Tuesday, June 16, 2015

Anritsu MF76A Repair - Part I


I recently acquired a nice Anritsu MF76A 18GHz frequency counter in a non-working state off of eBay. While older, this is still a very usable counter that goes for quite a bit of money when working. This one sold for cheap so I figured why not, I'm sure I'll be able to get it working. I didn't really need it as I have a good EIP 545A 18GHz counter, but this one looked fun to fix. The images of it indicated that it was powering up and had the cpu portions functional as the display went through its power up cycle and displayed all zeros on the display. Typically with frequency counters in this state and not counting, you either have a failed 10MHz reference or a damaged front end from over-driving the input. I was hoping for the former as I already have a stable rubidium reference I use with all of my gear.

Anritsu equipment is notoriously difficult to repair due to the lack of service manual availability. I ran into the same issue with my second MT8801C communication analyzer / spectrum analyzer that I had purchased in a non-booting state. I was ultimately able to acquire a service manual for it but it took some serious searching and asking around. Once I obtained it, it was nothing like the older HP and Tektronix manuals I was used to. This manual went through a basic troubleshooting process to identify the issue to a board level, no further schematics or information was available (in the manual I had anyway).

Upon arriving, I powered this MF76A up on the bench, it was in good overall condition and did power up as it was supposed to. Upon applying a RF source to either the 200MHz or 18GHz inputs resulted in no counting. In a way this was good, it could indicate an issue further down then the first converter stages. The back of the unit has a switch to either output the internal 10MHz reference or accept an external one. Checking this with a counter, the internal reference is working as expected. Damn. Time to open it up.

The back of the unit had the calibration stickers broken which was expected, this came from a calibration house / test equipment reseller and I'm sure someone mucked around inside with some attempt to repair it. With covers off, everything looked at least complete, this unit was constructed very nicely.

The power supply is tucked into the back of the unit, not the easiest to reach to check voltages, but the power comes off of it and is transferred to the backplane which has wider traces for increased current making it easy to identify. There are no voltage markings or test points on the boards but it was pretty easy to determine which were power. Probing voltages, everything looked fine except for one strange voltage reading which was around +6.8 volts. Also noticing that a -12V rail was present but no +12, I was betting that something simple like a bad cap was holding the +12V rail down to +6.8 volts, very similar to my EIP 545A repair.

Pulling all the boards and reinserting them to locate the source of the issue resulted in the +12V voltage drop being caused by the input IF brick at the front of the unit. This was fed directly from the 18GHz input, the 200MHz input bypassed it and went right to one of the digital boards. As a test I left the 18GHz section unplugged and ran a 50MHz source into the other input. At first there was no response but I realized that one of the coax connectors coming off of the 200MHz input was not connected in the correct location. Whomever had been in this unit messing around didn't put it back together correctly. Once it was where it was supposed to be, success. 50MHz displaying correctly.



So the counter itself is working fine, just the 18GHz converter is causing problems. This was always a concern, you see this often from someone providing too much input and damaging the input section. So while 200MHz is great, 18GHz is why I wanted this counter. At this point I pulled the input brick out and started taking the covers off of it. The cables for this are long enough to allow you to work on it outside of the unit, I so love designs that allow for repairs.

Each side of this brick was made up of multiple boards all of which actually had labeled power input pins. This made locating the problem board very easy. Measuring +12V to ground I was reading roughly 1.2K ohms through all boards. Through process of elimination I was able to isolate the boards that were sinking the +12V down to two boards, both exactly the same. Pulling the +12V cable off of each board returned the rail to normal levels. Both boards were labeled '342U7363', each containing a handful of passives, some transistors and MMICs, along with what looked like a large thick-film precision resistor.



By following the traces on the board and divide and conquering by cutting some traces, I discovered the +12V sinking was actually coming from this large mystery device package. Looking it up, it is an NEC MC-5156 broadband amplifier in a sip package and was nearly shorted from vcc to ground.

