3 and R121 the S200 (hacked to S250) will sometimes automatically detect the OCXO and update the oscillator setting in the EEPROM, but the 10MHz frequency never reaches 10MHz.  It it always 100 - 1000 Hz off.  The OCXO in the S200 stabilizes at a frequency that is never exactly 10MHz when measures against the 10MHz output form the S300-R (hacked to S350-R) or a Chinese GPSDO which agrees with S300-R to within .001Hz (relative phase drift measurement).  An new exact part VECTRON OCXO as installed from the factory is being used.   I haven't tried looking at the control voltages being generated to adjust the OCXO.  Upon power cycle of the S200 the OCXO appears to not startup or not startup fast enough and the software shows the oscillator type as Unknown.  This also seems to impact the GPS receiver and the GPS receiver is shown as Unknown whenever the oscillator is not detected.

I have removed the OCXO since I was able to track down a couple Symmetricom X72 rubidium frequency standards (used). 

In order to install the X72, I used a break-out board that is being sold by an EEVBLOG member.  There are only six pins to connect.  I haven't been able to find a pinout for the connector on the S200 mainboard, but photos of devices with rubidium standards installed and the cover off gave me enough information to figure out the pins.  When the X72 is installed, the R121 should be unpopulated.  Only J3 should be installed.   The S200 hacked into a S250-R with X72 rubidium does achieve and exact 10MHz output.  The control loop of the S200 appears to be functioning as expected but the rubidium oscillator has 10x the phase drift than the S300-R, and the darn Hardware Clock always remains "Unlocked".  This should only impact NTP and IRIG as far as I know. 

Does anyone have any idea what is going on? Even if the GT-8736 is doing something weird, I would expect the IRIG-B time source would have set the hardware clock.  Is this a software issue?  It would seem so.  The X72 rubidium frequency is exactly 10MHz which is pretty good proof that the FPGA is steering the oscillator.   

Since my goal is to have a working commercial GPSDO I don't have much more I need to do, but it would be great if the OCXO worked as advertised since the X72 rubidium standards have a limited life, are out of production, and the ones I can afford have thousands of hours on them.


FYI, the S300-R I've hacked into an S350-R also had the GT-8036 GPS board and failed GPS lock.  This was replaced with a GT-8736 and I now get GPS lock without any issues.   Unlike the S200, the S300-R does show hardware clock lock.  So, the Gt-8736 does appear to be a drop in replacement and works great in the S300.

Unfortunately, the GT-8736 is out of production and I can't seem to find any for sell.   I paid ~$50US for each GT-8736 from a UK parts distribution company.  A few years ago, several people on the timenuts mailing lists did a group buy of the GT-8736 receivers for ~$25US. 

-----

Just in case anyone is interested.  While I had the GT-8036 board installed in the S200 I decoded the serial data stream from the GT-8036 and the Motorola protocol which reports GPS status @@Ha would never show a valid date.  It had the correct time, but the date was completely wrong with too many Zeros.  I believe this is why the S200 would not accept the time and date information from GT-8036 regardless of the mode of the GPS receiver and having 5+ satellites in the timing solution.  The TTL serial data in Motorola binary format  is not hard to decode.  It should be possible to use something like an Arduino or PIC with two UARTS to sit between the GT-8036 and the S200 and patch the @@Ha message to insert the correct date information using a battery backed clock. Since this only updating the date, it doesn't need to be all that accurate as long as the date is set correctly when the time goes past GPS midnight.  I mention this because the replacement M12/M12+ boards are $400US.  If the date is the only thing wrong with the GT-8036 boards it would be worth making a custom Arduino board to intercept and update the serial data.  This is just an idea to fix the GPS Lock issue cheaply.

The GPS Week Rollover issue doesn't impact time or the 1 PPS signal generated by the GT-8036.  The S200 only uses the 1 PPS signal to control the TCXO/OCXO/X72,  so there isn't anything hardware wise that I'm aware of that should care about the GPS date.  The FPGA should only care about the 1 PPS, but I'm pretty sure the software tells the FPGA when GPS lock has occurred and the 1PPS is valid.  Without a valid date, the software never tells the FPGA the 1PPS is valid. I haven't actually tested when the control loop starts steering the oscillator, so take that with a grain of salt.

