[time-nuts] Lucent KS-24361, HP/Symmetricom Z3809A, Z3810A, Z3811A, Z3812...

R.Phillips phill.r1 at btinternet.com
Sun Oct 26 10:18:20 EDT 2014

Bob & others
I have the Lucent pair, RFTG-m XO and m-Rb and I have never succeeded in 
obtaining an interface to communicate with them. Is it possible that with so 
many manufacturers being involved with the specification and build, that an 
interface is available ?

-----Original Message----- 
From: Bob Camp
Sent: Saturday, October 25, 2014 2:09 AM
To: Discussion of precise time and frequency measurement
Subject: Re: [time-nuts] Lucent KS-24361, HP/Symmetricom Z3809A, 
Z3810A,Z3811A, Z3812...


The days of published schematics started to draw to a close 15 or 20 years 
ago. By the time the Z3xxx’s came out, they probably didn’t even generate a 
“publication ready” schematic.

Troubleshooting this sort of gizmo simply does not make economic sense. Swap 
out the power supply, swap out the OCXO, swap out the GPS module, swap out 
the front panel ( or any other attached board). If that doesn’t fix it - 
scrap out the unit. If you are not going to use the schematic for repairs, 
the only thing it does is make it easy for your competition to clone the 

The “swap whole assemblies” thing started at least 10 years before the 
schematics went away. Back then you could easily see why. Custom ASIC this, 
custom screened / selected that, non-standard something else. Guess what 
*always* broke? Guess which part took a “factory only” test set to calibrate 
if you did somehow replace it? (hint - they are the same part ….).

It’s not just the field repair end of things that have gone this way. The 
manufacturing line has done the same thing. Put it together right the first 
time. Scrap something less than 0.5% of the finished assemblies. You can’t 
afford to set up to replace stuff like fine pitch BGA’s for the money you 
would recover on 0.5%. Spend the same money on process control as you used 
to on troubleshooting. You’ll drive the 0.5% down to 0.3% (which is how you 
got from 10% to  5% to 3% to 1.5% to 1% to 0.5% …).

The flip side of the repair approach is reliability. Monitor the return rate 
on “fixed” units for a while and it’s pretty easy to spot a pattern. That 
was true even back in the 1970’s. Back then a “no trouble found” return didn’t 
count against your numbers. Those days are long long gone….. Run repaired 
units through a full blown battery of qualification testing and see what 
happens. Yes you can indeed find / buy / get “rectified” gear. Any more it’s 
mostly done by board swapping and re-testing. Much of what they get back is 
indeed NTF. Test it and back out it goes. Read the reviews on rectified gear 
and you can see the result.

All that said.

There have been a number of attempts to trace out schematics of some of 
these goodies. Things like the FEI Rb’s, the TBolt’s, and other similar 
parts are typical candidates. In each case you get to the boundary of a CPU 
and / or a FPGA pretty fast. In some cases there are code dumps on the CPU’s. 
I have not seen any dumps on the FPGA’s. With most designs, once you put a 
fairly large FPGA (not a CPLD) on the board, you have moved most of the 
“schematic” into it. What’s left on the pcb around it is just the analog 
this and that you could not pull into the FPGA. That seems to stop these 
efforts dead.

The Z3xxx’s are done with varying levels of integration. The newer ones 
(like the Trimble completion) tend to be more “big CPU plus big FPGA” 
surrounded by not much else. Could you trace one out? Sure, if they didn’t 
set the security bits. Would it take some custom gear, yes, but not all 
*that* custom. eBay will provide you with all you need for less than the 
cost of a Z3xxx. Are the FPGA dumps easy to turn into a schematic - not so 
much. You are talking about a lot of time to reverse one of these boards 
back to the schematic stage.


