Symmetricom NTS-200 Time Server

[ibjeepin]

You just have to register on microsemi to time sync systems here:

https://my.microsemi.com/AWelcome/HomeRNew.aspx

Inside the zip there's only a single .bin file with the same name with square brackets, that seems weird, and no instrucrions at all.

Old update instructions I found report other 2 files with extensions .fs and .bt

ftp://anthonygregory.com/Upgrade%20to%20Firmware%20Version%208.x.pdf

anenni, how did you get access to the file as it seems like its locked on the microsemi site.

[smgvbest]

register on the website then try to download the file.
it will tell you that you need approval, complete the request.
they completed mine in a few days.

I do have the files you get attached

[smgvbest]

Just for a FYI
I ran the bin file thru binwalk and we can see these

root@kali:~/Downloads# binwalk '182-9004v8[1].4ckpt1.81.bin'

Code: [Select]

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
24            0x18            Copyright string: "Copyright 1999 TrueTime Inc. and Wind River Systems, Inc."
22960         0x59B0          Copyright string: "Copyright 1984-1996 Wind River Systems, Inc."
23553         0x5C01          Zlib compressed data, default compression
i extracted the zlib file
dd if=182-9004v8.4ckpt1.81.bin skip=23553 bs=1 of=23553.zz

decompressed it
unpigz 23553.zz

root@kali:~/Downloads# binwalk 23553

Code: [Select]

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
303148        0x4A02C         HTML document header
304687        0x4A62F         HTML document footer
307184        0x4AFF0         HTML document header
307591        0x4B187         HTML document footer
1443260       0x1605BC        VxWorks WIND kernel version "2.5"
1456188       0x16383C        Copyright string: "Copyright Wind River Systems, Inc., 1984-1999"
1461152       0x164BA0        HTML document header
1561621       0x17D415        Copyright string: "copyright_wind_river"
1622016       0x18C000        Copyright string: "Copyright 1984-1996 Wind River Systems, Inc."
1640900       0x1909C4        VxWorks symbol table, big endian, first entry: [type: function, code address: 0x789B0200, symbol address: 0x4C3F1800]

looked at some strings

Code: [Select]

/config/acts.conf
/etc/ntp.conf
/etc/ntp.keys
/ramdrv/ntp.log
/config/snmp.conf
/config/truetime.conf
/web/data/IndexPg.dat
/web/data/ControlPg.dat
/web/data/TimePg.dat
/web/data/TimeContPg.dat
/web/data/NetworkPg.dat
/web/data/NetContPg.dat
/web/data/SatPg.dat
/web/data/SatContPg.dat
/web/data/GpsPg.dat
/web/data/GpsContPg.dat
/web/data/ActsPg.dat
/web/data/ActsContPg.dat
/web/data/ActsConfPg.dat
/web/data/NtpConfPg.dat
/web/data/Md5ConfPg.dat
/web/data/SnmpConfPg.dat
/web/data/NtpLogPg.dat
ntp-4.0.94
ARM PID - ARM7TDMI (ARM)
Osicom NET+ARM Ethernet driver
Jun 20 2008, 14:46:00
WIND version 2.5
]]]]]]]]]]]]]]]]]]]]]]]]]]]]
]]]]]]]]]]]]]]]]]]]]]]]]]]]]]       Development System
]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
]]]]]]]]  ]]]]]  ]]]    ]]]]]]]      ]     ]]]]]]]  ]]]]    ]]]]  ]]]] ]]]]]
]]]]]]]    ]]]]]  ]    ]]]]]]  ]    ]]]   ]]]]   ]] ]]]]    ]]]] ]]]]    ]]]]
]]]]]]      ]]]]]     ]]]]]]    ]  ]]]]]  ]]]]   ]] ]]]]    ]]]]]]]]    ]]]]
]]]]]     ]  ]]]]     ]]]]]      ]]]]]]]] ]]]]   ]] ]]]]    ]]]]]]]    ]]]]
]]]]     ]]]  ]]    ]  ]]]     ]] ]]]]] ]]]]]]   ]] ]]]]]]] ]]]] ]]   ]]]] 
]]]     ]]]]] ]    ]]]  ]     ]]]] ]]]   ]]]]]]]]]  ]]]] ]] ]]]]  ]]   ]]]]]
]]     ]]]]]]]  ]]]]]]]]     ]]]]]] ]     ]]                ]]]]           
]     ]]]]]]]]]  ]]]]]]     ]]]]]]]]       ]]               ]]]]           
     ]]]]]]]]]]]  ]]]]     ]]]]]]]]]]       ]]              ]]]]         (R)
]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
]]]]]]]]]]]]]]]]]]]]]]]]]]]       VxWorks version
]]]]]]]]]]]]]]]]]]]]]]]]]]       KERNEL:
]]]]]]]]]]]]]]]]]]]]]]]]]       Copyright Wind River Systems, Inc., 1984-1999
spy not configured into this system.
/bin/ls -a %s
/bin/rm %s
cat: read error: Is a directory
/bin/cat < %s
/bin/cat > %s
IP 4.4 TCP/IP
IP 4.4 ARP
xWorks (%s) FTP server ready
Local resource failure: %s
Directory non existent or syntax error
Data connection error
Parameter not accepted
Can't open passive connection
HELP    USER    PASS    QUIT    LIST    NLST
RETR    STOR    CWD     TYPE    PORT    PWD
STRU    MODE    ALLO    ACCT    PASV    NOOP
VxWorks login:
Copyright 1984-1996 Wind River Systems, Inc.
This program contains confidential information of Wind River Systems, Inc.
and disclosure and copying are prohibited.

