Kenwood TH-215A TH-225A HT Repair - Low / No Audio Output

I figured that I may as well post this as it could probably help others. The Kenwood TH-215A and TH-225A are my favorite 2M HT's. There are others in this family as well (TH-315A, 415A, etc which have different bands). Inside they are all basically identical. These radios are rugged, reliable, and inexpensive on the used market. I have also always loved the way they look and have a bunch of these as a result.

Recently a couple of mine had the same symptom develop around the same time, very low or no audio output from the speaker. Opening and debugging one with a heat gun and some freeze spray, there is a group of capacitors near the top of the main board which have gone bad. They all sit next to a BA526 audio amplifier which probably runs a little hot causing the capacitor failure over time. All of these capacitors are made by ELNA, so they used good caps. But these being manufactured from the late 1980s to early 90s is still pretty old and cap failure can be expected. 30+ years was a good run for them.

I ended up replacing all the capacitors in this section, nearly every one had been leaking. After replacing the audio was back to a nice loud volume level. I inspected other capacitors inside the radio but couldn't find any others that were leaking. It probably wouldn't be a bad idea to replace them all in these radios, but in terms of fixing the audio issue, these are all that need to be replaced. Sensitivity and receiving / transmit quality is still great after the fix. 

Replace the capacitors highlighted in yellow

Here are the capacitors I ordered from Digikey, dimensions are the critical spec here as you need to keep them under the original capacitor dimensions to fit in the tight locations. I generally always buy 105 C rated caps, but they were not available in all the values / sizes I needed at this time. I ordered at the price break of 10 of each as I had multiple radios to do and extras are never a bad thing. This is a good time to replace the lithium battery as well. Hopefully others find this helpful to keep these great radios running.

1	‎P15776CT-ND‎ ‎EEA-GA1A330B‎ CAP ALUM 33UF 20% 10V RADIAL
2	‎493-10461-1-ND‎ ‎UMA1H010MDD1TP‎ CAP ALUM 1UF 20% 50V RADIAL
3	‎P963-ND‎ ‎ECE-A1AKS101‎ CAP ALUM 100UF 20% 10V RADIAL
4	‎P969-ND‎ ‎ECE-A1CKS470‎ CAP ALUM 47UF 20% 16V RADIAL
5	‎P967-ND‎ ‎ECE-A1CKS220‎ CAP ALUM 22UF 20% 16V RADIAL

Tektronix 2465B Repair - Part II

After a couple months I finally found some time to revisit my sad Tektronix 2465B auction find. At this point the power supply was rebuilt, and I had isolated U950 being a culprit by grabbing good hybrid ICs out of my working 2445B to test. Once the replacement U950 arrived it was placed in the 2465B which solved the numerous display issues and returned a horizontal sweep.

 Tek 2465B with horizontal trace restored

To make matters worse, while troubleshooting I did not have one of the hybrids (U700) lined up exactly correctly after swapping it out from my 2445B. As a result of this when torquing it back down very lightly I heard a terrible crack. The edge of the ceramic board inside the hybrid had caught on the connector mounted on the board and cracked the hybrid substrate. So this would also have to be replaced because of my own mistake. I still had a good U700 from my 2445B for testing until the new hybrid arrived. Luckily these are cheap.

Tektronix 2465B Hybrids

A new issue was apparent at this time involving the horizontal sweep and possibly trigger systems. At low sweep speeds the scope would behave correctly, a nice sweep would occur with a waveform being properly triggered. The issue I was seeing involved at higher sweeps above 1ms/div. At these speeds the horizontal sweep would intermittently show up, sometimes not being visible altogether. If a signal was present I could get a waveform to display for a single sweep when changing either the sweep speed or trigger options.

Researching into the issue I could not locate anyone who had this exact issue on any forums, most issues with horizontal sweep resulted in people just recommending to replace various hybrids. I knew this was not the case for me, looking back to the service manual(s), there was no exact description of this issue. At this point I began following the troubleshooting flowchart for the horizontal section item by item verifying voltages and waveforms. With everything looking fine, I was beginning to reach desperation as there was not much more to check. Towards the end of the flowchart there was a test involving removing the plug to J102 which is a ribbon cable that runs to an option board. This specific option board was for TV sync options which I really have no need for. Testing this I removed this connector and powering on the unit resulted in a fully functional unit, sweep and trigger was now working at all time divisions. All issues were now gone.

I really don't care to look into repairing this TV option board, pulling it out didn't show any obvious signs of problems. I don't plan on needing to troubleshoot NTSC waveforms so I am just going to leave it disconnected for now.

Tektronix 2465B Working

Some last items that I need to look at are trivial. I need to replace the scale illumination light bulbs, with 2400+ hours on the scope, all three are burnt out. I need a replacement knob for the channel 2 vertical position. This has actually been harder to find than I expected. Being patient I'm sure one will show up on eBay soon. The last issue will require some more investigation though. The traces themselves are slightly fuzzy, not a crisp trace like I see on my 2246 or 2445B. The rest of the display is perfectly focused, on screen menus look nice and sharp. I adjusted the focus, astig, and the gain + focus knobs on the high voltage board, none of them helped the traces. So not quite sure about this one. It's not a super big issue but still bothers me somewhat.

As a final note I will need to get some proper Tektronix probes for this scope, my P6105s are not designed for this 400MHz bandwidth.

Tektronix 2465B Capacitor Replacement and Repair

Recently and randomly I was notified from a friend about a local company liquidation auction for a local Unisys facility that was shutting down. Hoping to score some cool old vintage computer hardware I scoured the item listings to no avail. Nothing was really of interest, a lot of office furniture, shelving units, misc bins of random hardware bits. Ten years ago I would have been all over this auction, bidding on random carts of hardware to see what I can find but I just don't have time or the space for that anymore. After looking at a hundred or so pages of auction photos, one thing did catch my interest.

Hiding on an equipment cart was a Tektronix 2465B, sitting all by itself, the only piece of test gear in the entire auction out of hundreds of lots. I'm sure it was dead, the odds of it working and still being there were very unlikely.  Having a 2445B, I have always wanted a 2465B, being the top of the line version at the time only second to the 2467 with its microchannel plate CRT. I ended up winning it for like 50 dollars including the cart which actually ended up being a really nice heavy duty equipment cart. Even if this scope was totally toast, it would still be a win for parts.