Removing these two amplifiers from each board returned the +12V rail to normal, so these two parts were at least indicating to be bad. Was anything else bad? Maybe, it is hard to tell for sure and without a full schematic it is really difficult to trace the signal paths between these boards to guess what else may be blown. Luckily these old amplifiers are still available as NOS from some suppliers, so with two ordered we shall see. Right now with these two amplifiers removed, the unit powers up and counts correctly on the 200MHz input. I am also able to see some RF on the input to each now missing amplifier, so RF is at least getting that far. Is this the only problem? Maybe, maybe not as this would be too easy. I'm betting there are more issues than just this but I can't do any more at the moment until the replacement parts arrive.









Monday, June 15, 2015

Decreasing Phase Noise with Low Noise Regulators

I have posted several times in the past on the PLL frequency synthesizer I designed and built based on the Analog Devices ADF4107. The overall design is a platform for a fractional PLL frequency synthesizer for any frequency range up to about 5GHz.  A single frequency or range could be generated simply by changing out the VCO and loop filter and reprogramming the ADF4107s registers. The design overall has worked very well, I have used it as a LO for a 1.42GHz hydrogen line radio telescope, a 2556GHz LO for my 10GHz ham station, and a 5.4GHz LO for some specific satellite downlinks.


One element of the design that has been less than ideal was the devices phase noise. My specific PLL was on average about 10dB to 20dB under spec of what the documented phase noise should be for similar designs using the ADF4107 and Z-Comm VCOs. After reading to the application notes some more and a recommendation via twitter from Tony (KC6QHP) who suggested looking into using very low noise regulators for the design, I decided to make the change.

Searching regulator semiconductor manufacturers for very low noise versions is not an easy task, often, the noise levels are not available in any parametric search. So to keep things simple, I just went with the ADP150 which is what Analog Devices recommends for their own designs including the ADF4107. Now this is definitely something I should have considered to begin with in the design, but it was my fault for not reading the docs and assuming the basic ST Micro KFNN regulators which I often use would be suitable for a project like this. Looking at the datasheets, the stated noise levels of each are quite a bit apart:

KF33:

OUTPUT NOISE  10 Hz to 100 KHz 50 µV rms

ADP150:

OUTPUT NOISE  10 Hz to 100 KHz  9µV rms

The issue I now have is I had designed the board for standard DPAK package regulators, the ADP150 used tiny TSOT packages. Because of this I would have to be creative in mounting the devices in the DPAK footprints. This turned out to not be too bad of a task although not the most elegant solution.



The results speak for themselves, after replacing the regulators with the ADP150s, phase noise has considerably decreased. I have already started on a version 2 of this synthesizer and I will be definitely switching to these regulators for all future versions.

Standard KF33 and 7805 regulators on the left, low noise ADP150 regulators on the right.

Monday, May 11, 2015

Tektronix 2246 Repair Part II


In the process of debugging the strange intermittent display issue on my Tektronix 2246 after re-capping the power supply, things are not looking so good. Things have actually gone from bad to worse. First of all, the short (or open connection) somewhere in this unit which I can return the unit to normal operation by twisting the chassis has been more difficult to find that planned. I pulled and went through the entire power supply again and did not find any issues. Same for all of the connectors, all are seated correctly without issue. Every screw was in place and I checked to make sure there were no poor grounding issues throughout the scope. What happened next is the result of my own stupid mistake (again) which is just making things worse.

In the process of removing the power supply, you have to remove the high voltage anode cable to the crt which is generated in the main power supply. This cable runs out of the supply towards the front of the unit and has an insulated high voltage connector that is clipped on the the metal chassis between the power supply and front panel board. When I was pulling the power supply out for the third time, I wasn't careful and unplugged this connector only a minute or two after powering the scope down. At this point I let the cable go and it fell towards the A16 main processor board letting a nice spark jump from the high voltage cable to the main board most likely due to stored capacitance that had not been bled off yet. I didn't see exactly where it hit, but it didn't matter. The stored voltage had hit the board and I knew damage had been done. Upon reassembly and power up it was confirmed.


The display was in bad shape at this point, everything to the left say 2/5ths of the display was not showing up and squashed into a vertical line. Definitely not good. So now my priorities have changed, now I have to debug this issue to make sure I haven't burnt out something serious like the main display DACs or readout processors as these would most likely be difficult parts to locate and replace.