[smgvbest]

Does any one have all the update files for any version of of the NTS-200?
looks like there should be atleast 3
bootloader
filesystem
and the main program

might help figuring more out
I would really like the filesystem one.  a look at etc/passwd would help and more importantly removing passwords from accounts where we don't know the passwords i think would be helpfull

[smgvbest]

Adding a little more information here

the GPS systems in the NTS-200 is the
GP2015/GP2021 and P60ARM   
The GP2015 (RF Frontend) & GP2021(GPS 12 channel Correlator) process the GPS signal and pass it to the P60ARM (ARM Processor)
the 1 PPS should be available on pin (32, 68 or 80 of the GP2021) depending on how the registers are setup.
Will track down where this is available later.

It also looks like the J11 connector is the JTAG connector for the P60ARM (Pins 67-71)
Will figure out pin out later.

my un-educated guess at this point is the code in the P60ARM is probably where any patch would occur

attached are datasheets for the 3 component mentioned as well as
photo's of the components
GP2015

GP2021

P60ARM

[smgvbest]

Ran out of attachment room,  here's the datasheets

[composerjk]

Does any one have all the update files for any version of of the NTS-200?

Attached is a tar of the prior version 8.2 firmware files for the TrueTime NTS-200 from 2004. Hope they help. I may have at least a version before that, if helpful. [Updated the tar file to include the release notes and upgrade document.]

[InFoq]

...the 1 PPS should be available on pin (32, 68 or 80 of the GP2021) depending on how the registers are setup. Will track...

after satellite acquisition, I attempted to oscilloscope pins 1,32,68 and 80, but did not seem to get anything close to a 1 PPS signal with my existing firmware.  Wonder how the front panel green flashing LED is derived...

[fira4]

after successful upgrade  , date time still set to 2000, how to fix the time

Code: [Select]

>F100 VER
F100 VER
 BOOTLOADER  182-9003v8.4
 SOFTWARE    182-9004v8.4
 FILE SYSTEM 182-9005v8.4
 NVRAM VER   2
 SER NUM     044550681

>F03
F03 UTC 6/13/2000 23:29:49
>


[smgvbest]

i'll take a look at this and see if there's anything extra interesting

[smgvbest]

so looking and reading more on this it's not going to a application firmware fix it's going to be the firmware shared by the GP2021/P60ARM   they share SRAM and EPROM   the GP2022 is the memory controler for the P60ARM if i read things correctly

that being case and this being the GPS WNRO issue where the Week Number is a 10bit value upto 1024 weeks what we have to find int he P60ARM code is where doe it calucate the week number of offset by the latest week number.

They followed the dev system pretty much to a tee which helps.  based on this the U39/U40 are the EPROMs and U19/U21 are the SRAM used by the GP2022/P60ARM  and U22 may be the EEPROM from the memory map but not shown in the block diagram (this is only a guess until I open it p again)

see attached app note on that and datasheet for the EPROM (need to verify though)

Oh, Pin80 of the GP2021 is an INPUT not an output


 an4855.pdf (793.11 kB - downloaded 312 times.)