----

S200/S250 P3 - Rubidium Oscillator connector pinout

From inboard to outboard

1 -  Service / End of Life Pin
2 -  C-field / Frequency Adjustment
3 -  Vpos / 15V
4 -  Vneg / GND
5 -  Vneg / GND
6 -  10Mhz Sine / RF out

The breakout board I ordered matches the pinout from the Symmerticom X72 manual

http://www.rdrelectronics.com/skip/nov/X72.pdf   See page 54


See

Here is a photo of the breakout board.  It has the same schematic as the Symmerticom breakout edge connector board.

See

The pins which are used on the X72 edge board connector are

4  -  Service / End of Life Pin
5  -  C-field / Frequency Adjustment
1  -  Vpos / 15V
7  -  Vneg / GND
8  -  Vneg / GND
16 -  10Mhz Sine / RF out

[testpoint1]

today I also tear down a Rb version of S200, if you just need the 10MHz port, no need to do so many things, just connect a BNC/MMCX cable to X72 interface board. and install the BNC connector to the rear panel.

[JoeFloyd]

Having the NTP, IRIG, and 10MHz out all working is my goal.  All of that works, but the software controlled hardware clock status remains in the unlocked state when using GPS or IRIG.  I can't explain why since the hardware clock is updated to the correct time by the NTP client software and matches what I can read from TTL serial output from the GT-8736.    I haven't tried decoding the IRIG data, but I assume that the S300 hacked to S350 with IRIG outputs is doing what it should.  The S200 hacked to S250 with IRIG inputs locks to the IRIG data which includes date and time information.  But, again, the S200 with IRIG inputs never shows the  hardware clock as locked even though the IRIG status shows locked. 

The GPSDO of Chinese origin is plenty accurate with minimal drift when GPS is locked.   If all I wanted was an accurate and stable 10MHz, the Chinese GPSDO is fine.  If I want to compare frequency standards in order to confirm that the standards are working as expected, I do need independent standards. 

Why do I care?  No good reason other than falling into the rabbit hole of metrology and the physics for cesium and rubidium standards allows me to clear the cobwebs that have formed since I received my physics degree back in the 90s. 

[testpoint1]

Having the NTP, IRIG, and 10MHz out all working is my goal.  All of that works, but the software controlled hardware clock status remains in the unlocked state when using GPS or IRIG.  I can't explain why since the hardware clock is updated to the correct time by the NTP client software and matches what I can read from TTL serial output from the GT-8736.    I haven't tried decoding the IRIG data, but I assume that the S300 hacked to S350 with IRIG outputs is doing what it should.  The S200 hacked to S250 with IRIG inputs locks to the IRIG data which includes date and time information.  But, again, the S200 with IRIG inputs never shows the  hardware clock as locked even though the IRIG status shows locked. 

The GPSDO of Chinese origin is plenty accurate with minimal drift when GPS is locked.   If all I wanted was an accurate and stable 10MHz, the Chinese GPSDO is fine.  If I want to compare frequency standards in order to confirm that the standards are working as expected, I do need independent standards. 

Why do I care?  No good reason other than falling into the rabbit hole of metrology and the physics for cesium and rubidium standards allows me to clear the cobwebs that have formed since I received my physics degree back in the 90s.

I also strange that hardware clock always in "unlocked" status, I checked the white line of No.5 within P3, when the X72 is unlocked, the voltage is high (5V), when X72 is locked, the voltage should be turn to low (low than 0.3V), but still 1.15V; when I disconnect the pin from X72 to S200 motherboard, in the locked status, the level is exact 0V, I only have one S200 in hand, not sure it is X72 or S200 motherboard problem, or design problem.

[dj831]

Hi all, my two cents on that (old) topic ... I found an S250 with a rubidium clock inside, sold as working. Of course, no surprise: no GPS sync. Here's what I did ...