Once I actually picked up the scope and had a good look at it, it was in pretty good shape. The only physical damage was the vertical position knob for channel 2 being broken off, but this was visible in the auction picture. The rest of the scope was in really good condition, clean with no other physical damage.

Tektronix 2465B

Having restored my 2445B and knowing this will need a full re-cap, I ordered all the replacement caps for the power supply and A5 PCB boards. The power supply for the entire 24NN series was basically identical with a few minor revisions. One thing I did notice though was some of the capacitor values were different in this 2465B compared to the capacitor list I had for my 2445B. Instead of placing the order based on my old parts list, I created a new list based off the values in this scope. Some parts on my old DigiKey list were no longer available anyway.

Here is the updated DigiKey parts list:

Quantity	Part Number	Manufacturer Part Number	Description
10	P10267-ND	EEU-FC1E470	CAP ALUM 47UF 20% 25V RADIAL
2	P13465-ND	EEU-EB1H4R7S	CAP ALUM 4.7UF 20% 50V RADIAL
1	P5874-ND	ECA-2WHG3R3	CAP ALUM 3.3UF 20% 450V RADIAL
4	P10769-ND	EEU-FC2A100	CAP ALUM 10UF 20% 100V RADIAL
4	493-10252-1-ND	UMP1H010MDD1TP	CAP ALUM 1UF 20% 50V RADIAL
1	399-7494-ND	PME271Y510MR06	CAP FILM 10000PF 20% 1KVDC RAD
2	399-5410-ND	PME271Y422MR30	CAP FILM 2200PF 20% 1KVDC RADIAL
1	EF2563-ND	ECQ-E2563KF	CAP FILM 0.056UF 10% 250VDC RAD
2	399-7482-ND	PME271M568MR30	CAP FILM 0.068UF 20% 275VAC RAD
2	PCE3777CT-ND	EEE-FK1A330R	CAP ALUM 33UF 20% 10V SMD
2	PCE3833CT-ND	EEE-FK1V100R	CAP ALUM 10UF 20% 35V SMD
2	493-1421-ND	UVZ2E331MRD	CAP ALUM 330UF 20% 250V RADIAL
10	P10323-ND	EEU-FC1H101	CAP ALUM 100UF 20% 50V RADIAL
1	P5856-ND	ECA-2CHG100	CAP ALUM 10UF 20% 160V RADIAL
4	P11236-ND	EEU-FC1V271	CAP ALUM 270UF 20% 35V RADIAL
2	P10345-ND	EEU-FC1J181S	CAP ALUM 180UF 20% 63V RADIAL

Note that I ordered a few extra values of some of the caps to meet price breaks. Total cost came to $30.02 without shipping.

Just like on my 2445B, I always use high quality Panasonic 105 C caps and original replacement RIFA film capacitors. The couple non-polarized caps are 105 C Nichicons along with the two large filter caps. None of the resistors in this power supply were damaged like on my 2445B, so I left them alone on this one.

2465B power supply with new capacitors

For my first power on test, the scope did power up, went through the first self-test cycling the panel LEDs, fan was running, but nothing on the CRT. Intensity controls had no effect. Even the graticule illumination was dead. Timebase, channel, and trigger controls responded to changes so the digital portions were at least working. Checking voltages, some were off and had ripple so I powered down and would wait for the capacitors to arrive.

Once all capacitors were replaced, powering up had the same result as before. Checking voltages they were all in spec now and the ripple I had was gone, but still no display. Time to reference the service manual.

One note on the 2465B service manual, I found three different versions all of which having some slightly different information. None of the info contradicted itself, just some manuals had more information than others. Once of the manuals looked to be for the older version of the 2465B where the A5 pcb was not using surface mount components, this was for early serial numbers . The other two looked to be newer. I ended up referencing all three throughout the repair process.

Following the troubleshooting flowcharts in the service manual, I ended up adjusting the grid bias adjustment which when increasing did give me a working display. Traces appeared along with on-screen graphics, but they were out of focus and had horizontal artifacts across the display. Intensity controls had no effect leading me to believe it was something with the Z axis processing based on the service manual flowcharts. The primary culprit would be the U950 hybrid which handles most of the Z axis functionality.

2565B with grid bias increased

Since I did have a somewhat readable display, at this point I was able to run the self-test routine outlined in the service manual to verify the rest of the functionality. In doing this, the scope passed with no issues, so good news there. I could also check power-on hours and cycles, 15703 and 2440 respectably. About 5k more hours than my 2445B but still not a high amount compared to some 24NN's I have seen that are well over 30K hours.

At this step, having a working donor scope makes troubleshooting significantly easier. All of the hybrid ic's on the main board are identical, with exception to U600 which has a different part number.  165-2393-00 on the 2445B and 155-0237-00 on the 2465B. Reading into this, they are compatible with the exception being that the 2445B version does not have 400MHz bandwidth. So I can use it for testing if necessary, it will just limit bandwidth on the 2465B to something under 400MHz. You would not want to use this long term in the 2465B.

Pulling parts from a working donor scope is always a little scary, I could end up with two non-working scopes in the process but parts are now plentiful on eBay for reasonable money.

2445B donating hybrids to the 2465B

Swapping U950 from my 2445B to the 2465B did fix the display issue. After turning the grid bias back down, the intensity and readout intensity controls now properly function. The display has a nice clear readout and clean trace. Looking on eBay, a working tested replacement U950 is about $50 - $60 which has been ordered.

Checking the rest of the scopes functionality I did notice another problem. As I adjust the horizontal timebase, the trace will disappear after increasing it beyond 2ms. Turn it back down and the trace will reappear. This behavior repeats for all 4 channels and is Y axis independent. Applying a signal has no change on behavior. Either the built in square wave calibrator or an external signal from a signal generator, the scope will lose trigger right around 2ms then have no trace at all beyond 1ms. Changing any setting, 20mhz bw, delayed timebase, other triggering options, etc made no difference. So something is up with the horizontal timebase and / or triggering on this scope.

One first attempt was to swap out the remaining hybrid ic's from my 2445B to the 2465B to at least eliminate another one of them being a possible issue. This ended up making no difference, so the next step will be to go back to the service manual. Their is a lengthy flowchart to debug horizontal trace issues, following this will be my next step. I'll leave this for a part II of the repair.

Counterfeit 2N3055 Transistors from eBay

I recently needed some 2N3055 TO-3 transistors for a project, but could not locate any around my basement, so I went ahead and carefully purchased some from eBay. I'll explain what I mean by carefully, a little back story on this before I continue.