[fira4]

so there is no way to fix nts-200 ?

[smgvbest]

don't know yet,   I'm going to get dumps of the P60ARM EPROMs and take a look but I'm not a developer.
I'll publish what I find here and maybe others will take interest and help

[ibjeepin]

Sandra, thanks for putting in your time and brain into this problem. I know i dont have the energy to do this.

[smgvbest]

My thought/hope is I can fine where the GPS Week value is read in and basically add 1024 to it and see if that works.  if so that would buy another 19+ years
if not I read one way is to find where the base date is stored
The first GPS Date was January 6, 1980  and the first rollover was midnight August 21, 1999 so I am hoping to find the August date somewhere in the firmware
if that can be changed April 6, 2019 that might also fix it.  but I'm truthfully not sure what I'll be able to figure out on this

this is me just saving some links I found that I thought might be helpful

 
http://gnsstk.sourceforge.net/gps_8c-source.html#l00714
http://www.telesens.co/2017/07/17/calculating-position-from-raw-gps-data/#Processing_Raw_GPS_Data
https://www.unoosa.org/documents/pdf/icg/2018/ait-gnss/15a_PPP_RTKLIB.pdf
https://www.gps.gov/technical/ps/1995-SPS-signal-specification.pdf
https://sourceforge.net/projects/gnss-sdr/
http://en.qi-hardware.com/wiki/GPS_Free_Stack
http://www.rtklib.com/
https://www.gps.gov/
https://gogps-project.github.io/
https://www.use-snip.com/kb/article-categories/message-decoding/


https://www.gps.gov/technical/icwg/IS-GPS-200H.pdf

For reference Subframe 1-3 structure

Code: [Select]

------------------------------------------------------------------
                           SUBFRAME1
------------------------------------------------------------------
TERM,               NR BITS,    BITS NO PARITY,   BITS WITH PARITY
preamble,           8,          1-8,              1-8,
TLM,                14,         9-22,             9-22
reserved,           2,          23-24,            23-24
--PARITY--          6,          -----             25-30
TOW,                17,         25-41,            31-47
alert_flag,         1,          42,               48
anti_spoof_flag,    1,          43,               49
subframeID,         3,          44-46,            50-52
parity_related,     2,          47-48,            53-54
--PARITY--          6,          -----             25-30
week,               10,         49-58,            61-70
code_on_L2,         2,          59,60,            71-72
ura,                4,          61-64,            73-76
health,             6,          65-70,            77-82
iodc_MSB,           2,          71-72,            83-84
--PARITY--          6,          -----             85-90
L2_P_data_flag,     1,          73,               91
reserved,           23,         74-96,            92-114
--PARITY--          6,          -----             115-120
reserved,           24,         97-120,           121-144
--PARITY--          6,          -----             25-30
reserved,           24,         121-144,          151-174
--PARITY--          6,          -----             25-30
reserved,           16,         145-160,          181-196
tgd,                8,          161-168,          197-204
--PARITY--          6,          -----             205-210
iodc_LSB,           8,          169-176,          211-218
toc,                16,         177-192,          219-234
--PARITY--          6,          -----             235-240
af2,                8,          193-200,          241-248
af1,                16,         201-216,          249-264
--PARITY--          6,          -----             265-270
af0,                22,         217-238,          271-292
parity_related,     2,          239-240,          293-294
--PARITY--          6,          -----             295-300
------------------------------------------------------------------
                           SUBFRAME2
------------------------------------------------------------------
TERM,               NR BITS,    BITS NO PARITY,   BITS WITH PARITY
preamble,           8,          1-8,              1-8,
TLM,                14,         9-22,             9-22
reserved,           2,          23-24,            23-24
--PARITY--          6,          -----             25-30
TOW,                17,         25-41,            31-47
alert_flag,         1,          42,               48
anti_spoof_flag,    1,          43,               49
subframeID,         3,          44-46,            50-52
parity_related,     2,          47-48,            53-54
--PARITY--          6,          -----             25-30
iode,               8,          49-56,            61-68
crs,                16,         57-72,            69-84
--PARITY--          6,          -----             95-90
delta_n,            16,         73-88,            91-106
m0_MSB,             8,          89-96,            107-114
--PARITY--          6,          -----             115-120
m0_LSB,             24,         97-120,           121-144
--PARITY--          6,          -----             145-150
cuc,                16,         121-136,          151-166
ecc_MSB,            8,          137-144,          167-174
--PARITY--          6,          -----             175-180
ecc_LSB,            24,         145-168,          181-204
--PARITY--          6,          -----             205-210
cus,                16,         169-184,          211-226
sqrta_MSB,          8,          185-192,          227-234
--PARITY--          6,          -----             235-240
sqrta_LSB,          24,         193-216,          241-264
--PARITY--          6,          -----             265-270
toe,                16,         217-232,          271-286
fit_interval_flag,  1,          233,              287
age_of_data_offset, 5,          234-238,          288-292
parity_related,     2,          239-240,          293-294
--PARITY--          6,          -----             295-300
------------------------------------------------------------------
                           SUBFRAME3
------------------------------------------------------------------
TERM,               NR BITS,    BITS NO PARITY,   BITS WITH PARITY
preamble,           8,          1-8,              1-8,
TLM,                14,         9-22,             9-22
reserved,           2,          23-24,            23-24
--PARITY--          6,          -----             25-30
TOW,                17,         25-41,            31-47
alert_flag,         1,          42,               48
anti_spoof_flag,    1,          43,               49
subframeID,         3,          44-46,            50-52
parity_related,     2,          47-48,            53-54
--PARITY--          6,          -----             25-30
cic,                16,         49-64,            61-76
omega0_MSB,         8,          65-72,            77-84
--PARITY--          6,          -----             85-90
omega0_LSB,         24,         73-96,            91-114
--PARITY--          6,          -----             115-120
cis,                16,         97-112,           121-136
i0_MSB,             8,          113-120,          137-144
--PARITY--          6,          -----             145-150
i0_LSB,             24,         121-144,          151-174
--PARITY--          6,          -----             175-180
crc,                16,         145-160,          181-196
w_MSB,              8,          161-168,          197-204
--PARITY--          6,          -----             205-210
w_LSB,              24,         169-192,          211-234
--PARITY--          6,          -----             235-240
omegadot,           24,         193-216,          241-264
--PARITY--          6,          -----             265-270
iode,               8,          217-224,          271-278
idot,               14,         225-238,          279-292
parity_related,     2,          239-240,          293-294
------------------------------------------------------------------