I started right with the schematic, which was my next stop anyway in locating the intermittent display issue. The full service manual including schematics is easily available for this scope which is another reason why I love the older Tektronix gear. I focused right away at the character generator and display readout circuitry.



After some probing around, I noticed that output from the A16 processor pcb was odd, the horizontal output drive for the display was not looking right, the bottom half of the waveform was clipped which would explain the left half of the display being smashed into a vertical line. Further up the signal path, the signal was looking correct from the DAC and the multiplexer. So the final op amp stage was looking to maybe be the culprit which makes sense as these op amps definitely wouldn't survive a direct high voltage hit.

Output of mux on left, output after op amp on right
So only the final output stage from the A16 pcb was looking bad, this is a good sign as the actual logic does not look to be damaged. Only the final outputs through an op amp look to have been hit. The op amp in question is a TI TL074. There still may be more damage but I'm going to focus on this op amp for now. I didn't have any in my parts bins, so I placed an order for a handful with Digikey which I should have in a few days. Stand by for part III.



Saturday, May 9, 2015

Tektronix 2246 Repair


Last year I had talked about how I accidentally destroyed my Tektronix 2246 oscilloscope by removing the cover. There was a small dent in the metal bottom panel that while removing it had snagged a heatsink on a Motorola 151-0846-00 labeled TO-39 transistor, specifically Q702 on the A10 main board. This ended up ripping the pins out of the transistor can leaving me with a unusable scope. Unfortunately this was not a common part and trying to locate one is next to impossible. I had attempted to use a 2N3866A with no success, the scope was definitely not happy with that transistor in it, an original replacement part would be necessary.

I did ultimately find a donor board. Late last year I found a complete used replacement board on eBay for around $40 which contained both of the 151-0846-00 labeled transistors. This option was definitely cheaper than a whole parts scope and I would hate to ruin another 2246 which may be repairable just for this one transistor. Once I replaced this transistor in my 2246 it was good as new.



I want to focus the attention now to a second Tek 2246 scope that I own with its own set of troubles. I purchased another 2246 a few years ago for cheap, I think it was only around $100. This scope had a lot more use than my original one, while it was in good cosmetic shape it had some issues mostly related to old capacitors. The display was not stable, the character generated osd and cursors would jump around and upon probing the supply rails you could see there was some noise present. A re-cap would be necessary and possibly some additional caps on the A-10 main pcb if necessary.

The 2246 main power supply is pretty basic, much more simple to work on than the Tektronix 2445B power supply which I have also done. One interesting observation upon accessing it is that all of the caps look to be large axial electrolytics:

Trktronix 2446 Power Supply

The bottom of the board told a different story, and once removing a capacitor and testing it was indeed a standard radial cap with an interesting third lead out the top that wasn't connected to anything. Maybe it was designed for additional stability? I know this scope was a popular portable model so my guess it was just some additional ruggedness built into the design. Interesting regardless, at least I can replace them with standard radial caps which are much easier to source.


Replacement caps were all Panasonic 105 degree C. units which are always my first choice, then using Nichicon capacitors in cases where the Panasonic's were not available. The final rebuilt version looked like this:

Tek 2446 Power Supply Rebuild
Quite a difference in size. For good measure I also replaced all of the high voltage film capacitors on the board, many looked stressed as they did in the 2445B. I left the large primary switching capacitor alone, they are rarely every a source of trouble. Everything else looked okay.

This is where things started to get interesting. After putting everything together and powering the scope back up, I had strange display issues. The entire display was shifted left. I started looking around to see if I had missed a cable or possibly had a connector loose during the reassembly but didn't see anything obvious. This scope was working just fine before the power supply rebuild so this issue was definitely something that I caused. At this time I went to turn the scope over on its side while powered up that the display snapped back into alignment. After some more poking around I realized that if I put pressure on the chassis, twisting it just lightly I could get the display back in alignment. So it must be a bad ground, loose connector, bad solder joint, or some other mechanical failure where putting pressure on the chassis would complete whatever broken connection was occurring. It will just be a matter of tracing down where the issue is at. More to come in part II.