Counterfeit 2N3055 Transistors vs Real

Counterfeit components sourced from eBay is not a new thing or a surprise. I don't think that I would be wrong in saying that most components on eBay are a no-name brand from Shenzhen, if not actually counterfeit. Now if you know what you are looking for specifically and don't just buy the first thing that pops up in your search results, you will be fine. Plenty of components from China are just fine, LEDs are a good example. I have LEDs of probably every wavelength available in bags by the hundred that cost next to nothing from China, all from eBay. Many have been used in projects running for years without issue, for items like this I have no issues with cheap components. But when I'm expecting a legitimate transistor sold as a name brand, and get a knock-off cheap piece of crap there is an issue. As I have learned, TO-3 transistors for whatever reason are a very popular thing to counterfeit.

So back to buying my transistors. Fake transistors are usually easy to spot visually. The cases are always shiny, the label on the case is usually crooked, or blurry from the poor printing process that is used. The type fonts are often weird. They just look cheap. So I first picked a few ST Micro 2N3055s that in the auction picture looked like original OEM transistors comparing to other TO-3 style transistors I had around. This was from a US seller with a good reputation too, everyhting looked legit. I had them in a few days, what I received though was not the same transistor shown in the picture. It looked wrong, it felt wrong, everything was just wrong about it. I purposely avoided all of the listing with transistors that looked like this as I knew they were counterfeit but ended up with them anyway.

To test for a counterfeit transistor, first just see if you can rub the label off with your finger. The label on this transistor came off with little effort just by rubbing on it. A stronger test is to use some rubbing alcohol, a real transistors label will not come off even with alcohol. Also look at the date codes, most counterfeit transistors will have a misleading date code or just be non-existent altogether.

So at this point I knew they were crap, time to crack one open. Stick it in a vice and with a couple taps of a hammer on a chisel right on the lip of the edge, it popped open with barely any effort. What is inside is comical:

Counterfeit ST 2N3055

A tiny little die glued down with some white stuff and tiny little bonding wires, really pathetic. My favorite feature is the surface rust seen on the inside of the can. I wonder how long this case was sitting around before someone manually assembled it.

For what it's worth, I did test the transistors and they do work, although I highly doubt they will handle the current they are rated for. Based on this discovery I was curious to see what else I could find. Could I get any real new 2N3055 transistors on eBay? To find out I went back on eBay, found another set of this time Toshiba transistors, the most legitimate listing I could find that was not labeled as NOS or used. It was a similar auction, US based seller with good rating, transistors are claimed to be OEM. After receiving, they again are different from the picture and just wrong:

Counterfeit Toshiba 2N3055

The ink rubbed off on this one just as easily, the can popped off almost with no effort. There in fact wasn't even any damage to them when I removed it, a clean break. And inside, this one was even better. Similar construction, and the bonding wires! Oh my, even smaller than the previous labeled ST transistor. At this point I could keep buying them seeing if I could find anything legit, but I decided to cut my losses and just get the real thing.

As a final comparison of what this transistor should look like, I purchased some legitimate ON Semi 2N3055s from Digikey. They were only about a dollar more a piece than the ones available on eBay. After receiving, a noticeable difference is noted right away. Most importantly is the weight, they feel much heavier. Also the labeling, you can rub them with alcohol and the label does not come off at all. I decided to sacrifice one (which did not come apart very easily) and you can see the obvious differences on the inside:

On Semi 2N3055

First big difference is the backing plate. The die is mounted directly to a piece of metal designed to better distribute the heat off of it and down to the case. Next is the die itself, noticeably larger than the other transistors and it is better mounted to the backing plate, not a big dab of white adhesive. Finally the bonding wires, they are considerably thicker than the other two transistors. Here is a close up comparing each transistor:




I ended up contacting the sellers of the transistors from eBay just to see what their response would be in telling them that their components are most likely counterfeit. One seller actually seemed to care and began questioning his supplier, whether or not he actually will do anything about it is yet to be seen, the transistors I bought are still available by him. The other seller didn't seem to care at all and simply said I could return them if  I didn't like them. I will also note that all of these transistors did work, although I have not tested them at higher currents which is where most people say they will fail. Either way I don't trust them and wouldn't use them in any serious project. It seems the counterfeit market for these is much worse than I had expected.

HP 54503A NVRAM Replacement - DS1235YW to DS1230Y

A few weeks ago I turned on my HP 54503A to find it behaving strangely. While probing a circuit under test, I could not get any waveforms at all. Was very unusual, so ran a quick self test and was greeted with the following:

HP 54503A Selftest Failure - Protected Non-Volatile RAM

This didn't look good.  An important key to the cause of the failures was the failure of the Non-Volatile ram. Most older equipment like this used a Dallas Semiconductor real time clock / NVRAM IC to store the calibration data along with waveform storage. In this case it is not a real-time clock, just a battery backed DS1235YW RAM ic. This classic chip has an internal battery to backup the contents inside, technology that existed way before inexpensive flash memory that has a limited lifetime. Based on the manufacturing date on the late 1980s, this ic was almost 30 years old, way beyond its expected lifetime but about average for how long I see these devices last.

The HP 5450NA family of scopes 54501A, 54502A, and 54503A are really nice scopes readily available for cheap. My favorite part about them is the interface, it is intuitive and lightning fast. Response from button inputs is instantaneous, unlike many modern scopes which makes it a pleasure to use. This was definitely getting repaired.

A quick way to check to see if the NVRAM is indeed the issue is to flip the write protect switch on the back of the unit off and attempt calibration. Once you calibrate this scope, you flip this switch to protect the contents from accidental writing, but in this case I want to re-calibrate it and to do so you must enable writing. Once this switch was changed I ran the calibration procedure for channel 1. It calibrated successfully and brought the scope back to a working state. So this was the only problem and the NVRAM ic will need to be replaced, unless you feel like going through a full calibration every time you power the scope on. Since a full calibration of all channels takes around 25 minutes, this is not ideal.

HP 54503A Main Board

This scope comes apart very easily, the main board slides out of the back with little effort. Once removed the Dallas NVRAM was easy to spot:

HP 54503A DS1235YW

Removing this ic is pretty easy, use a nice fat hot iron and some fine solder wick and the ic falls right out with no damage to traces.

