[time-nuts] Lucent KS-24361, HP/Symmetricom Z3809A, Z3810A, Z3811A, Z3812...

GandalfG8 at aol.com GandalfG8 at aol.com
Wed Nov 5 07:20:00 EST 2014

For what it's worth, here's what happened when I linked two Ref-1 units  
One was fitted with it's GPS module as normal, I'll call this Ref-1.
The other was as normal other than having it's GPS module removed, I'll  
call this Ref-1-0.
The link cable was around 15 inches long and wired 1-15, 2-14, etc, using  
standard 15 way high density plugs.
BTW, whereas shortened pins have been used in the past to ensure safe power 
 up sequences I'm pretty sure that on the Z3809A cable it's perhaps a  
precaution to reduce the risk of bringing down the base station when hot  
I've noticed that removing my "faker" plug once a stand alone Ref-1 is  up 
and running starts to flash the Standby light but doesn't otherwise inhibit  
operation, the 15MHz and 1PPS outputs remain available. I don't know how 
long  this might continue but the system obviously responds differently once  
fully booted to when it's first powered and I suspect the use of shortened  
pins could be related.
Anyway, back to the two linked....
At power up both go through the flashing light sequence, then...
Ref-1-0 -- "No GPS" - Flashing, "Fault" - Solid
Ref-1 ------"No GPS" - Solid, "Fault" - Solid
After the boot period finishes.....
Ref-1-0 -- "No GPS" - Flashing, "Fault" - Solid
Ref-1 ------"Standby" - Solid, all other lights off.
Both units will talk via the J8 diagnostics port as soon as powered up but  
Ref-1-0 behaves just as one would expect if the GPS module is removed, and 
it  doesn't seem to be relaying any data from the Ref-1 unit, whilst  Ref-1 
shows what looks to be a normal acquisition sequence, the onset of  
conditioning, and a self survey
At no time is there a 15MHz or 1PPS output available from either  unit.
Although it's been conjectured that the firmware is identical in the Z3811A 
 and Z3812A, and the Prom markings certainly seem to confirm this, it would 
also  seem that there must be something that tells the unit what it is, 
either by a  firmware difference somewhere after all or perhaps a link on the 
board  somewhere.
This isn't just based on my not very successful experiment, although the  
results are no great surprise:-), but my Ref-1 units always report  
themselves to monitoring software as a "Z3811A Secondary Receiver".
Based on this am I correct in thinking that a standard Ref-0 would report  
as a "Z3812A Primary Receiver"?
If so it has to get this information from somewhere.
In a message dated 04/11/2014 09:38:25 GMT Standard Time,  
stewart.cobb at gmail.com writes:

A wiring  diagram of the Z3809A cable interconnect cable was published
earlier on  this list.  That information appears to be incorrect.  The
cable  is actually wired pin 1 to pin 15, pin 2 to pin 14, etc.
Another way to  describe it is that for each wire in the cable, the pin
numbers on each end  of the cable add up to 16.

A mated pair of these units is running in my  lab with a scratch-built
interconnect cable following the above  rules.  This scratch-built
cable allowed access to the interconnect  signals while the system was
operating happily.  No lights were lit  except the green ON light on
the Ref-0 unit (Z3812A, no GPS) and the yellow  STBY light on the Ref-1
unit (Z3911A with GPS receiver).  The  following signals were observed
on the interconnect (pin numbers given for  the J5 interconnect socket
on the Ref-1 unit):

Pin 1:  9600  baud serial data (described below)

Pin 2:  logic low  (0.11V)

Pin 3:  Ground (0.00V)  Presence detect? (see  below)

Pin 4:  logic high (4.79V)

Pin 5:  inverted  Motorola PPS, high (5V) for 800ms, low for 200ms

Pin 6: "17 / 23 dBm"  signal from Ref-0 unit (see below)

Pin 7:  logic high  (4.48V)

Pin 8:  Ground (0.00V)

Pin 9:  logic low  (0.11V)

Pin 10: "17 / 23 dBm" signal from Ref-1 unit (see  below)

Pin 11:  inverted PPS, low 400us, high (5V)  otherwise

Pin 12:  logic low (0.12V)

Pin 13:  Ground  (0.00V)

Pin 14:  logic low (0.08V)

Pin 15:  logic high  (4.78V)

Pins 3, 8, and 13 appear to be firmly connected to  Ground.  (Note that
these are the three pins which are clipped short  on the HP
interconnect cable.)  On an unpowered, disconnected box  (either Ref-0
or Ref-1), pins 8 and 13 are connected to Ground (low  resistance) and
pin 3 is high impedance.  Presumably pin 3 on each box  (connected to
the grounded pin 13 on the other box) is used to sense the  presence of
the other box and/or the interconnect cable.