> On Oct 24, 2014, at 12:27 AM, Tom Miller <tmiller11147 at verizon.net> wrote:
> I am surprised the schematics for these have not surfaced yet. Are they 
> not out of support now?
> I got a set and am awaiting on a power supply and some connectors. Anyone 
> have a source for the latches for the D connectors?
> Tom
> ----- Original Message ----- From: "Anthony Roby" <aroby at antamy.com>
> To: "Discussion of precise time and frequency measurement" 
> <time-nuts at febo.com>
> Sent: Thursday, October 23, 2014 10:39 PM
> Subject: Re: [time-nuts] Lucent KS-24361, HP/Symmetricom Z3809A, Z3810A, 
> Z3811A, Z3812...
>> My curiosity got the better of me so I ordered these earlier this week 
>> and received them today.
>> I've powered both up and quickly measured the 10MHz output.  I don't yet 
>> have a GPS antenna feed that I can connect, so couldn't check that out. 
>> And I need to look into why both of the units have the Fault and StdBy 
>> lights illuminated.  I was surprised how compact they are and they weight 
>> next to nothing.  And they are very nicely made.  I took the tops off 
>> both and took some photos (see http://goo.gl/87e8GG), but have not 
>> ventured into unscrewing everything to get to the bottom of the boards. 
>> From the top, I didn't immediately spot anything extra on the board for 
>> the 10MHz out.  All the extras appear to be for the GPS, but the 
>> underside of the boards may tell a different story.
>> Anthony
>> -----Original Message-----
>> From: time-nuts [mailto:time-nuts-bounces at febo.com] On Behalf Of Bob 
>> Stewart
>> Sent: Thursday, October 23, 2014 12:20 PM
>> To: Discussion of precise time and frequency measurement
>> Subject: Re: [time-nuts] Lucent KS-24361, HP/Symmetricom Z3809A, Z3810A, 
>> Z3811A, Z3812...
>> My units came in today. What I got appears to be new-in-box. It's 
>> probably the only thing I'll ever get with a blue Agilent sticker on the 
>> box. =) It has a yellow Symmetricom notice inside the box.
>> The circuit board appears to be the same on both units, but that says 
>> nothing about the firmware, of course. The REF-1 has an Oncore receiver 
>> labeled TM-AB - whichever one that is, small parts to support it, and a 
>> TNC connector for the GPS receiver.
>> The REF-0 is missing everything related to the receiver, and has an SMA 
>> for the 10MHz output in the space where the REF-1 has the TNC along with 
>> a few extra small parts. This is a shared space with both SMA and TNC 
>> pads, though they don't seem to share the same electrical path. Since the 
>> SMA and TNC share the same physical space, even if the 10MHz is available 
>> somewhere, you'd have to do some surgery on the case before you could 
>> bring it out. Probably by adding a hole in the case for the GPS antenna 
>> and using the pad space for the SMA.
>> It will be a day or two before I have the bits to apply power and connect 
>> an antenna. So, that's what I know. I'd probably just break something if 
>> I tried to find and bring out the 10MHz, so I'll have to leave that to 
>> someone else. But, the appropriate signals need to get between the 
>> boards, so I wonder what's on the Interface pins? Maybe just arbitration, 
>> 1PPS, and sawtooth comms?
>> In my case, I do need the 10MHz, so I'm just as happy to have bought both 
>> units at this point. Maybe, down the road, someone will come up with the 
>> mods to convert a REF-1 into a REF-0, and vice versa, unless the firmware 
>> prevents that.
>> Bob
>>    From: GandalfG8--- via time-nuts <time-nuts at febo.com>
>> To: time-nuts at febo.com
>> Sent: Tuesday, October 21, 2014 5:59 AM
>> Subject: Re: [time-nuts] Lucent KS-24361, HP/Symmetricom Z3809A, Z3810A, 
>> Z3811A, Z3812...
>> It seems from the auction revision table that this seller has been 
>> offering  these for some time, so perhaps another "hidden" gem:-), but 
>> it's perhaps also worth noting that if this system functions on similar 
>> principles to earlier RFTG kit then the GPS conditioning is only applied 
>> to the unit actually containing the GPS module, with the other unit 
>> intended as a standby should the first one fail.
>> In other words, unless the system redundancy is really required most 