HP 54503A NVRAM Removed

As far as a replacement, the original DS1235YW is not easily available, but the pin compatible DS1230Y is available. It is still made and Digikey sells it for $30. Then there is the eBay source of them direct from China for only $5. While the Chinese version is guaranteed to be a knock off, it does work as I have used them before. I went ahead and used one for this replacement since I have a few laying around.

There are also available pin compatible flash based alternative ics that you can use in this scope, but I have never personally tried them. One last note is as long as you are going through the trouble of this, go ahead and place a socket on the board so in the event your new NVRAM doesn't work, you won't have to stress the board with another de-solder. Here is the replaced ic:

HP 54503A DS1230Y NVRAM

Once replaced and everything is back together, calibration is the last step. Set the write protect switch to off and run through all the calibration procedures. The calibration for this scope requires a 50ohm bnc cable to be fed from two outputs on the back of the unit to each channel is sequence, the scope really walks you through everything. The manual will explain all of this as well, but is really a simple procedure and a really nice feature.

HP 54503A Calibration

When done, set the switch back to write protect, test it out and power cycle it to verify all calibration was held. Good as new.

10GHz Station Upgrades

With the 2015 September 10GHz and up contest approaching fast, I am in process of making some performance improvements to my 10GHz station. I had already missed the first round of the August 10GHz and up, so I wanted to make sure to complete a few necessary items before the 2nd round is here.

First on the agenda is to upgrade my PLL frequency synth that runs my LO to use low-noise regulators. This was a design error on my part, when I originally designed these freq synths, they had less than ideal phase noise as a result. The noise itself was determined to be coming from the 78nn series of linear regulators I had originally spec'd out for the design for the 5v vco, and dual 3.3v analog and digital supplies. A test of an unused synth I had built (for a beacon project) proved to show quite an impressive improvement once I replaced the regulators:

ADF4107 Phase Noise

Phase noise is shown here on the left with the original noise regulators, and a much cleaner output is shown on the right after the low-noise regulator replacement.

Next item on my list was to add some additional attenuation into the LO path that drives the mixers. Originally when I had a phased lock PLL brick, LO drive power through both outputs was approximately 12dBm. This was ideal for the two Magnum Microwave mixers I was using. After switching to the PLL synth and x4 multiplier, my output to the LO's through a splitter was a little hot at 15dBm. This was the upper max limit of power in the datasheet. This as a result was causing some additional spurs on the RF side, which while immediately filtered was still resulting in some spur leakage. A 3dB pad in line with the output of the x4 multiplier cleaned the excessive spurs up nicely.

The final improvement is in regards to the actual frequency reference itself for the LO PLL freq synth. I had designed my synth to use an on board TCXO protected by a shielded enclosure for both rf shielding and hopefully help stabilize the temperature. Temperature drift is critical in any design, this one was particularly touchy to temperature. When the synth was running and locked to my 2556GHz output frequency, simply blowing air across the TCXO caused the output frequency to start drifting. The specs for the particular crystal I had chosen were not that great at ±2.5ppm over the specified temperature range, I would definitely need to do better for good stability.

I have a rubidium 10MHz reference I use at my bench. I didn't want to devote this just for my mobile station as I use the reference for all of my test equipment. I would also need to frequency double it to work with my ADF4107 PLL as it requires a minimum 20MHz reference. As a compromise, I decided to go with a crystal oven oscillator (OCXO). I had a 20MHz version available that runs off of 12V which will be perfect for this mobile 10GHz station. Details of this will probably be in a separate post due to the difference being pretty interesting.

Anritsu MF76A Repair - Part I

I recently acquired a nice Anritsu MF76A 18GHz frequency counter in a non-working state off of eBay. While older, this is still a very usable counter that goes for quite a bit of money when working. This one sold for cheap so I figured why not, I'm sure I'll be able to get it working. I didn't really need it as I have a good EIP 545A 18GHz counter, but this one looked fun to fix. The images of it indicated that it was powering up and had the cpu portions functional as the display went through its power up cycle and displayed all zeros on the display. Typically with frequency counters in this state and not counting, you either have a failed 10MHz reference or a damaged front end from over-driving the input. I was hoping for the former as I already have a stable rubidium reference I use with all of my gear.

Anritsu equipment is notoriously difficult to repair due to the lack of service manual availability. I ran into the same issue with my second MT8801C communication analyzer / spectrum analyzer that I had purchased in a non-booting state. I was ultimately able to acquire a service manual for it but it took some serious searching and asking around. Once I obtained it, it was nothing like the older HP and Tektronix manuals I was used to. This manual went through a basic troubleshooting process to identify the issue to a board level, no further schematics or information was available (in the manual I had anyway).

Upon arriving, I powered this MF76A up on the bench, it was in good overall condition and did power up as it was supposed to. Upon applying a RF source to either the 200MHz or 18GHz inputs resulted in no counting. In a way this was good, it could indicate an issue further down then the first converter stages. The back of the unit has a switch to either output the internal 10MHz reference or accept an external one. Checking this with a counter, the internal reference is working as expected. Damn. Time to open it up.

The back of the unit had the calibration stickers broken which was expected, this came from a calibration house / test equipment reseller and I'm sure someone mucked around inside with some attempt to repair it. With covers off, everything looked at least complete, this unit was constructed very nicely.

The power supply is tucked into the back of the unit, not the easiest to reach to check voltages, but the power comes off of it and is transferred to the backplane which has wider traces for increased current making it easy to identify. There are no voltage markings or test points on the boards but it was pretty easy to determine which were power. Probing voltages, everything looked fine except for one strange voltage reading which was around +6.8 volts. Also noticing that a -12V rail was present but no +12, I was betting that something simple like a bad cap was holding the +12V rail down to +6.8 volts, very similar to my EIP 545A repair.

Pulling all the boards and reinserting them to locate the source of the issue resulted in the +12V voltage drop being caused by the input IF brick at the front of the unit. This was fed directly from the 18GHz input, the 200MHz input bypassed it and went right to one of the digital boards. As a test I left the 18GHz section unplugged and ran a 50MHz source into the other input. At first there was no response but I realized that one of the coax connectors coming off of the 200MHz input was not connected in the correct location. Whomever had been in this unit messing around didn't put it back together correctly. Once it was where it was supposed to be, success. 50MHz displaying correctly.

So the counter itself is working fine, just the 18GHz converter is causing problems. This was always a concern, you see this often from someone providing too much input and damaging the input section. So while 200MHz is great, 18GHz is why I wanted this counter. At this point I pulled the input brick out and started taking the covers off of it. The cables for this are long enough to allow you to work on it outside of the unit, I so love designs that allow for repairs.