[smgvbest]

Here's the JP11 JTAG Pinout for the P60ARM Processor

[smgvbest]

This is the full view of the P60ARM JTAG connector



the EPROMs used for the P60ARM Processor at AT27C516  (32Kx16)  These are U39 & U40



And their datasheet

 AT27C516.pdf (270.29 kB - downloaded 181 times.)

[smgvbest]

Here's the Full View of the Main Board front

[smgvbest]

Back side of the Main Board (nothing to see here except a unpopulated memory footprint

[smgvbest]

Next are some of the chips with labels so we know what they are

Lattice GAL16V8D @ U22


and datasheet

 GAL16V8.pdf (761.38 kB - downloaded 92 times.)

XILINIX 1765EPC  @ U4



and datasheet

 XC1765EPC.pdf (248.7 kB - downloaded 253 times.)

[smgvbest]

Here's another one of the Lattice chips,  the GAL22LV10C @ U15



and it's datasheet

 GAL22LV10D.PDF (588.45 kB - downloaded 137 times.)

[acfnews]

Sandra (et all),

I also have a NTS-200 (on a remote site), which I'm eager to get fixed as the time on this unit is also affected by the week-rollover issue.
I will pick this unit up for some debugging on this.

Hopefully we can get this fixed, seems like a lot of people still have this unit...

Ron

[smgvbest]

I looks like you can use a AT49F1025 to replace the EPROMs on the NTS-200.   They are pin compatible with 1 extra address line (A15) that on the AT27F516 is a NC pin.
this will make testing code changes easier as the chip can be reflashed as needed unlike the 27F516 which is OTP

[smgvbest]

if I'm lucky I finally found the NET+40 hardware reference manual and datasheet (more of a marketing sheet)

see attached
 73-NET-40-QIPRO-4.pdf (4343.89 kB - downloaded 174 times.)

 93600.pdf (175.72 kB - downloaded 207 times.)

[BloodyCactus]

Just noticed this, from my original post my nts-200 is now toast. its weird, its rollover occured very early january I think or something. My machines started saying it was 2006 :/

I guess these things are basically paperweights now... shame.