A look at my Symmetricom GPSDO / 10MHz reference (OCXO + Furuno receiver)

[ve7xen]

Hey ve7xen, would you mind sharing some more info on what have you tried with the firmware?

In the Samsung case, it's an AVR32 (UC3), which Ghidra seems to support.

Yeah, I've decompiled and tagged some sections of the code, figured out the command parser and handler table (their implementation is pretty funny, to support SCPI abbreviations they just duplicate the command variants and do simple string matching, so there are like 16 copies of the same command in the table). Also mapped out most of the AVR32 peripherals. The biggest problem Ghidra seems to have with it is sometimes the disassembler gets a bit tripped up and it gets out of sync due to there being 2-byte and 4-byte instructions. It also sometimes thinks pointers are instructions, which can really mess up the interpretation. It's not magic, and requires human effort unfortunately.

It's quite a bit of work doing the archaeology to find meaning in the stream of instructions. You need to kind of start to work from known starting points - certain strings that are part of code you are interested in, the entry point, peripheral register accesses etc. and work out from there following references and function calls labelling stuff as you go. If you don't have the memory map correct, it will make no sense at all, most calls are indirect.

I do plan to post my Ghidra work when I feel like I've finished with it.

[wkb]

I have not had time to really dig into the Trimble but the chip that I think holds the code is a ballgrid of some sorts(?). Does not help

A plain 'strings' on the image might be interesting to know which commands exist.

Wilko

I've pretty much broken this completely open now. There are quite a few undocumented commands in both the main CLI and the debug one. I'll work on documenting all of them soon.

Also, something I did poking around is now causing my previously-working module to get pegged in EFC Exceed, and it is now clearly off frequency, so be careful... still haven't quite worked out how to get it back, if that's possible.

I also have a non-working Trimble module kicking around, might give ripping the image a try, but I don't think it will be very fruitful due to the TMS320. Ghidra at least doesn't support it. Maybe some basic analysis would find something.

[thinkfat]

Over the last couple days I received some requests for the UCCM connector board I made. I've uploaded my KiCAD project to github, you can find it there: https://github.com/thinkfat/uccm-connector

I hope it can be useful to some of you. If you want to recreate it, there's a folder with the Gerber files and a README with a partial BOM with the "interesting" parts. I've not listed all the parts, but there's an "interactive BOM" that can help you with ordering and assembly.

The board has a switching regulator that you can feed anything from 7V to 30V DC through a 6mm DC barrel jack that should fit a 5.5mm/2.1mm connector. The regulator should be able to source at least 2A with the components chosen. Before you hook up your board it'll be prudent to first check and adjust the output voltage of that regulator. Most UCCMs are happy with 5.5V.

The board should be fairly easy to assemble, but maybe not for a beginner. It's mostly SMT parts but nothing smaller than 0805. I recommend using a hot air station at least for the LMR14030SDDAR, make sure the center pad is well connected, this is where the heat goes.

The real challenge is the FPC connector, though. It is a real PITA. Use plenty of lube flux.

[wkb]

This is the Trimble PCB. The ISSI chip is a high-speed 16 bit wide SRAM.  Guessing that the MX is flash or so?

I have not had time to really dig into the Trimble but the chip that I think holds the code is a ballgrid of some sorts(?). Does not help

A plain 'strings' on the image might be interesting to know which commands exist.

Wilko

I've pretty much broken this completely open now. There are quite a few undocumented commands in both the main CLI and the debug one. I'll work on documenting all of them soon.

Also, something I did poking around is now causing my previously-working module to get pegged in EFC Exceed, and it is now clearly off frequency, so be careful... still haven't quite worked out how to get it back, if that's possible.

I also have a non-working Trimble module kicking around, might give ripping the image a try, but I don't think it will be very fruitful due to the TMS320. Ghidra at least doesn't support it. Maybe some basic analysis would find something.

[lamaral]

That MX sure looks like an EEPROM. In a quick Google search, MX seems to a somewhat big EEPROM manufacturer, but the P/N seems to be a custom one on this IC

[Bad_Driver]

Happy New Year to all,

after some weeks of waiting I got yesterday from the Chinese reseller a second board as replacement for my broken UCCM-GPS-receiver
for free (only postage 80ct).

He announced a board in worse condition with broken SMDs but I got a pretty good looking one. At first glance nothing broken but someone
has had it in his hands  - you see the soldering on the fuse for 5V and the replacement of a SMD cap on the converter board.
May be some one from this board owns it before? 

I hope to get one working but unfortunately I'm because of all the 2nd lockdown efforts a little short of hobby time 
It will take some time to do further investigations.

btw: I got from Aliexpress for less money the breakout board and the cable for this small 50pin connector. If someone is interested I can provide the links.

[wkb]

Happy New Year to all,

after some weeks of waiting I got yesterday from the Chinese reseller a second board as replacement for my broken UCCM-GPS-receiver
for free (only postage 80ct).