Each side of this brick was made up of multiple boards all of which actually had labeled power input pins. This made locating the problem board very easy. Measuring +12V to ground I was reading roughly 1.2K ohms through all boards. Through process of elimination I was able to isolate the boards that were sinking the +12V down to two boards, both exactly the same. Pulling the +12V cable off of each board returned the rail to normal levels. Both boards were labeled '342U7363', each containing a handful of passives, some transistors and MMICs, along with what looked like a large thick-film precision resistor.

By following the traces on the board and divide and conquering by cutting some traces, I discovered the +12V sinking was actually coming from this large mystery device package. Looking it up, it is an NEC MC-5156 broadband amplifier in a sip package and was nearly shorted from vcc to ground.

Removing these two amplifiers from each board returned the +12V rail to normal, so these two parts were at least indicating to be bad. Was anything else bad? Maybe, it is hard to tell for sure and without a full schematic it is really difficult to trace the signal paths between these boards to guess what else may be blown. Luckily these old amplifiers are still available as NOS from some suppliers, so with two ordered we shall see. Right now with these two amplifiers removed, the unit powers up and counts correctly on the 200MHz input. I am also able to see some RF on the input to each now missing amplifier, so RF is at least getting that far. Is this the only problem? Maybe, maybe not as this would be too easy. I'm betting there are more issues than just this but I can't do any more at the moment until the replacement parts arrive.

Decreasing Phase Noise with Low Noise Regulators

I have posted several times in the past on the PLL frequency synthesizer I designed and built based on the Analog Devices ADF4107. The overall design is a platform for a fractional PLL frequency synthesizer for any frequency range up to about 5GHz.  A single frequency or range could be generated simply by changing out the VCO and loop filter and reprogramming the ADF4107s registers. The design overall has worked very well, I have used it as a LO for a 1.42GHz hydrogen line radio telescope, a 2556GHz LO for my 10GHz ham station, and a 5.4GHz LO for some specific satellite downlinks.

One element of the design that has been less than ideal was the devices phase noise. My specific PLL was on average about 10dB to 20dB under spec of what the documented phase noise should be for similar designs using the ADF4107 and Z-Comm VCOs. After reading to the application notes some more and a recommendation via twitter from Tony (KC6QHP) who suggested looking into using very low noise regulators for the design, I decided to make the change.

Searching regulator semiconductor manufacturers for very low noise versions is not an easy task, often, the noise levels are not available in any parametric search. So to keep things simple, I just went with the ADP150 which is what Analog Devices recommends for their own designs including the ADF4107. Now this is definitely something I should have considered to begin with in the design, but it was my fault for not reading the docs and assuming the basic ST Micro KFNN regulators which I often use would be suitable for a project like this. Looking at the datasheets, the stated noise levels of each are quite a bit apart:

KF33:

OUTPUT NOISE  10 Hz to 100 KHz 50 µV rms

ADP150:

OUTPUT NOISE  10 Hz to 100 KHz  9µV rms

The issue I now have is I had designed the board for standard DPAK package regulators, the ADP150 used tiny TSOT packages. Because of this I would have to be creative in mounting the devices in the DPAK footprints. This turned out to not be too bad of a task although not the most elegant solution.

The results speak for themselves, after replacing the regulators with the ADP150s, phase noise has considerably decreased. I have already started on a version 2 of this synthesizer and I will be definitely switching to these regulators for all future versions.

Standard KF33 and 7805 regulators on the left, low noise ADP150 regulators on the right.

Tektronix 2246 Repair Part II

In the process of debugging the strange intermittent display issue on my Tektronix 2246 after re-capping the power supply, things are not looking so good. Things have actually gone from bad to worse. First of all, the short (or open connection) somewhere in this unit which I can return the unit to normal operation by twisting the chassis has been more difficult to find that planned. I pulled and went through the entire power supply again and did not find any issues. Same for all of the connectors, all are seated correctly without issue. Every screw was in place and I checked to make sure there were no poor grounding issues throughout the scope. What happened next is the result of my own stupid mistake (again) which is just making things worse.

In the process of removing the power supply, you have to remove the high voltage anode cable to the crt which is generated in the main power supply. This cable runs out of the supply towards the front of the unit and has an insulated high voltage connector that is clipped on the the metal chassis between the power supply and front panel board. When I was pulling the power supply out for the third time, I wasn't careful and unplugged this connector only a minute or two after powering the scope down. At this point I let the cable go and it fell towards the A16 main processor board letting a nice spark jump from the high voltage cable to the main board most likely due to stored capacitance that had not been bled off yet. I didn't see exactly where it hit, but it didn't matter. The stored voltage had hit the board and I knew damage had been done. Upon reassembly and power up it was confirmed.

The display was in bad shape at this point, everything to the left say 2/5ths of the display was not showing up and squashed into a vertical line. Definitely not good. So now my priorities have changed, now I have to debug this issue to make sure I haven't burnt out something serious like the main display DACs or readout processors as these would most likely be difficult parts to locate and replace.

I started right with the schematic, which was my next stop anyway in locating the intermittent display issue. The full service manual including schematics is easily available for this scope which is another reason why I love the older Tektronix gear. I focused right away at the character generator and display readout circuitry.

After some probing around, I noticed that output from the A16 processor pcb was odd, the horizontal output drive for the display was not looking right, the bottom half of the waveform was clipped which would explain the left half of the display being smashed into a vertical line. Further up the signal path, the signal was looking correct from the DAC and the multiplexer. So the final op amp stage was looking to maybe be the culprit which makes sense as these op amps definitely wouldn't survive a direct high voltage hit.

Output of mux on left, output after op amp on right

So only the final output stage from the A16 pcb was looking bad, this is a good sign as the actual logic does not look to be damaged. Only the final outputs through an op amp look to have been hit. The op amp in question is a TI TL074. There still may be more damage but I'm going to focus on this op amp for now. I didn't have any in my parts bins, so I placed an order for a handful with Digikey which I should have in a few days. Stand by for part III.

Tektronix 2246 Repair

Last year I had talked about how I accidentally destroyed my Tektronix 2246 oscilloscope by removing the cover. There was a small dent in the metal bottom panel that while removing it had snagged a heatsink on a Motorola 151-0846-00 labeled TO-39 transistor, specifically Q702 on the A10 main board. This ended up ripping the pins out of the transistor can leaving me with a unusable scope. Unfortunately this was not a common part and trying to locate one is next to impossible. I had attempted to use a 2N3866A with no success, the scope was definitely not happy with that transistor in it, an original replacement part would be necessary.

