Symmetricom S200 Teardown/upgrade to S250

[Astralix]

Hi!

Thank you for the (impossible) offer, but you are right, shipping from the US is horror. I do have a nice working splitter from SV1AFN:
https://www.sv1afn.com/en/gnss-gps/-7.html
And I also use his TCXO driven GPSDO-2.

I need a new fixture for the Sparcfun GPS antenna but need to figure out the right thread metrics and pole size. Will order that next week.

I can't find any ZB3PD-0dB-1+ over here, but as I said, the SV1AFN splitter is an active one and works fine. With my BIAS-T -> 12V to 5V LDR -> BIAS-T construct everything works totally smooth!

[testpoint1]

Hi!

Thank you for the (impossible) offer, but you are right, shipping from the US is horror. I do have a nice working splitter from SV1AFN:
https://www.sv1afn.com/en/gnss-gps/-7.html
And I also use his TCXO driven GPSDO-2.

I need a new fixture for the Sparcfun GPS antenna but need to figure out the right thread metrics and pole size. Will order that next week.

I can't find any ZB3PD-0dB-1+ over here, but as I said, the SV1AFN splitter is an active one and works fine. With my BIAS-T -> 12V to 5V LDR -> BIAS-T construct everything works totally smooth!

the ZB3PD-0dB-1+ only 25 USD in Ebay, I checked its internal circuit, it will use the active GPS port's power (that one using maximum vlotage), and pass it to antenna.

[tverbeure]

I wrote blog post that describes the steps to configure a SyncServer S200 as an NTP server, how to install the BNC connectors, how to make a backup of the flash drive etc.

https://tomverbeure.github.io/2024/07/14/Symmetricom-S200-NTP-Server-Setup.html

Most of the contents won't be new to the readers of this forum thread since I learned a lot by reading things here, but for those who are getting started it puts everything together in an organized way.

I also have a blog post in the works that describes how I got the original Furuno 8031 GPS module to work for much cheaper than buying a replacement GPS module, by using a custom interposer PCB that configures the GPS module correctly at power-on time.

[Neoname]

For reference, the Symmetricom S200 & S300 are looking for a Motorola M12+ / iLotus M12M GNSS receiver that outputs "Motorola 9600 baud". This very old protocol is unsupported by most modern GNSS chips, so an intermediary chip usually is used to emulate. In Synergy Systems offerings, this is a PIC24FJ128, for Jackson Labs they use a "32-bit ARM Cortex".

The "drop-in" main options for GNSS receivers without the WNRO problem (that I know of) are:

1) Heol HD-8737, using a Furuno GT-88-C3B

2) Synergy Systems SSR-6Tf+, using u-blox LEA-6T-1 https://synergy-gps.com/synergy-products/ssr-6t-gps-receiver/

3) Synergy Systems SSR-M8, using u-blox LEA-M8T-0 https://synergy-gps.com/synergy-products/ssr-m8-multi-gnss-precision-timing-receiver/

4) Jackson Labs Technologies "M12M replacement" receiver, using a u-blox M8T (I have not tested this) https://www.jackson-labs.com/index.php/products/m12m_receiver

Having tried both the SSR-6Tf+ and the HD-8737, the SSR-6Tf+ seems to lock from cold in half the time!! to the HD-8737 and have slightly better signal reception as well. This is relevant to me as my antenna is in an awful position with marginal signal, but cannot be relocated. As an experiment, I deliberately put the antenna in an even worse site and gave each GNSS receiver 15 mins twice to see how both performed with terrible signal. The HD-8737 hovered between 2-3 satellites seen, and on occasions dropped out completely. The SSR-6Tf+ consistently saw 5-6. I make no comment as to the relative stability or accuracy of the receivers, but in the case of poor signal reception the SSR-6Tf+ is the clear winner. I will try the SSR-M8 soon.

Synergy Systems told me that they were aware of the new u-blox NEO-F10T and the even higher accuracy LEA-F9T, and were evaluating them but no products were available yet.

I also saw some comments from someone in this thread about being unable to access the web interface. Note that the web interface is only available on LAN1, which on the S300 is the SECOND port. The FIRST physical port with GbE is actually considered LAN4 with the LAN4 MAC address as printed on the case sticker.

[Neoname]

I was doing some hacking and have now enabled root logon via SSH
if there is a easier way feel free to tell me I wasting my time.  And yes I know you can get a console port @ 9600 baud but ssh is nicer


otherwise

perform a backup and do a save-as to get a backup downloaded
open the backup in a zip until such as 7-zip
inside you will see config-1.2.tar.gz
open this in 7zip
then open config-1.2.tar in 7zip
you now have 2 directories
/etc
/var
go into /etc
open and edit shadow (the password file)
the root account looks like this
root:*:14012::::::
the * mean root can not logon
change to
root:$1$uV2.fU1.$UFcRU1rZDB5NJElVrwIR11:14012::::::
that will give root same password as admin (ie symmetricom)
save
if prompted to update the backup file do so
now go to /etc/ssh
edit sshd_config
find
PermitRootLogin no
change to
PermitRootLogin yes
save file
if prompted to update the backup file do so
close the archive
if prompted to update the backup file do so
go to the wizard and restore using the backup file you just updated

(Attachment Link)

Thanks for this, this was very helpful.

The Symmetricom S200 & S300 normally only support its own self-signed SSL X.509 certificates normally. Even the S600 only allows you to upload your own SSL certificates if you pay more for the optional "Security Protocol License".