He announced a board in worse condition with broken SMDs but I got a pretty good looking one. At first glance nothing broken but someone
has had it in his hands  - you see the soldering on the fuse for 5V and the replacement of a SMD cap on the converter board.
May be some one from this board owns it before? 

Great stuff.. this module has collected more frequent flyer miles than the average business excutive 😳

Curious to see if the two of them allow building one working one. Or maybe 2 😃?

Wilko

[Bad_Driver]

Hi Wilko,

congratulations to the great finalized project and the enclosure you used! It is always hard to have the right one
by the hand and not to give up before the project is really at such a state!
btw: what kind of enclosure you have used and where you got it from?

I'm also using an old (external) video distribution amplifier in a 1" rack mount housing since I got 4 different one at Ebay for 20€. I was only looking for one
but it was a bundle and I made the only bid. Fortunately the one I now have in use has a bandwidth of 110 MHz!!! Perfect for square wave distribution.
And with respect to the incredible high energy costs in Germany it needs only 4 watts so I can keep it running.

 I will give the new (old) UCCM a final try. May be it works without any efforts (only connecting the OCXO). If not I will go the Samsung way as you.
I spend so much money in antennas, cables, PSUs, GPS receivers, connectors (and a HP 53131A  ) and learning that I have to bring it to an end. 

[wkb]

hi,

The case I found at a local ham rally, there was a "phone patch" in there. Nice aluminium box, couple of €,
why not.  I tend to scrounge for this kind of stuff, and store it in the garage or cellar. "Might be useful at some point".

Wilko

[Bad_Driver]

Good news. The recent arrived replacement for my first defective UCCM is working!

But it was a hard fight! The Furuno-receiver seems to be much less sensitive than my other GPS receiver (new U-Blox).
It took a some efforts to find the right antenna location. All my other receivers find always about 8 satellites with antenna on the bench or nearby
the window in a few seconds  (my working bench is under the roof).
I had to built a "through window) cabling what is not so easy with an new 3-layer-window.
And it took some tries to come thru the survey.

Following a hint in this topic (message #12) I ordered a weather proofed antenna. All my other receivers are pretty happy with it but not the Furuno!
In the technical specification I found the reason:
antenna current < 10 mA = open - no antenna connected
antenna current > 40 mA = short cut of antenna

and this antenna sucks 44 mA !  (wtf!!) So I had to use one of this little black magnetic antennas, placed on a piece of metal in a plastic bag, outside on the roof. ...and it is snowing.

Next problem are my OCXOs. As mentioned before only one of my 3 TRIMBLEs has a Vref > Vcontrol but the gap is so small
that the UCCM's DAC cannot reach the necessary voltage for 10 MHz (only 9.999.999,92 Hz - 50 mV missing - f..!) So no PLL-lock till now.
I have to use another Vref-source. I have one of this cheap Chinese AD584 based reference board by the hand.
Has anybody experience with an external Vref-source? Or a better idea? Or should I stop here and order a Samsung-UCCM?

[wkb]

I can confirm the Furuno GPS sucks chunks when it comes to sensitivity. I had at one
time a Symm, a Sam and a Trim connected to a single outdoor Symmetricom antenna plus splitter. The Furuno was essentially deaf compared to the other two. Ublox on the Sam rules the lot!

[Bad_Driver]

Thanks Wilko, I think for research only  (flying wires and bread board) I try a separate reference source to get the PLL locked.

But I think it's time to follow the Samsung way. The U-Blox Lea I could spot on some pictures seems more reliable to me.

[Bad_Driver]

Success!
Got it running and sync. Since I started housing it before I ran into trouble I will finish it.
Than I will try the Samsung UCCM. You can never have enough good time sources 

Two questions:
1) Has anyone ever seen a TFOM better than 2?? (10...100 ns)
2) If the UCCM uses a 12 bit DAC for OCXO control and I have a Vref of 7.5 volts, 1 bit is nearly 2 mV. My OCXO has a sensitivity of 1V/Hz. That means that I can reach in best case a frequency accuracy of +/- 2 mHz ??

[wkb]

TFOM: "yes", see screenshot

[Bad_Driver]

wow! Impressive! What antenna are you using?

I connected LH  to the UCCM first time one hour ago. Let's see how it works.

[wkb]

wow! Impressive! What antenna are you using?

I connected LH  to the UCCM first time one hour ago. Let's see how it works.

Some kind of Garmin "hockeypuck", it sits on my roof, so I cannot check what type it is.

Wilko

[ve7xen]

Success!
Got it running and sync. Since I started housing it before I ran into trouble I will finish it.
Than I will try the Samsung UCCM. You can never have enough good time sources 

Two questions:
1) Has anyone ever seen a TFOM better than 2?? (10...100 ns)
2) If the UCCM uses a 12 bit DAC for OCXO control and I have a Vref of 7.5 volts, 1 bit is nearly 2 mV. My OCXO has a sensitivity of 1V/Hz. That means that I can reach in best case a frequency accuracy of +/- 2 mHz ??