I did ultimately find a donor board. Late last year I found a complete used replacement board on eBay for around $40 which contained both of the 151-0846-00 labeled transistors. This option was definitely cheaper than a whole parts scope and I would hate to ruin another 2246 which may be repairable just for this one transistor. Once I replaced this transistor in my 2246 it was good as new.

I want to focus the attention now to a second Tek 2246 scope that I own with its own set of troubles. I purchased another 2246 a few years ago for cheap, I think it was only around $100. This scope had a lot more use than my original one, while it was in good cosmetic shape it had some issues mostly related to old capacitors. The display was not stable, the character generated osd and cursors would jump around and upon probing the supply rails you could see there was some noise present. A re-cap would be necessary and possibly some additional caps on the A-10 main pcb if necessary.

The 2246 main power supply is pretty basic, much more simple to work on than the Tektronix 2445B power supply which I have also done. One interesting observation upon accessing it is that all of the caps look to be large axial electrolytics:

Trktronix 2446 Power Supply

The bottom of the board told a different story, and once removing a capacitor and testing it was indeed a standard radial cap with an interesting third lead out the top that wasn't connected to anything. Maybe it was designed for additional stability? I know this scope was a popular portable model so my guess it was just some additional ruggedness built into the design. Interesting regardless, at least I can replace them with standard radial caps which are much easier to source.

Replacement caps were all Panasonic 105 degree C. units which are always my first choice, then using Nichicon capacitors in cases where the Panasonic's were not available. The final rebuilt version looked like this:

Tek 2446 Power Supply Rebuild

Quite a difference in size. For good measure I also replaced all of the high voltage film capacitors on the board, many looked stressed as they did in the 2445B. I left the large primary switching capacitor alone, they are rarely every a source of trouble. Everything else looked okay.

This is where things started to get interesting. After putting everything together and powering the scope back up, I had strange display issues. The entire display was shifted left. I started looking around to see if I had missed a cable or possibly had a connector loose during the reassembly but didn't see anything obvious. This scope was working just fine before the power supply rebuild so this issue was definitely something that I caused. At this time I went to turn the scope over on its side while powered up that the display snapped back into alignment. After some more poking around I realized that if I put pressure on the chassis, twisting it just lightly I could get the display back in alignment. So it must be a bad ground, loose connector, bad solder joint, or some other mechanical failure where putting pressure on the chassis would complete whatever broken connection was occurring. It will just be a matter of tracing down where the issue is at. More to come in part II.

Large Display for GPS Disciplined Time Server

Since building my own GPS disciplined local time server I have wanted a large display of some sort to display my super accurate clock. The primary purpose of doing this was really just because it would be rally really cool looking. I also have a personal issue with any clock that does not set itself from the WWVB or support NTP, in 2015 we shouldn't have to manually set clocks anymore. A secondary use for doing this would be for ham radio purposes. A nice large clock that is always accurate so I can easily and quickly log contacts in UTC would be very useful. Ultimately I ended up with a very nice solution and here is the result:

ESE ES-166 timecode display used for GPS clock

Searching for someone who makes such a clock was frustrating. It seems either you can have a large format clock for cheap that does not support NTP, or you can have one that does support NTP but costs hundreds of dollars. Designing and building my own was the next option that I had considered for awhile. A simple PIC based device that drives some large 7 segment led displays would be trivial to build, but I couldn't get into the project. It just didn't excite me, It's one of those things that would be so simple and mundane that I just couldn't drive myself to do it. It would be like a software engineer being assigned the task of writing a word processor. It's already been done so many times and is such an unfulfilling project you can just never get excited about it.

So on to Plan C. Let's see what's already available and either modify or make it work for my intended use. Basically I would be looking for a large LED, backlit LCD, or big VFD display of some sort that would be able to easily display time. Input can be via various means, ethernet or serial would be first choices, some other parallel type interfaces would be not ideal although I could still make it work if needed. Luckily having some experience is professional video editing when I was in college, I looked towards something I felt might me the perfect solution: Timecode displays.

Upon scrounging around I found a perfect device on eBay, an ESE-166 remote timecode display. These can be found for less than $50 at times are are beautiful pieces of gear. It is a big 2U rack mount enclosure with a nice large format LED display on the front panel. This display is designed for displaying accurate time code for video editing systems. The particular display I purchased had hour, minute, and second digits which would be perfect. Many time code displays also include a 4th digit section for frames which this one did not as I did not need it for my purpose. The inputs on these devices are typically a single 75ohm timecode serial input for SMPTE timecode. I was fine with this as designing some hardware to convert an rs232 serial stream to SMPTE timecode actually sounded pretty fun, but I ended up not needing to. This specific display also included an rs232 serial input that supports a few ASCII time formats. This would be a perfect solution, just have a script that takes my local time directly off of the time server itself and dump it out the serial port to this display. There would be some very minimal latency with this obviously, but regardless this solution would be perfect! The ASCII format I chose to use is as follows:

Format #0: (CR)(LF)I(^)(^)DDD(^)HH:MM:SS(^)DTZ=XX(CR)(LF)

As for getting the time data into the ESE, it has two runtime options set by some dip switches inside. The first is a free running clock that when the serial port receives a time string, it updates the internal clock to the time received. The second option does not free run, you simply continuously provide the time signals to update at the interval you specify. In this option, you would need to provide the time signal at least once a second to keep the display real time. For now, I went with the first option. I have the ESE free running with a cron dumping data from my NTP server sending an rs232 time string via cron every five minutes. The noticeable time drift of this clock over a five minute period is not noticeable at all and this solution keeps the clock up to date on five minute intervals without having to constantly send it serial data.

For those that are curious what is inside the ESE ES-166, it is pretty basic:

There is a whole lot of room in that chassis with not very much there. Just a mains transformer and simple analog rectified power supply with a handful of logic to decode the SMPTE / serial port data and drive the display. I'm planning on moving my Trimble GPS receiver inside of this case as there would be plenty of room for it. This would consolidate some of the hardware laying in the back of my server rack.

