Firmware WNRO fix for S300/S350 and XLi
As many folks on this list are probably aware, the GPS week number
rollover (WNRO) periodically causes older GPS receivers to misbehave.
One solution is to replace the problematic GPS module with a newer one.
But many of these older modules will still work, they just need a bit of
help, in the form of providing a hint about the current year.
The Symmetricom SyncServer S300/S350 and the older XLi units both use an
HCS12 microcontroller to interface with the GPS module. This
microcontroller is in the perfect position to send the "set time"
command to the GPS module during start-up. It's unfortunate that
Symmetricom didn't implement something like this in the firmware, for
instance to pass the time to the GPS receiver when the time is manually
set on the unit. Fortunately, not only are these microcontrollers not
code-protected, but the firmware for the HCS12 microcontroller on the
S300/S350 is actually included on the CF card so it can be installed
during an upgrade. So, with a bit of work in Ghidra, I managed to sort
out how to patch the firmware to set the initial date on the GPS
receiver. With the patch applied, it should be possible to get some
more life out of GPS receivers that would otherwise not be usable due to
WNRO, including the Furuno GT-8031F modules as well as iLotus M12M
modules with older firmware. Symmetricom kindly put BDM headers on
their boards, so all that's needed to install the modified firmware is a
USBDM adapter, which runs for around $30.
It may also be possible to build similar patches for other units, such
as the S200/S250. But currently I only have access to S350 and XLi.
Unfortunately, cannot distribute the modified firmware for copyright
reasons, and I don't yet have a comprehensive write-up of how to apply
the patch yourself. It's also not particularly well-tested as I just
got it working last night. In the meantime, if anyone is interested in
these patches, please contact me directly.
--
Alex Forencich
Hello Alex,
Amazing work!
Just last night, I was working on my hardware rollover solution for my SyncServer S200 with GT-8031.
Instead of patching the firmware, I have a simple hardware interposer with an RP2040-zero that intercepts the messages from the GT-8031, changes then, and forwards the modified data to the motherboard.
This solutions works at patching the date, but for reasons unknown, the S200 still refuses to lock to the 1PPS after that.
Meanwhile, my ILS module (which also has experienced the rollover) locks fine with or without patching the date.
I have a script that decodes the whole data stream of both modules but so far haven’t figured out what it is between those modules that makes the S200 lock to the 1PPS or not.
I would love to compare the difference in data stream between my original GT-8031 and one that has your patched version.
But if anyone has insights about how the week rollover can prevent the S200 to sync to the 1PPS on one kind of module but not the other, that would be extremely useful too. I’m not really interested in the time serving abilities of the S200, I only want to use it as a GPSDO.
Tom
On May 30, 2024, at 2:04 AM, Alex Forencich via time-nuts time-nuts@lists.febo.com wrote:
As many folks on this list are probably aware, the GPS week number
rollover (WNRO) periodically causes older GPS receivers to misbehave.
One solution is to replace the problematic GPS module with a newer one.
But many of these older modules will still work, they just need a bit of
help, in the form of providing a hint about the current year.
The Symmetricom SyncServer S300/S350 and the older XLi units both use an
HCS12 microcontroller to interface with the GPS module. This
microcontroller is in the perfect position to send the "set time"
command to the GPS module during start-up. It's unfortunate that
Symmetricom didn't implement something like this in the firmware, for
instance to pass the time to the GPS receiver when the time is manually
set on the unit. Fortunately, not only are these microcontrollers not
code-protected, but the firmware for the HCS12 microcontroller on the
S300/S350 is actually included on the CF card so it can be installed
during an upgrade. So, with a bit of work in Ghidra, I managed to sort
out how to patch the firmware to set the initial date on the GPS
receiver. With the patch applied, it should be possible to get some
more life out of GPS receivers that would otherwise not be usable due to
WNRO, including the Furuno GT-8031F modules as well as iLotus M12M
modules with older firmware. Symmetricom kindly put BDM headers on
their boards, so all that's needed to install the modified firmware is a
USBDM adapter, which runs for around $30.