>> users would probably only need the GPS based unit, or would at least be 
>> better off buying two of those for the same money that the "matched" pair 
>> would cost.
>> The only advantage, as far as I'm aware anyway, of the non-GPS unit is 
>> that  it contains a 10MHz output.
>> However, Skip Withrow published modification details in January 2013 
>> showing how straightforward it was to add the the 10MHz output, to the 
>> RFTGm-II-XO module, the PCB location for the socket was already 
>> available, so I would suspect it wouldn't be too difficult on these 
>> either.
>> Regards
>> Nigel
>> In a message dated 20/10/2014 05:53:29 GMT Daylight Time, 
>> stewart.cobb at gmail.com writes:
>> Fellow time-nuts,
>> This (long) post is a review of the HP/Symmetricom Z3810A (or Z3810AS) 
>> GPSDO system built for Lucent circa 2000. I wrote it because I looked for 
>> more information before I bought one, and couldn't find much.
>> It's relevant because (as of this writing), you can buy a full system on 
>> the usual auction site for about $150 plus shipping. For those of you 
>> lamenting the dearth of cheap Thunderbolts, this looks like one of the 
>> best deals going. The description of these objects does not include 
>> "GPSDO", so time-nuts may have missed it. Search for one of the part 
>> numbers in the subject line and you should find it.
>> So what is it? It's a dual GPSDO built by HP as a reference (Redundant 
>> Frequency and Time Generator, or RFTG) for a Lucent cell-phone base 
>> station, built to Lucent's spec KS-24361. Internally, it's a close cousin 
>> of a later-model Z3805A. Externally, it looks to be almost a drop-in 
>> replacement for the earlier RFTG system built to Lucent's spec KS-24019. 
>> That was a redundant system containing one rubidium (LPRO, in the one I 
>> have) and one OCXO in two almost-identical boxes. That spec went through 
>> several revisions with slightly different nameplates and presumably 
>> slightly different internals. You can generally find one or two examples 
>> on the auction site (search for RFTG or KS-24019).
>> This system is similar, but the two boxes each contain a Milliren
>> (MTI) 260-0624-C 5.000MHz DOCXO, and neither contains a rubidium. The 
>> Milliren DOXCO is the same one used in the later models of the HP Z3805A 
>> / 58503A. It's a very high-performance DOCXO, in the same class as the 
>> legendary HP 10811, and better than the one in most surplus Thunderbolts. 
>> The 5 MHz output is multiplied up to 10 MHz in at least one unit, and 15 
>> MHz in both units. I don't have the ability to measure phase noise on 
>> these outputs, but I'd be interested to see the results if someone could.
>> Nomenclature: The Z3810AS (there always seems to be an "S" at the
>> end) is a system consisting of the Z3811A (the unit containing a GPS 
>> receiver), the Z3812A (the unit with no GPS receiver), and the Z3809A (a 
>> stupid little interconnect cable). The GPS receiver inside the Z3811A is 
>> a Motorola device, presumably some version of an OnCore.
>> Where the Z3811A has a TNC GPS antenna input, the Z3812A has an SMA 
>> connector labeled "10MHz TP". That is indeed a 10 MHz output. It comes 
>> active as soon as power is applied to the unit, and its frequency follows 
>> the warmup curve of the OCXO. The two units have identical PCBs (stuffed 
>> slightly differently), and I have no doubt that someone can figure out 
>> how to add a 10 MHz output to the Z3811A as well.
>> Operation: From the outside, these units are broadly similar to earlier 
>> units in the Lucent RFTG series. The (extremely valuable) website run by 
>> Didier, KO4BB, has a lot of information on those earlier units, much of 
>> which still applies here. The purpose of these units was to provide a 
>> reliable source of frequency and timing information to the cell-site 
>> electronics. The 15 MHz outputs from both units were connected to a power 
>> combiner/splitter and directed to various parts of the transmitter. The 
>> units negotiate with each other so that only one 15 MHz output is active 
>> at a time. The outputs labeled "RS422/1PPS" contained a 4800 baud (?) 
>> serial time code as well as the PPS signal, which were sent to the 
>> control computer.
