[time-nuts] Re: Firmware WNRO fix for S300/S350 and XLi

[Tom Verbeure]

Hello Alex,

Amazing work!

Just last night, I was working on my hardware rollover solution for my SyncServer S200 with GT-8031. 

Instead of patching the firmware, I have a simple hardware interposer with an RP2040-zero that intercepts the messages from the GT-8031, changes then, and forwards the modified data to the motherboard. 

This solutions works at patching the date, but for reasons unknown, the S200 still refuses to lock to the 1PPS after that. 

Meanwhile, my ILS module (which also has experienced the rollover) locks fine with or without patching the date. 

I have a script that decodes the whole data stream of both modules but so far haven’t figured out what it is between those modules that makes the S200 lock to the 1PPS or not. 

I would love to compare the difference in data stream between my original GT-8031 and one that has your patched version. 

But if anyone has insights about how the week rollover can prevent the S200 to sync to the 1PPS on one kind of module but not the other, that would be extremely useful too. I’m not really interested in the time serving abilities of the S200, I only want to use it as a GPSDO. 

Tom
 




> On May 30, 2024, at 2:04 AM, Alex Forencich via time-nuts <time-nuts at lists.febo.com> wrote:
> 
> As many folks on this list are probably aware, the GPS week number
> rollover (WNRO) periodically causes older GPS receivers to misbehave. 
> One solution is to replace the problematic GPS module with a newer one. 
> But many of these older modules will still work, they just need a bit of
> help, in the form of providing a hint about the current year.
> 
> The Symmetricom SyncServer S300/S350 and the older XLi units both use an
> HCS12 microcontroller to interface with the GPS module. This
> microcontroller is in the perfect position to send the "set time"
> command to the GPS module during start-up.  It's unfortunate that
> Symmetricom didn't implement something like this in the firmware, for
> instance to pass the time to the GPS receiver when the time is manually
> set on the unit.  Fortunately, not only are these microcontrollers not
> code-protected, but the firmware for the HCS12 microcontroller on the
> S300/S350 is actually included on the CF card so it can be installed
> during an upgrade.  So, with a bit of work in Ghidra, I managed to sort
> out how to patch the firmware to set the initial date on the GPS
> receiver.  With the patch applied, it should be possible to get some
> more life out of GPS receivers that would otherwise not be usable due to
> WNRO, including the Furuno GT-8031F modules as well as iLotus M12M
> modules with older firmware.  Symmetricom kindly put BDM headers on
> their boards, so all that's needed to install the modified firmware is a
> USBDM adapter, which runs for around $30.
> 
> It may also be possible to build similar patches for other units, such
> as the S200/S250.  But currently I only have access to S350 and XLi.
> 
> Unfortunately, cannot distribute the modified firmware for copyright
> reasons, and I don't yet have a comprehensive write-up of how to apply
> the patch yourself.  It's also not particularly well-tested as I just
> got it working last night.  In the meantime, if anyone is interested in
> these patches, please contact me directly.
> 
> --
> Alex Forencich
> 
> _______________________________________________
> time-nuts mailing list -- time-nuts at lists.febo.com
> To unsubscribe send an email to time-nuts-leave at lists.febo.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: IMG_5994.jpeg
Type: image/jpeg
Size: 253911 bytes
Desc: not available
URL: <http://febo.com/pipermail/time-nuts_lists.febo.com/attachments/20240530/895c48ae/attachment.jpeg>