Using your backup method & 7-zip, you can replace the following files with your own X.509 and private key, and the S300 at least has no problem with it.
config-2.0.tar.gz\config-2.0.tar\etc\apache\ssl.crt\server.crt
config-2.0.tar.gz\config-2.0.tar\etc\apache\ssl.key\server.key

However, the apache/openssl installed is too old (on a S300 running 2.83.2) to support anything higher than TLS1.0. Support for TLS1.0 is deprecated from most modern browsers as too archaic.

Adding to config-2.0.tar.gz\config-2.0.tar\etc\apache\httpd.conf  "SSLProtocol all +TLSv1.1" or "+TLSv1.2" causes the webserver to fail to load.

Does anyone have any idea how to update the apache/openssl webserver? I have very little Linux experience.

[tverbeure]

I just pushed a blog post that discusses a WNRO fix by using an interposer: https://tomverbeure.github.io/2024/08/18/Fixing-the-Symmetricom-S200-GPS-Week-Number-Rollover-Problem.html.

With this, I can keep on using the original Furuno GT-8031 at a cost that is less than $30.

[dj831]

Hi, excellent job  Just a question: wouldn't it be much simpler to reprogram the DSP in the board (for someone who knows DSP assembly or C)? Furthermore, ISCP pins are already in place, IIRC.

[Astralix]

Hi!

Unfortunately I need my single unit for my lab to work without interruption. And all the units that were available cheap over here in Germany were sold out.
But if I come across a second unit, I will definitely try to upgrade the Linux on the system. Everything needed for that should be on the box.

It also relies on a bigger FPGA and that bit stream is probably not easy to upgrade, but it also may not be necessary if the drivers and applications around it are well enough understood.
It is very likely that the PLL and VCOCXO control is done in that FPGA and as these work fine, there is no need to change. Also it will probably handle the fail-over from GPS to VCOCXO / RB and also combine all the external sources as well as providing all outputs for the external connections without any real software control needed.

If the programmer of the functional applications around web services, NTP and such didn't modify basic structures like kernel drivers and so on, it may also be possible to upgrade the whole Linux and just keep the old applications just going.
What I mean is, that if they used /dev/ttySx for accessing the UART to the GPS module and did not write a code that accesses the CPU internal register to communicate with the GPS, the only thing a new Linux needs to do, is providing the same /dev/ttySx to the same physical serial port and the software still works.

And I bet there are specialists available here in the forum, that will provide some nice modern web interface

But I checked, there are currently no S200 or S250 available that are affordable for such an experiment and the need the one I have running 24/7

[tverbeure]

Hi, excellent job  Just a question: wouldn't it be much simpler to reprogram the DSP in the board (for someone who knows DSP assembly or C)? Furthermore, ISCP pins are already in place, IIRC.

It would be more elegant, but for somebody who has never seen an MSP430 in his live, it definitely wouldn't be simpler.

[dj831]

Thanks for all these explanations  You're right about cheap S200/250/300/350, not easy to find some these days. I was luck enough to find in April 2023 an S250 with an Rb oscillator ($405 w/o brokerage and shipping), an S250 last year in France for 200€ (no options), and few months ago, an S300 ($75) missing its power supply, but I installed a 1800 Cisco power that works flawlessly. All three almost work: I miss an EHOL card for one, and I still have to replace the VFDs.

Anyway, since design or Linux hack are time-consuming, the easiest way is to use a 1:1 card replacement (EHOL card works pretty fine here in France), and spare time for other projects 

[Astralix]

The Linux hack isn't probably that difficult. To boot up a modern Linux may take a rainy Saturday evening.
The problem is, that my unit has to work.

I agree that the HEOL card does work flawlessly and they a re doing a great support, even outside of France. The money to safe compared to the time that needs to be spent for an adapter board, doesn't sum up for me. So I would buy the HEOL card again.

May be, if I have some work out of the lab, I can create a secondary boot card for testing. The cards I use to revive R&S FSxx and ZVxx do not work out of the box with a copied image.

[Neoname]

Astralix - Does it actually need a modern linux version, or could apache & openssl be updated in place?

[Astralix]

That is a question I cannot answer for you...

My unit is sitting inside a network that is hidden behind a firewall and does not allow any access from the outer world. So theoretically, there is no matter in wasting any time to secure the unit.
On the other hand, network breaches are often reversed so hacking a PC, telnetting into an insecure device and installing some tools to breach more and more of the network.

Exchanging some certificates only gets rid of these annoying pop-ups in your browser accessing the device, but does not in any way improve network security.

I have not checked if any of the known security vulnerabilities apply to kernel, bootloader or any service running on the unit. But in remember that the used ntpd service is outdated, the web service is outdated, the ssh service is outdated and the kernel is old too.

Does it need to be changed in a secure environment? May be not. Does it make lots of fun to hack yourself into a system to a degree where you can even build your own uboot and kernel? Definitely yessss!!

[electromaticboy]

Hi all,
New member, first time posting after many many years following the EEVBlog on Youtube.
Got a dead Symmetricom S200 from work, replaced a couple of bulged caps in the power supply and seems to work fine but I have no use for it. Comes with SanDisk 256MB CF card, firmware v1.01 and TXCO oscillator. I'm in the UK so if anyone wants it, please send me a DM and we'll sort something out (like you send a shipping label, a small voluntary donation to my local Hackspace and I'll send it across). If no interest, I'll put it on fleabay.
Cheers!
Tom

[carver]

the ZB3PD-0dB-1+ only 25 USD in Ebay, I checked its internal circuit, it will use the active GPS port's power (that one using maximum vlotage), and pass it to antenna.

I found a box with lot of new Mini-Circuits ZB3PD-0dB-1+ in the warehouse
(spares for Lucent/Alactel-Lucent Base Station) .
Do you have any PDF for them?
Thanks.