>> Power is applied to the connector labeled "+24VDC" and "P1", in exactly 
>> the same way as the earlier RFTG units. Apply +24V to pin 1 and the other 
>> side of the power supply (GND or RTN) to pin 2. In these units, that 
>> power supply goes directly to an isolated Lucent DC/DC converter brick 
>> labeled "IN: DC 18-36, 1.9A". Presumably you can run both units with a 
>> 4-amp supply.
>> Once you have applied power, connect the Z3809A cable between the jacks 
>> labeled "INTERFACE J5" on each unit. The earlier RFTG units used a 
>> special cable between two DE-9 connectors, and it mattered which end of 
>> the cable connected to which unit. The interconnect for these units is a 
>> high-density DE-15 connector (like a VGA plug). The Z3809A cable is so 
>> short that the two units need to be stacked one above the other, or the 
>> cable won't reach. It doesn't seem to matter which end of the cable goes 
>> to which unit. I don't know whether it's a straight-through cable, or 
>> whether you could use a VGA cable as a substitute.
>> When you apply power, all the LEDs on the front panel will flash. The "NO 
>> GPS" light will continue flashing until you connect a GPS antenna.
>> Once it sees a satellite, the light will stop flashing and remain on.
>> The unit will conduct a self-survey for several hours. Eventually, if all 
>> is well, the Z3812A ("REF 0" on its front panel) will show one green "ON" 
>> light and the Z3811A ("REF 1") will show one yellow "STBY"
>> light. This means that the Z3812A is actually transmitting its 15MHz 
>> output, and the other one is silently waiting to take over if it fails.
>> Most time-nuts want to see more than a pretty green light. The old RFTG 
>> series allowed you to hook up a PC to the "RS422/PPS" port and peek under 
>> the hood with a diagnostic program. The program is available on the KO4BB 
>> website. It is written for an old version of Windows, and I had no luck 
>> getting it to run under Windows 7. It does run under WINE (the Windows 
>> emulator for Linux) on Ubuntu 12.04 LTS.
>> To use it, you need to make an adapter cable to connect the oddball
>> RS-422 pinout to a conventional PC RS-232 pinout. The adapter cable looks 
>> like this:
>> DE-9P DE-9S
>> 7 <----------> 5
>> 8 <----------> 3
>> 9 <----------> 2
>> (According to the official specs, this is cheating, because you're 
>> connecting the negative side of the differential RS-422 signals to the 
>> RS-232, and ignoring the positive side of the differential signals.
>> However, it's a standard hack, and it's worked every time I've tried
>> it.)
>> With that adapter, you can see the periodic timetag reports from the 
>> unit. The RFTG program will interpret these timetags when it starts up in 
>> "normal mode". However, when I try to use any of the diagnostic features 
>> built into the program, it crashes WINE. The timetag output was required 
>> for compatibility, but I suspect that HP didn't bother to implement the 
>> Lucent diagnostics.
>> Instead, they added a connector which is not on the previous RFTG series. 
>> That connector is labeled, logically enough, "J8-DIAGNOSTIC".
>> It too is wired with RS-422, so you need to use the same adapter cable as 
>> before. Once you do, you'll find that this connector speaks the usual HP 
>> SCPI command set (Hooray!). I used the official SATSTAT program (again 
>> under WINE on 12.04 LTS), but I'm sure that other programs written for 
>> this command set will work as well. The default SATSTAT serial port 
>> settings of 9600-8-N-1 worked for me.
>> After about 24 hours, with a poorly-sited indoor GPS antenna, my system 
>> has converged to TFOM=3, FFOM=0 (the best possible numbers), and a 
>> "predicted 24-hour holdover uncertainty" of 5.2 microseconds, which is 
>> not too shabby. It found the correct day and year without any assistance, 
>> so if it has a "GPS week number rollover" problem, it's still in the 
>> future. I don't currently have the ability to compare the 10 MHz output 
>> to anything else. Again, if someone else can, I'd be interested to see 
>> the results.
>> Additional Notes: The parts on the boards all have date codes of 1998 or 
>> 1999. The Motorola GPS receiver has a firmware label that reads 