Additionally the manual for the ES-166 includes a schematic which is also nice to see. There was one part of the design that I really loved, the rs232 to TTL translation:

There is no serial driver there, MAX232 or equivalent. Just a simple level converter based on a 2n2222 with a diode and resistor. I love it! You see MAX232s in everything these days when they are often just not needed for serial RX conversion.

Further plans include racking this unit in my server rack and possibly getting a second unit so I can display both local time and UTC.

IoT Security Fail

So I am not a huge fan of the whole Internet of Things movement that is going on right now, mostly due to the recent lack of any real security or thought of security being placed into these IoT devices. A more accurate name for the IoT would be the Internet of Insecure Things (IoIT). Recent (or not so recent) news of consumer home wireless access points and routers being compromised and used for various botnets are one example of this concern, and this is just one small example. Home routers, thermostats, IP cameras, VOIP phones, DVRs, smart TVs, etc, all things that can contain embedded firmware of now outdated or obsolete libraries that are exploitable. And if they are not exploitable, great, there is probably just some hard coded admin user and password in the device or another debugging backdoor that was forgotten to be disabled.

'Junk Hacking' is a term I like that is used to describe people finding exploits in these devices, it seems every week there is some new little embedded device that has a vulnerability. Stop. When these stories break, everyone always seems to be surprised that there is a backdoor or other exploit on IoT device N. Really?! Of course there was a vulnerability on it! I would have only been surprised if there wasn't! I go by the opinion that every device is vulnerable. Proving me correct is not difficult, proving me wrong on the other hand would actually be impressive.

Now sure, most of these devices (with exception to the router itself) will live on a home private network and all have private ip's assigned by the routers DHCP server, so risk to them should be very minimal even if they are vulnerable in some way or another, although wireless devices are an exception. Some vulnerabilities require physical access to the device as well, which imo is not really a vulnerability (anyone can re-flash devices if it's physically in your hands ). That said, it is amazing how many of these devices end up being publicly accessible on the internet, either on public ips themselves or port forwarded to private ips. Not excluding commercial and industrial devices as well, they are also exposed everywhere. Everything is just hanging out waiting to be poked at. Having convenience over security seems to be the norm.

Favoring backwards compatibility is another issue that needs to be overcome. 'Well, it needs to work on IE6!' No, actually it doesn't, and it definitely shouldn't. This mentality needs to go away. Software goes obsolete for a reason, and that is because it's usually broken. This rule needs to be enforced by all.

The wireless side of things is the same story. Wireless ISM band mesh devices are the new hotness with everything communicating over ZigBee, Z-Wave, or other protocols. You don't need to look hard or far to find known vulnerabilities in these protocols or tools to sniff these networks. While sure, newer devices will have updated firmware with possibly better encryption and security, what about all of the existing devices in the wild?

While manufacturer of devices intentions may be good to keep devices secure and up to date, the real result of these devices is that none of them actually are. The OpenSSL vulnerabilities that occurred last year and recently are an example of these concerns. How many of these devices are still running an old version of OpenSSL? Probably most, unless of course you have updated your firmware, which I know usually never actually happens. This is assuming new firmware is even available.

This issue of updating these home devices to keep them up to date ends up being your (the consumers) responsibility. Manufactures are more than capable of having their devices auto update when new firmware comes available, but the risk and cost would be too high in doing so. The day that the device auto updates and becomes a brick because of a mistake is just too high, especially if it happens to thousands of devices. Manufacturers could of course design in fail-safes to prevent this, things like dual flash memories for running and updated configs allowing a rollback option, but this would of course increase costs. Plus manufactures don't want to have to support their own devices, that is just additional cost.

So the result is it is your responsibility as the consumer to make sure your device stays up to date. I'm not okay with this, but you have no choice. The alternative is to not use the device, if it isn't on, it is not vulnerable. The real issue falls onto the larger portion of the population that doesn't really know or understand, or care to know or understand security, networking, or recent CVE listed identifiers that come out, not to mention understand the actual details of the vulnerability. It is this group of the population that results in everything being at risk, but I don't believe they should be held responsible. Maybe manufacturers should be responsible for the security and patching of their own devices. Maybe they should not be designed so insecure in the first place.

So what is the solution? Should manufacturers be more security minded and allow automatic updates to all IoT based devices? Sure, that would be a good start. Putting any actual thought and time into security in the first place would be another great idea. Having anyone who actually knows anything about security audit your product before production would probably catch a lot of the really stupid mistakes. Another thought would be to not make every device IoT enabled if it doesn't half to be in the first place. Just because something could be internet enabled doesn't mean it should be. I'm pretty sure I have been hearing news of internet enabled refrigerators for over 10 years now, even seen one or two in some stores. Everyone thinks its neat and cool and somehow it will be useful as it solves a problem that doesn't exist. I just know it will be end up being another vulnerable device.

Stratum 1 Time Server Based on a Trimble Placer GPS 450 with PPS Output

Setting up GPS disciplined stratum-1 timeservers are not a new or technically difficult task, plenty of articles are already available including some excellent ones from David Taylor's satsignal.eu site. The basic idea behind using a GPS device as a stratum-0 reference is the ability to have a very low latency and low jitter accurate local time source. The only complicated part is finding or modifying a GPS receiver that can provide a precise 1 pulse per second source.

This post is going to focus on a simple, inexpensive, and somewhat elegant solution based on a Trimble Placer 450 GPS receiver. The Trimble 450 is by no means a modern device. It was originally produced in the 1990s and used within vehicles for fleet management purposes. It is large compared to modern units and is also only an 8 channel receiver that uses only satellites in the US GPS satellite constellation. The reasons why I really like the Trimble 450 are that is is very rugged and well designed (as it was to be used in the field). It can also run off of a wide voltage supply range and it is easily modified for a true precise 1 pulse per second (PPS) output which is the key part to having an accurate stratum-1 time server.

Trimble Placer GPS 450s are plentiful (there are available on eBay all the time for less than $15 including shipping). I had a unit myself sitting in a parts box for maybe 10 years that I picked up somewhere for free, this is why I went with this unit to begin with as my time source. I also love re-purposing old and somewhat obsolete inexpensive hardware. You will need an external active GPS antenna to use with it, any cheap ones from China will work, the one I purchased was $6. Note you will need an antenna with an MCX connector (or adapter) to interface to it. One additional nice thing about the 450 is you can easily replace the on-board MCX connector with an SMA, BNC, etc if you wish.