Friday, May 8, 2015

Large Display for GPS Disciplined Time Server


Since building my own GPS disciplined local time server I have wanted a large display of some sort to display my super accurate clock. The primary purpose of doing this was really just because it would be rally really cool looking. I also have a personal issue with any clock that does not set itself from the WWVB or support NTP, in 2015 we shouldn't have to manually set clocks anymore. A secondary use for doing this would be for ham radio purposes. A nice large clock that is always accurate so I can easily and quickly log contacts in UTC would be very useful. Ultimately I ended up with a very nice solution and here is the result:

ESE ES-166 timecode display used for GPS clock

Searching for someone who makes such a clock was frustrating. It seems either you can have a large format clock for cheap that does not support NTP, or you can have one that does support NTP but costs hundreds of dollars. Designing and building my own was the next option that I had considered for awhile. A simple PIC based device that drives some large 7 segment led displays would be trivial to build, but I couldn't get into the project. It just didn't excite me, It's one of those things that would be so simple and mundane that I just couldn't drive myself to do it. It would be like a software engineer being assigned the task of writing a word processor. It's already been done so many times and is such an unfulfilling project you can just never get excited about it.

So on to Plan C. Let's see what's already available and either modify or make it work for my intended use. Basically I would be looking for a large LED, backlit LCD, or big VFD display of some sort that would be able to easily display time. Input can be via various means, ethernet or serial would be first choices, some other parallel type interfaces would be not ideal although I could still make it work if needed. Luckily having some experience is professional video editing when I was in college, I looked towards something I felt might me the perfect solution: Timecode displays.

Upon scrounging around I found a perfect device on eBay, an ESE-166 remote timecode display. These can be found for less than $50 at times are are beautiful pieces of gear. It is a big 2U rack mount enclosure with a nice large format LED display on the front panel. This display is designed for displaying accurate time code for video editing systems. The particular display I purchased had hour, minute, and second digits which would be perfect. Many time code displays also include a 4th digit section for frames which this one did not as I did not need it for my purpose. The inputs on these devices are typically a single 75ohm timecode serial input for SMPTE timecode. I was fine with this as designing some hardware to convert an rs232 serial stream to SMPTE timecode actually sounded pretty fun, but I ended up not needing to. This specific display also included an rs232 serial input that supports a few ASCII time formats. This would be a perfect solution, just have a script that takes my local time directly off of the time server itself and dump it out the serial port to this display. There would be some very minimal latency with this obviously, but regardless this solution would be perfect! The ASCII format I chose to use is as follows:

Format #0: (CR)(LF)I(^)(^)DDD(^)HH:MM:SS(^)DTZ=XX(CR)(LF)

As for getting the time data into the ESE, it has two runtime options set by some dip switches inside. The first is a free running clock that when the serial port receives a time string, it updates the internal clock to the time received. The second option does not free run, you simply continuously provide the time signals to update at the interval you specify. In this option, you would need to provide the time signal at least once a second to keep the display real time. For now, I went with the first option. I have the ESE free running with a cron dumping data from my NTP server sending an rs232 time string via cron every five minutes. The noticeable time drift of this clock over a five minute period is not noticeable at all and this solution keeps the clock up to date on five minute intervals without having to constantly send it serial data.

For those that are curious what is inside the ESE ES-166, it is pretty basic:


There is a whole lot of room in that chassis with not very much there. Just a mains transformer and simple analog rectified power supply with a handful of logic to decode the SMPTE / serial port data and drive the display. I'm planning on moving my Trimble GPS receiver inside of this case as there would be plenty of room for it. This would consolidate some of the hardware laying in the back of my server rack.

Additionally the manual for the ES-166 includes a schematic which is also nice to see. There was one part of the design that I really loved, the rs232 to TTL translation:


There is no serial driver there, MAX232 or equivalent. Just a simple level converter based on a 2n2222 with a diode and resistor. I love it! You see MAX232s in everything these days when they are often just not needed for serial RX conversion.

Further plans include racking this unit in my server rack and possibly getting a second unit so I can display both local time and UTC.