It may also be possible to build similar patches for other units, such
as the S200/S250. But currently I only have access to S350 and XLi.
Unfortunately, cannot distribute the modified firmware for copyright
reasons, and I don't yet have a comprehensive write-up of how to apply
the patch yourself. It's also not particularly well-tested as I just
got it working last night. In the meantime, if anyone is interested in
these patches, please contact me directly.
--
Alex Forencich
time-nuts mailing list -- time-nuts@lists.febo.com
To unsubscribe send an email to time-nuts-leave@lists.febo.com
I suspect the GPS module may be detecting that something is wrong, and reporting this via some status field. I noticed similar behavior on my unit as well - the GPS status page on my S350 never reported as "locked" with the Furuno GPS module. But, now that you have an interposer, presumably you should be able to do what my patch does; set the correct year on the GPS with the Gb command. Just send that command after the S200 sends the Cf command to reset the GPS.
On your S200 web UI, what does "hardware clock version" say?
Alex Forencich
On 5/30/24 04:57, Tom Verbeure wrote:
Hello Alex,
Amazing work!
Just last night, I was working on my hardware rollover solution for my SyncServer S200 with GT-8031.
Instead of patching the firmware, I have a simple hardware interposer with an RP2040-zero that intercepts the messages from the GT-8031, changes then, and forwards the modified data to the motherboard.
This solutions works at patching the date, but for reasons unknown, the S200 still refuses to lock to the 1PPS after that.
Meanwhile, my ILS module (which also has experienced the rollover) locks fine with or without patching the date.
I have a script that decodes the whole data stream of both modules but so far haven’t figured out what it is between those modules that makes the S200 lock to the 1PPS or not.
I would love to compare the difference in data stream between my original GT-8031 and one that has your patched version.
But if anyone has insights about how the week rollover can prevent the S200 to sync to the 1PPS on one kind of module but not the other, that would be extremely useful too. I’m not really interested in the time serving abilities of the S200, I only want to use it as a GPSDO.
Tom
On May 30, 2024, at 2:04 AM, Alex Forencich via time-nuts time-nuts@lists.febo.com wrote:
As many folks on this list are probably aware, the GPS week number
rollover (WNRO) periodically causes older GPS receivers to misbehave.
One solution is to replace the problematic GPS module with a newer one.
But many of these older modules will still work, they just need a bit of
help, in the form of providing a hint about the current year.The Symmetricom SyncServer S300/S350 and the older XLi units both use an
HCS12 microcontroller to interface with the GPS module. This
microcontroller is in the perfect position to send the "set time"
command to the GPS module during start-up. It's unfortunate that
Symmetricom didn't implement something like this in the firmware, for
instance to pass the time to the GPS receiver when the time is manually
set on the unit. Fortunately, not only are these microcontrollers not
code-protected, but the firmware for the HCS12 microcontroller on the
S300/S350 is actually included on the CF card so it can be installed
during an upgrade. So, with a bit of work in Ghidra, I managed to sort
out how to patch the firmware to set the initial date on the GPS
receiver. With the patch applied, it should be possible to get some
more life out of GPS receivers that would otherwise not be usable due to
WNRO, including the Furuno GT-8031F modules as well as iLotus M12M
modules with older firmware. Symmetricom kindly put BDM headers on
their boards, so all that's needed to install the modified firmware is a
USBDM adapter, which runs for around $30.It may also be possible to build similar patches for other units, such
as the S200/S250. But currently I only have access to S350 and XLi.Unfortunately, cannot distribute the modified firmware for copyright
reasons, and I don't yet have a comprehensive write-up of how to apply
the patch yourself. It's also not particularly well-tested as I just
got it working last night. In the meantime, if anyone is interested in
these patches, please contact me directly.--
Alex Forencich
time-nuts mailing list -- time-nuts@lists.febo.com
To unsubscribe send an email to time-nuts-leave@lists.febo.com