>> "02/04/00". The SCPI error logs inside the HP units were virgin when I 
>> first got them. They had 84 and 94 power cycles, respectively.
>> Before the GPS receiver acquired time, the error log timestamps read
>> "2000-05-09 00:00:00", which I interpret as a firmware release date.
>> The PCB has an interesting feature. Next to each soldered-in pin of the 
>> Milliren OCXO is a single-pin socket soldered into the board. I'm 
>> guessing this was used in manufacturing, to temporarily install a 
>> Milliren and confirm that the system worked before permanently soldering 
>> it in. (At production prices, the Milliren would have cost far more than 
>> the rest of the PCB.) You might be able to use this in reverse, if you 
>> have a set of Millirens to test from another source.
>> The Z3809A interconnect cable has three of the 15 pins on each end 
>> clipped a bit shorter than the rest. Not so short that they won't 
>> eventually make contact, but short enough to make contact later than the 
>> rest. Don't know why, but it's clearly deliberate. A lot of hot-plug 
>> connectors are built that way, including USB connectors. I have no idea 
>> what the pinout of the interconnect is.
>> The redundant system slaves both DOCXOs to the same GPS reference.
>> Inside the GPS loop bandwidth, the two oscillators will have almost the 
>> same frequency and will differ only by phase noise and short-term 
>> stability. This is almost a perfect setup for experimenting with certain 
>> kinds of time-nut measurements, assuming someone can figure out how to 
>> get 10MHz out of the Z3811A unit. If you then command both units into 
>> holdover, you could measure longer-term stability as well.
>> The units are described as "new in factory sealed box". After an 
>> archeological investigation of the various strata of labels and tape on 
>> the boxes, I would say that's probably accurate. My set seems to have 
>> been shipped from the Agilent factory in Korea to Symmetricom in 
>> Sunnyvale, CA sometime in August, 2000, shortly after it was built, and 
>> remained untouched until I opened it. I'm guessing it was built and saved 
>> as part of a spares program for Lucent, and kept until Lucent decided 
>> they didn't need spares any more.
>> I have no connection with the current seller of these units (or any other 
>> sellers, for that matter) except as a satisfied customer. I think I'll 
>> order another set as a spare, before the feeding frenzy hits.
>> Request for help: Both the SatStat and RFTG programs run under WINE on 
>> stock Ubuntu 12.04 LTS (32-bit) without any tricks or special 
>> configuration. Neither seems to run under WINE on Ubuntu 14.04 LTS 
>> (64-bit). I am a WINE novice. Any hints from WINE experts would be 
>> appreciated. Also, I've been able to run TimeLab under WINE, but I can't 
>> connect it to my USB-to-488 interface, so I can't take data. If anyone 
>> can tell me how to set that up, I'd be extremely grateful.
>> Cheers!
>> --Stu
>> _______________________________________________
>> time-nuts mailing list -- time-nuts at febo.com To unsubscribe, go to 
>> https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts
>> and follow the instructions there.
>> _______________________________________________
>> time-nuts mailing list -- time-nuts at febo.com To unsubscribe, go to 
>> https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts
>> and follow the instructions there.
>> _______________________________________________
>> time-nuts mailing list -- time-nuts at febo.com To unsubscribe, go to 
>> https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts
>> and follow the instructions there.
>> _______________________________________________
>> time-nuts mailing list -- time-nuts at febo.com
>> To unsubscribe, go to 
>> https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts
>> and follow the instructions there.
> _______________________________________________
> time-nuts mailing list -- time-nuts at febo.com
> To unsubscribe, go to 
> https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts
> and follow the instructions there.

time-nuts mailing list -- time-nuts at febo.com
To unsubscribe, go to 
and follow the instructions there. 

More information about the time-nuts mailing list