Wednesday, April 1, 2015

IoT Security Fail


So I am not a huge fan of the whole Internet of Things movement that is going on right now, mostly due to the recent lack of any real security or thought of security being placed into these IoT devices. A more accurate name for the IoT would be the Internet of Insecure Things (IoIT). Recent (or not so recent) news of consumer home wireless access points and routers being compromised and used for various botnets are one example of this concern, and this is just one small example. Home routers, thermostats, IP cameras, VOIP phones, DVRs, smart TVs, etc, all things that can contain embedded firmware of now outdated or obsolete libraries that are exploitable. And if they are not exploitable, great, there is probably just some hard coded admin user and password in the device or another debugging backdoor that was forgotten to be disabled.

'Junk Hacking' is a term I like that is used to describe people finding exploits in these devices, it seems every week there is some new little embedded device that has a vulnerability. Stop. When these stories break, everyone always seems to be surprised that there is a backdoor or other exploit on IoT device N. Really?! Of course there was a vulnerability on it! I would have only been surprised if there wasn't! I go by the opinion that every device is vulnerable. Proving me correct is not difficult, proving me wrong on the other hand would actually be impressive.

Now sure, most of these devices (with exception to the router itself) will live on a home private network and all have private ip's assigned by the routers DHCP server, so risk to them should be very minimal even if they are vulnerable in some way or another, although wireless devices are an exception. Some vulnerabilities require physical access to the device as well, which imo is not really a vulnerability (anyone can re-flash devices if it's physically in your hands ). That said, it is amazing how many of these devices end up being publicly accessible on the internet, either on public ips themselves or port forwarded to private ips. Not excluding commercial and industrial devices as well, they are also exposed everywhere. Everything is just hanging out waiting to be poked at. Having convenience over security seems to be the norm.

Favoring backwards compatibility is another issue that needs to be overcome. 'Well, it needs to work on IE6!' No, actually it doesn't, and it definitely shouldn't. This mentality needs to go away. Software goes obsolete for a reason, and that is because it's usually broken. This rule needs to be enforced by all.

The wireless side of things is the same story. Wireless ISM band mesh devices are the new hotness with everything communicating over ZigBee, Z-Wave, or other protocols. You don't need to look hard or far to find known vulnerabilities in these protocols or tools to sniff these networks. While sure, newer devices will have updated firmware with possibly better encryption and security, what about all of the existing devices in the wild?

While manufacturer of devices intentions may be good to keep devices secure and up to date, the real result of these devices is that none of them actually are. The OpenSSL vulnerabilities that occurred last year and recently are an example of these concerns. How many of these devices are still running an old version of OpenSSL? Probably most, unless of course you have updated your firmware, which I know usually never actually happens. This is assuming new firmware is even available.

This issue of updating these home devices to keep them up to date ends up being your (the consumers) responsibility. Manufactures are more than capable of having their devices auto update when new firmware comes available, but the risk and cost would be too high in doing so. The day that the device auto updates and becomes a brick because of a mistake is just too high, especially if it happens to thousands of devices. Manufacturers could of course design in fail-safes to prevent this, things like dual flash memories for running and updated configs allowing a rollback option, but this would of course increase costs. Plus manufactures don't want to have to support their own devices, that is just additional cost.

So the result is it is your responsibility as the consumer to make sure your device stays up to date. I'm not okay with this, but you have no choice. The alternative is to not use the device, if it isn't on, it is not vulnerable. The real issue falls onto the larger portion of the population that doesn't really know or understand, or care to know or understand security, networking, or recent CVE listed identifiers that come out, not to mention understand the actual details of the vulnerability. It is this group of the population that results in everything being at risk, but I don't believe they should be held responsible. Maybe manufacturers should be responsible for the security and patching of their own devices. Maybe they should not be designed so insecure in the first place.

So what is the solution? Should manufacturers be more security minded and allow automatic updates to all IoT based devices? Sure, that would be a good start. Putting any actual thought and time into security in the first place would be another great idea. Having anyone who actually knows anything about security audit your product before production would probably catch a lot of the really stupid mistakes. Another thought would be to not make every device IoT enabled if it doesn't half to be in the first place. Just because something could be internet enabled doesn't mean it should be. I'm pretty sure I have been hearing news of internet enabled refrigerators for over 10 years now, even seen one or two in some stores. Everyone thinks its neat and cool and somehow it will be useful as it solves a problem that doesn't exist. I just know it will be end up being another vulnerable device.