The timing  of the PPS signal on pin 11 matches precisely the timing of
the PPS signal  available on pins 1 and 6 of J6 (RS422/PPS) on the
active Ref-0 unit.   Presumably this signal is coming across the cable
from the Ref-0  unit.

Note: when the system is coming up from a cold start, SatStat on  the
unit with the GPS receiver (Ref-1) will show "[Ext 1PPS valid]" in  the
space where it shows "[GPS 1PPS valid]" after the survey is  complete.
It appears that the Ref-1 unit timing system is locking its  oscillator
to the PPS coming from the Ref-0 unit during this  time.

The timing of the PPS signal on pin 5 matches the timing of the  PPS
output described in the Motorola OnCore manual.  Presumably  this
signal is sourced by the Ref-1 unit to allow the Ref-0 unit to lock  to
GPS.  The edges of this PPS signal look very dirty compared to  the
signal on pin 11.  This may be an artifact of the homemade cable  used
for this experiment.  The HP cable clearly has an overall  shield
(visible through the cable sheath) and may have internal coax  or
twisted pair for these PPS signals.

When pin 5 and pin 11 are  observed together, the usual GPS sawtooth
pattern is  evident.

Someone discovered earlier that the both units will blink  their green
ON lights if the front-panel switch on either unit is set to 23  dBm
vice the normal 17.  Obviously each unit can communicate its  switch
status to the other unit.  They use pins 6 and 10 to do  that.  Pin 10
(on the Ref-1 unit) is high (~5V)  if the switch on  the Ref-1 unit is
in the 17 dBm position, and low in the 23 dBm position.  Pin 6 (on the
Ref-1 unit) gives the same indications for the switch on the  Ref-0

The serial data on pin 1 is transmitted at 9600 baud,  with a burst of
data every second.  The signal idles at logic low  (near 0V) and rises
to logic high (near 5V) during the burst.  This  may be the standard
for TTL (not RS-232) transmission of serial data, or it  may be
inverted.  The first few characters of one burst were  hand-decoded
from a scope trace as 0x40, 0x40, 0x45, 0x61, 0x0B, or ASCII  "@@Ea".
This appears to be the Motorola Oncore binary data format,  although
"Ea" does not appear to be a valid Motorola command or  response.
Perhaps the hand-decoding was in error.

One can use  SatStat, talking to the Ref-0 (non-GPS) box, to issue
queries and commands  to the GPS receiver.  The results are
inconsistent, but it seems that  at least some of the queries get
through and trigger responses.  If  the Ref-0 box is actually talking
to the GPS receiver, it must be doing so  through the interconnect
cable.  The specific wire in the cable used  for this (if any) has not
yet been identified.

An earlier post  speculated that the computer in each unit only had two
UARTs.  This  does not seem possible.  Clearly each unit uses one UART
to  communicate with the J8 diagnostic port.  The Ref-1 unit needs
another  UART to communicate with the GPS receiver. And both units need
to be able  to transmit the legacy Lucent timecode message out the J6
(RS422/1PPS)  port.  Perhaps there is a transmit-only UART coded into
the FPGA, or  perhaps one of the UARTs is timeshared with the Lucent
message, or perhaps  there is another UART chip hidden somewhere on the

It seems  unlikely that the two units are sending serial data to each
other.   (No such data was observed on the interconnect.)  Instead,
they appear  to communicate their state to each other by means of logic
levels on  various pins of the cable.  The logic functions of pins 6
and 10 have  already been identified.  Further research is  needed.

time-nuts  mailing list -- time-nuts at febo.com
To unsubscribe, go to  
and follow the  instructions there.

More information about the time-nuts mailing list