1) Yep

Code: [Select]

UCCM> SYNC:TFOM?
1 ~ 10 nsec

This with a not very good sky view.

2) See my post on reverse engineering these units for some commands you can use to manipulate and interrogate the DAC and measure the practical range of the EFC. As far as I can tell, the EFC resolution is a lot better than 12-bits. My unit for example is currently reporting EFC value of 0x57089 which is beyond uint12_max and even uint16_max. The box reports a max EFC value of 0xCCCCC, which is an odd value not being fully saturated, but requires at least 20 bits to get to. What gave you the idea it is only 12 bits?

[lamaral]

The DAC on my Samsung board is a DAC 1220E. According to the datasheet below, it's a 20bit.
https://www.ti.com/lit/ds/symlink/dac1220.pdf

[wkb]

The skyview I see. The roof of my house obstructs it somewhat.

[Bad_Driver]

That's my mistake. I thought I spotted elsewhere in this forum someone mentioning a 12 bit DAC, and I'm a little biased
by my HP 53131A project, where I build the high precision time base. HP uses a 12 bit DAC for automatic calibration.
But 20 bits are good news!
Has anyone spotted the DAC on the SYMMETRICOM board? Unfortunately my Laptop decided for a reboot this night
so I had to start LH again  And the roof including my antenna was covered by snow this morning...

One further question: 
Since I got a empty board without OCXO I use a external analog 12 V PSU for my TRIMBLE and for my voltage reference.
Are the boards "testing" and  "learning" the characteristic of the OCXO?

btw: It seems that you all are more happier with the Samsung UCCM. I ordered one for me but it will take time on the slow boat from China.

[wkb]

Now that I have built my Samsung UCCM into a nice case it was time to get back to my non-functional Trimble UCCM.  [no.. I will not mention that meanwhile received a 2nd Samsung UCCM.. no... I will not...  )

I more and more get the feeling I need to force the trimble to use the GPS as its reference.  See the screenshot below.

But:
UCCM >SYNChronization:REFerence:ENABLE?
GPS
Command complete
UCCM >

and
UCCM >REFerence:TYPE?
GPS
Command complete
UCCM >

and
UCCM >DIAGnostic:REFerence:SELect?
Undefined header
UCCM >

So.... any takers on what I am overlooking here?

I really do not get the
2-2. #Current Reference Type ----------- [GPS]
2-3. #Current Select Reference --------- [NOT SELECT]

shown in the attached screenshot. Not sure either about the
firmware ver  1.0.0.1-01 Ext     mode


Wilko

[ZigmundRat]

It's set to and running on GPS. Most of the things you point to in the display are just because it's designed to also use the 8khz signal from the frame. You can safely ignore it.

I'm not sure it will change the selected reference, or if it will have any real effect, but you can try:

SYNChronization:REFerence:DISABLE LINK
SYNChronization:REFerence:ENABLE GPS
REFerence:TYPE GPS

It might change the display.

You might want to start from scratch using SYSTem:PRESet - that will reset to defaults. If nothing is borked, it should come up in GPS mode by itself. No need to enter any commands. The display will show some references to 'Link' or 'Ext' but it should still come up.

The other thing you can do is try grounding pin 39 on the FPC - this should force GPS mode.

[heavenway]

Some of these units are still available (at human prices) but without ocxo, cant understand if they were sold separetly or what.
Does it make any sense to get one and look for a ocxo to fit in it?

Thank u guys

[Bad_Driver]

Hi folks,

I'm awaiting my Samsung UCCM from China. Can someone be so kind and measure what the height of this module is? I'm curious about
the space I need for the enclosure. I have a nice rackmount enclosure with prepared 5V - 3A PSU.

My SYMMETRICOM UCCM is still working with the weak Furuno receiver.... I think the Furuno GPS module is as mentioned by WKB really a PITA.
And it is sensitive to the antenna current (less then 10 mA - open/no antenna, more than 40 mA short cut of antenna - from the data sheet).
Not all OCXOs fit into the module, my TRIMBLE (12V) was to large but with 5 wires and a breakout board it works for me.
It seems that the original OCXO were removed from the board and sold separately. On my both boards this was done carefully without any further damages.

Thanks in advance for the measurement of the Samsung UCCM!

[wkb]

The Samsung UCCM's height is 17.5mm, with the metal shield mounted on the bottom of the PCB.

hth,
Wilko

Hi folks,

I'm awaiting my Samsung UCCM from China. Can someone be so kind and measure what the height of this module is? I'm curious about
the space I need for the enclosure. I have a nice rackmount enclosure with prepared 5V - 3A PSU.

[snip

Thanks in advance for the measurement of the Samsung UCCM!