Friday, December 5, 2014

Stratum 1 Time Server Based on a Trimble Placer GPS 450 with PPS Output

Setting up GPS disciplined stratum-1 timeservers are not a new or technically difficult task, plenty of articles are already available including some excellent ones from David Taylor's satsignal.eu site. The basic idea behind using a GPS device as a stratum-0 reference is the ability to have a very low latency and low jitter accurate local time source. The only complicated part is finding or modifying a GPS receiver that can provide a precise 1 pulse per second source.

This post is going to focus on a simple, inexpensive, and somewhat elegant solution based on a Trimble Placer 450 GPS receiver. The Trimble 450 is by no means a modern device. It was originally produced in the 1990s and used within vehicles for fleet management purposes. It is large compared to modern units and is also only an 8 channel receiver that uses only satellites in the US GPS satellite constellation. The reasons why I really like the Trimble 450 are that is is very rugged and well designed (as it was to be used in the field). It can also run off of a wide voltage supply range and it is easily modified for a true precise 1 pulse per second (PPS) output which is the key part to having an accurate stratum-1 time server.



Trimble Placer GPS 450s are plentiful (there are available on eBay all the time for less than $15 including shipping). I had a unit myself sitting in a parts box for maybe 10 years that I picked up somewhere for free, this is why I went with this unit to begin with as my time source. I also love re-purposing old and somewhat obsolete inexpensive hardware. You will need an external active GPS antenna to use with it, any cheap ones from China will work, the one I purchased was $6. Note you will need an antenna with an MCX connector (or adapter) to interface to it. One additional nice thing about the 450 is you can easily replace the on-board MCX connector with an SMA, BNC, etc if you wish.

By default the Placer 450 outputs a Trimble ASCII Interface Protocol (TAIP) serial datastream, but this is easily changeable to NMEA-0183 strings. Going through the docs I believe gpsd is capable of decoding TAIP messages, but I didn't spend the time to try. TAIP is a binary format and while it is a brief and compact data format, I like the human readable NMEA output strings as they can provide visual output of  your GPS devices status. The Placer 450 can be switched to NMEA with the following commands:

       
>SPR:NMEA=TT<
>SRTSAVE<


Once switched to NMEA, it will provide the following standard strings: GPZDA, GPGGA, GPGLL, GPGSA, GPVTG, and GPRMC. I recommend reading the Trimble Placer 450 manual as it does have good information if you are unable to successfully communicate to the device via RS-232. There is also an old dos based configuration utility available that you can use to program it and switch its output to NMEA format. You will need a machine running win98 or older to run it though. I keep an ancient Pentium 133 machine around for programming old Motorola radios and I had no issues using it for programming the 450.

If your Placer 450 has been sitting around for years without being used, its internal GPS almanac is going to be extremely outdated. This resulted in a cold start of mine taking about an hour to finally acquire four satellites for 3D navigation and update its GPS almanac. Any subsequent warm starts after this will lock on within about 60 seconds. This would also be a good time to check the internal lithium battery. The memory in the Placer 450 is volatile and if the battery is bad every power on will result in a cold start. Checking on my receiver, the battery was fine.

PPS Output

Utilizing the PPS output of a GPS receiver is really the most important part of having a truly disciplined stratum-1 time server. Not all GPS receivers offer a true 1-PPS reference, fortunately the Placer 450 does, it just isn't where it needs to be. While the NMEA strings that come off of the GPS receiver contain accurate time data, various delays through the serial communication result in a time reference that has significant latency and jitter. This usually ends up being no better time keeping than just pointing your time server to another stratum-1 server. That said, the GPS time is still useful for events where internet connectivity is lost or unreliable.

The PPS output provides an extremely accurate time pulse that occurs once per second. Ntpd ( or your time server software of choice) can use this pulse to keep extremely accurate time. I will only be discussing the integration of ntpd in this post. The Placer 450 does indeed have a PPS output, unfortunately this output is on a separate DB-9 data connector. Probing its output on a scope, this pulse is clearly visible and has a very fast falling edge when it occurs (1.1 microseconds on average).