• Firmware upgrade. Either I was extremely lucky, or I don't know, but it was a strightforward process. I did it in a totally different way, knowing my level of competence about Linux (close to ground level), as I did many years ago for a Lantronix server. I used WinHex and made a raw copy to save original Flash Card, a Delkin Devices CFX512I4G1-DAAEG00 with v1.26 running on it. I took the first 512Mb card I had, a 512Mb Sandisk SDCFJ, I restored the image, and voilà, it worked like a charm. I then performed the upgrade with the tar file found several posts earlier, and done, v1.36. I Did the same on the original flash, same result: S250 runs on v1.36

• Power supply. Not an upgrade in itself, but I noticed that it is nearly indentical of those found in old Cisco 2500/2600/1800 routers. Note though that if your symmetricom supply fails and you want to use one of these Cisco power supplies, you need to keep casing, and simply swap electronic board (it misses drilling on cisco supplies). Note also that it won't work for rubidium version, since 12V rail wattage of Cisco supplies is lower than wattage of Symmetricom supply

• GPS module. I performed tests with the original Pentair (GT-8031) module here: https://www.eevblog.com/forum/metrology/symmetricom-syncserver-s350-furuno-gt-8031-timing-gps-gps-week-rollover/. That module will never work again in an S200/300. The only way that could perhaps make it work again would be to intercept ZDA frame sent by GT-8031 (TX) to MSP430, and replace date (2003 for example) by adding rollover offset. It would need an extra microcontroller handling one COM port (RX from GT-8031, TX to MSP430). BTW too much complicated. Thus, I ordered an HD-8736 module from EHOL Design thru eBay (the easiest way, even if I'm in France too). Their module is the Furuno GT-8736, modded with an extra regulator to make it work on a wide range of devices (3.3V or 5V). The module was slightly to tall, but issue was easily solved by adding 2.5mm washers between standoffs and module. It works, but you must set 'dynamic' mode in References/GPS menu. Note that they purchased the very last stock of a distributor, hence the availability of the module still in 2023. Important notice: rollover of the GT-8736 is in 2032.

• Antenna. Finding a 12V antenna is a nightmare. I purchased back in 2016 a PCTEL GPS-TMG-HR-26NCM (26dB GPS Timing Antenna). Datasheet rates it for 5V, but usable till 12V. It works like a charm. For those wanting to use a 5V only antenna, be aware that power supply of antenna is not managed by Furuno module, but by an LT4254 on the main board. You can't change supply of that component, since its minimum supply is a bit above 10V. You could though try to use a 6.8V/1.3W zener diode in series with L1 inductor (27µH), to lower voltage of antenna without impacting the LT4254

I've attached some pictures, if it helps 

[NA5WH]

Good day.  I've had my modded S200 running for.... feels like ever now...

One problem I've had off and on was that periodically the front display would be garbled. I don't seem to have a picture of that at the moment, but it was fairly short-lived and infrequent, would last half a day or so and be fine for many days.

Last week it went bad. I am so used to looking down and seeing the current UTC time and after coming home from work it was frozen display with a time hours old at that point. Unit was completely unresponsive to front controls (LEDs still work, NTP light comes on etc).  Verified that web and ntp on it were still going fine (they were/still are), and while I don't have anything serious on my 10 mhz loop, my RS sig-gen still thinks its getting a good 10 mhz...  so left it to sit thinking it would come back after a few days. No luck.  And ending a year+ uptime, I powered it down, and back up... front panel display and controls worked fine (but of course usual wait for it to be totally happy for gps lock etc). But next day I get what is shown below (something half-way between two different messages), and again unresponsive to front panel buttons but LEDs are fine. Its now been another day and still showing that.  I assume there must be some chip controlling the VFD and controls that is likely to blame. Just curious if anyone run across this before that might save a bit of troubleshooting time on it.

Only other mod I have on it is replacing the original GPS with an "i-lotus" IL-GPS-0030-B in May 2021.  I didnt seem to have any issue with the Sept 2022 issue.

[dj831]

If you need to replace your VFD module, it is orderable from Farnell, with different firmware, if it helps (Farnell code 1495427, with a deadline of 19 weeks). But do not forget to check power supply capacitors first (or replace supply with one removed from a Cisco 2500/2600/1800 router, if you don't have Rb oscillator).