By default the Placer 450 outputs a Trimble ASCII Interface Protocol (TAIP) serial datastream, but this is easily changeable to NMEA-0183 strings. Going through the docs I believe gpsd is capable of decoding TAIP messages, but I didn't spend the time to try. TAIP is a binary format and while it is a brief and compact data format, I like the human readable NMEA output strings as they can provide visual output of  your GPS devices status. The Placer 450 can be switched to NMEA with the following commands:

       
>SPR:NMEA=TT<
>SRTSAVE<

Once switched to NMEA, it will provide the following standard strings: GPZDA, GPGGA, GPGLL, GPGSA, GPVTG, and GPRMC. I recommend reading the Trimble Placer 450 manual as it does have good information if you are unable to successfully communicate to the device via RS-232. There is also an old dos based configuration utility available that you can use to program it and switch its output to NMEA format. You will need a machine running win98 or older to run it though. I keep an ancient Pentium 133 machine around for programming old Motorola radios and I had no issues using it for programming the 450.

If your Placer 450 has been sitting around for years without being used, its internal GPS almanac is going to be extremely outdated. This resulted in a cold start of mine taking about an hour to finally acquire four satellites for 3D navigation and update its GPS almanac. Any subsequent warm starts after this will lock on within about 60 seconds. This would also be a good time to check the internal lithium battery. The memory in the Placer 450 is volatile and if the battery is bad every power on will result in a cold start. Checking on my receiver, the battery was fine.

PPS Output

Utilizing the PPS output of a GPS receiver is really the most important part of having a truly disciplined stratum-1 time server. Not all GPS receivers offer a true 1-PPS reference, fortunately the Placer 450 does, it just isn't where it needs to be. While the NMEA strings that come off of the GPS receiver contain accurate time data, various delays through the serial communication result in a time reference that has significant latency and jitter. This usually ends up being no better time keeping than just pointing your time server to another stratum-1 server. That said, the GPS time is still useful for events where internet connectivity is lost or unreliable.

The PPS output provides an extremely accurate time pulse that occurs once per second. Ntpd ( or your time server software of choice) can use this pulse to keep extremely accurate time. I will only be discussing the integration of ntpd in this post. The Placer 450 does indeed have a PPS output, unfortunately this output is on a separate DB-9 data connector. Probing its output on a scope, this pulse is clearly visible and has a very fast falling edge when it occurs (1.1 microseconds on average).

Now that we know we have an accurate PPS pulse, we need to get it into the computer running ntpd as quickly and with as little latency as we can afford. The solution to this is to send the pulse across the serial port on an unused pin (data carrier detect is standard to use in this case) which will drive an interrupt on the ntpd machine. In regards to the Placer 450, I decided to take this negative edge pulse, feed it into a max232 serial driver and send it down the unused DCD pin on the serial port. This worked perfect as the max232 inverts the data and results with a positive ~+15V RS-232 compliant pulse. The final setup of this is shown here:

The small blue board I added contains the max3232c serial driver and necessary charge pump capacitors. I pulled +5 volts off of a positive rail on the Placer 450 along with ground. Since the DCD pin on the RS-232 connector was unused, this modification was very simple. I also removed the original 3 pin power connector and hardwired it to +12v as there is no reason to worry about sourcing an original power cable. Since these devices are usually pulled from service, the original wiring harnesses usually never stay with the unit. Here is the resulting outgoing pulse through the max3232c:

Now that we have the pulse going to the NTP server via the DCD pin over RS-232, we need to verify its operation. Any modern Linux distribution will have PPS support built into the kernel, the serial module for PPS will just have to be loaded. To verify the arriving pulses, you can use pps-tools which is available for most distributions. The following output from ppstest shows my arriving 1 PPS pulse indicating my hardware modification is working.

       
[root@time01 ~]# ppstest /dev/pps0
trying PPS source "/dev/pps0"
found PPS source "/dev/pps0"
ok, found 1 source(s), now start fetching data...
source 0 - assert 1417642033.999999820, sequence: 226503 - clear  1417642033.000028598, sequence: 173333
source 0 - assert 1417642035.000000722, sequence: 226504 - clear  1417642034.000021949, sequence: 173334
source 0 - assert 1417642035.999999642, sequence: 226505 - clear  1417642035.000022821, sequence: 173335
source 0 - assert 1417642036.999999339, sequence: 226506 - clear  1417642036.000023328, sequence: 173336

One note regarding serial to USB adapters. I was using one initially and was not seeing the pulse arriving on my machine. Once I switched to the onboard serial port (/dev/ttyS0) my pulses were immediately visible. If you are going to use a USB adapter, make sure that it supports the DCD pin as mine did not.

A few more prerequisites are needed including having gpsd installed along with ntp. The ntpd configuration is really the last critical step, in the case of my Placer 450, the following configuration is used:

       
# GPS reference
server 127.127.28.0 prefer
fudge 127.127.28.0 refid GPS

# PPS reference
server 127.127.22.0 minpoll 4 maxpoll 4
fudge 127.127.22.0  flag3 1  refid PPS

How this configuration works and what it should be set to could be an entire separate discussion, luckily it is documented very well. Basically the ip addresses shown above are driver interfaces to the gps NMEA serial interface and the kernel PPS. Once ntpd is restarted, checking ntp's status you will see the following:

       
[root@time01 ~]# ntpq -p

     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
-time3.chpc.utah 198.60.22.240    2 u    2   64  377   71.766   14.708   0.200
-time.tritn.com  66.220.9.122     2 u   39   64  377   71.081    2.188   3.051
+segfault.boom.n 216.218.254.202  2 u   25   64  377   45.549   -4.891   0.548
+50.7.72.4       128.138.141.172  2 u   31   64  377   58.978   -4.452   0.654
*SHM(0)          .GPS.            0 l    8   64  377    0.000  -71.444   4.780
oPPS(0)          .PPS.            0 l   12   16  377    0.000   -0.001   0.001

A few things to note in the above output:

1. Both the GPS and PPS sources now show up in the ntp output.
2. The tally flag for the GPS source is '*' indicating it is a system peer.
3. The tally flag for the PPS source is 'o' indicating the system sync is derived from a PPS signal.
4. Jitter on the PPS source is significantly lower than the other network based sources.
5. The jitter and offset for the GPS source are higher than other sources, this is expected as the serial communication latency between the Placer 450s NMEA strings and server is not guaranteed.

The next steps are to monitor and log the time servers accuracy and precision over time to see how much drift there is with the GPS source and without. After some basic testing it seems to be much improved but only time will tell.