Now that we know we have an accurate PPS pulse, we need to get it into the computer running ntpd as quickly and with as little latency as we can afford. The solution to this is to send the pulse across the serial port on an unused pin (data carrier detect is standard to use in this case) which will drive an interrupt on the ntpd machine. In regards to the Placer 450, I decided to take this negative edge pulse, feed it into a max232 serial driver and send it down the unused DCD pin on the serial port. This worked perfect as the max232 inverts the data and results with a positive ~+15V RS-232 compliant pulse. The final setup of this is shown here:


The small blue board I added contains the max3232c serial driver and necessary charge pump capacitors. I pulled +5 volts off of a positive rail on the Placer 450 along with ground. Since the DCD pin on the RS-232 connector was unused, this modification was very simple. I also removed the original 3 pin power connector and hardwired it to +12v as there is no reason to worry about sourcing an original power cable. Since these devices are usually pulled from service, the original wiring harnesses usually never stay with the unit. Here is the resulting outgoing pulse through the max3232c:


Now that we have the pulse going to the NTP server via the DCD pin over RS-232, we need to verify its operation. Any modern Linux distribution will have PPS support built into the kernel, the serial module for PPS will just have to be loaded. To verify the arriving pulses, you can use pps-tools which is available for most distributions. The following output from ppstest shows my arriving 1 PPS pulse indicating my hardware modification is working.

       
[root@time01 ~]# ppstest /dev/pps0
trying PPS source "/dev/pps0"
found PPS source "/dev/pps0"
ok, found 1 source(s), now start fetching data...
source 0 - assert 1417642033.999999820, sequence: 226503 - clear  1417642033.000028598, sequence: 173333
source 0 - assert 1417642035.000000722, sequence: 226504 - clear  1417642034.000021949, sequence: 173334
source 0 - assert 1417642035.999999642, sequence: 226505 - clear  1417642035.000022821, sequence: 173335
source 0 - assert 1417642036.999999339, sequence: 226506 - clear  1417642036.000023328, sequence: 173336


One note regarding serial to USB adapters. I was using one initially and was not seeing the pulse arriving on my machine. Once I switched to the onboard serial port (/dev/ttyS0) my pulses were immediately visible. If you are going to use a USB adapter, make sure that it supports the DCD pin as mine did not.

A few more prerequisites are needed including having gpsd installed along with ntp. The ntpd configuration is really the last critical step, in the case of my Placer 450, the following configuration is used:

       
# GPS reference
server 127.127.28.0 prefer
fudge 127.127.28.0 refid GPS

# PPS reference
server 127.127.22.0 minpoll 4 maxpoll 4
fudge 127.127.22.0  flag3 1  refid PPS


How this configuration works and what it should be set to could be an entire separate discussion, luckily it is documented very well. Basically the ip addresses shown above are driver interfaces to the gps NMEA serial interface and the kernel PPS. Once ntpd is restarted, checking ntp's status you will see the following:

       
[root@time01 ~]# ntpq -p

     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
-time3.chpc.utah 198.60.22.240    2 u    2   64  377   71.766   14.708   0.200
-time.tritn.com  66.220.9.122     2 u   39   64  377   71.081    2.188   3.051
+segfault.boom.n 216.218.254.202  2 u   25   64  377   45.549   -4.891   0.548
+50.7.72.4       128.138.141.172  2 u   31   64  377   58.978   -4.452   0.654
*SHM(0)          .GPS.            0 l    8   64  377    0.000  -71.444   4.780
oPPS(0)          .PPS.            0 l   12   16  377    0.000   -0.001   0.001


A few things to note in the above output:

1. Both the GPS and PPS sources now show up in the ntp output.
2. The tally flag for the GPS source is '*' indicating it is a system peer.
3. The tally flag for the PPS source is 'o' indicating the system sync is derived from a PPS signal.
4. Jitter on the PPS source is significantly lower than the other network based sources.
5. The jitter and offset for the GPS source are higher than other sources, this is expected as the serial communication latency between the Placer 450s NMEA strings and server is not guaranteed.

The next steps are to monitor and log the time servers accuracy and precision over time to see how much drift there is with the GPS source and without. After some basic testing it seems to be much improved but only time will tell.