Standalone Operation of the Lucent KS-24361 REF-0 Unit

Introduction

This post will detail how to make the REF-0 unit of the Lucent KS-24361, aka HP/Symmetricom Z3812A, run standalone.

My REF-0 running standalone with support from a Venus GPS module and an Arduino.

The KS-24361 has been available on the usual auction site for quite a while. It is an old GPSDO, but new-old-stock surplus units can be purchased for a reasonable price. The KS-24361 is designed to run as a pair of boxes. The REF-1 box has the GPS module inside. The REF-0 does not have a GPS, and is controlled by the REF-1 box. However, the REF-0 does have a useful 10MHz output. Both have high quality Milliren OCXOs inside. Steward Cobb on the Time-Nuts mailing list wrote a very detailed review of this GPSDO. I highly recommend you read that if you haven't already.

If you want to run the KS-24361 normally, it is very easy. Hook up a GPS antenna and the interface cable, and power the boxes from +24V as described by Steward. After some time the green "ON" light will appear on the REF-0 and the other lights will extinguish. The REF-1 will flash that it is in standby mode, though of course it is still doing quite a lot. It has to discipline its own OCXO and pass the GPS data to the REF-0 box. Several connectors are available for reading out serial data and accessing the pulse-per-second (PPS).

For various reasons, many more REF-0 boxes are available by themselves than complete systems. At the time of this writing, a single REF-0 costs $25 plus shipping. The problem is that the REF-0 does not have a GPS, so normally it can not run by itself.

Is there a way to add a different GPS and run the REF-0 as a standalone unit? There sure is.

Much of the groundwork for this project was done by members of the Time-Nuts community. Recently, Bob Camp provided a detailed writeup on how the interface connector on the boxes works, and what signaling is needed to make the REF-0 think a REF-1 is attached when it is not. I made the necessary connections as described by Bob and got my own REF-0 to turn its outputs on. The main issue remaining at that point was getting the unit to accept a PPS signal and discipline its oscillator. Bob describes in his writeup several messages that are passed between the REF-1 and REF-0 during normal operation. These would be needed, with correct information in certain fields and sent at the right intervals, to make the REF-0 work. This is where I attempted to help with the project.

Creating a GPS Neverland for the REF-0 to live in

Analyzing the serial output of my REF-1 on the interface connector, I found that the following messages were passed at the listed intervals:

• Every Second (75ms after the PPS edge)
• @@Ea - Position, status, and general data
• @@En - Set alarm limits for T-RAIM
• 6 Second Interval
• @@Bb - Visible satellite status
• 8 Second Interval
• @@Ap - Set user datum
• 30 Second Interval
• @@Aw - Time mode
• 40 Second Interval (for each, but spaced out, not all at once)
• @@Ag - Satellite mask angle
• @@At - Go to position hold mode
• @@Az - Offset the 1PPS for antenna delay
• @@Bj - Leap second pending
• @@Bo - UTC offset status message

These messages are in an older Motorola format used by the Oncore GPS in the REF-1. Other messages may be sent at other times, but this is what's sent during normal operation. Some of them have limited usefulness to the REF-0 and are for setup after a hot swap. Nonetheless, they fill in data fields that need to be filled, so the REF-0 is looking for them. We need to send these messages to the REF-0, make it think the GPS lock is good, and accept the PPS signal as valid.

I modified the messages to create a perfect fake GPS environment for the REF-0. It thinks a full set of eight satellites are being tracked directly overhead, at 0 degrees latitude 0 degrees longitude, on January 1st 1998. That may sound funny, but if you are familiar with these messages, you'll know why that is.

Through significant trial and error, I figured out strings that work, and how to send them. Here are the modified message strings:

@@Ea
0x40, 0x40, 0x45, 0x61, 0x01, 0x01, 0x07, 0xCE, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0A, 0x08,
0x02, 0x08, 0xFF, 0x82, 0x04, 0x08, 0xFF, 0x82, 0x06, 0x08,
0xFF, 0x82, 0x08, 0x08, 0xFF, 0x82, 0x0A, 0x08, 0xFF, 0x82,
0x0C, 0x08, 0xFF, 0x82, 0x0E, 0x08, 0xFF, 0x82, 0x10, 0x08,
0xFF, 0x82, 0x20, 0xDF, 0x0D, 0x0A

Note: The 9th, 10th, and 11th bytes are the hour, minute, and seconds. 

The third to last byte is the check character.

@@En
0x40, 0x40, 0x45, 0x6E, 0x01, 0x01, 0x00, 0xC0, 0x01, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00,
0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x0A, 0x00, 0x00, 0x00,
0x00, 0x0C, 0x00, 0x00, 0x00, 0x00, 0x0E, 0x00, 0x00, 0x00,
0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0xFA, 0x0D, 0x0A

@@Bb
0x40, 0x40, 0x42, 0x62, 0x0A, 0x02, 0x00, 0x00, 0x5A, 0x00,
0x00, 0x00, 0x04, 0x00, 0x00, 0x5A, 0x00, 0x00, 0x00, 0x06,
0x00, 0x00, 0x5A, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x5A,
0x00, 0x00, 0x00, 0x0A, 0x00, 0x00, 0x5A, 0x00, 0x00, 0x00,
0x0C, 0x00, 0x00, 0x5A, 0x00, 0x00, 0x00, 0x0E, 0x00, 0x00,
0x5A, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x5A, 0x00, 0x00,
0x00, 0x12, 0x00, 0x00, 0x5A, 0x00, 0x00, 0x00, 0x14, 0x00,
0x00, 0x5A, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x3C,
0x0D, 0x0A

@@Ap
0x40, 0x40, 0x41, 0x70, 0x32, 0x61, 0x52, 0x99, 0x00, 0x81,
0x01, 0x2A, 0x0F, 0x54, 0xEB, 0x8B, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x38, 0x0D, 0x0A

@@Aw
0x40, 0x40, 0x41, 0x77, 0x00, 0x36, 0x0D, 0x0A

@@Ag
0x40, 0x40, 0x41, 0x67, 0x0A, 0x2C, 0x0D, 0x0A

@@At
0x40, 0x40, 0x41, 0x74, 0x01, 0x34, 0x0D, 0x0A

@@Az
0x40, 0x40, 0x41, 0x7A, 0x00, 0x00, 0x00, 0x00, 0x3B, 0x0D,
0x0A

@@Bj
0x40, 0x40, 0x42, 0x6A, 0x00, 0x28, 0x0D, 0x0A

@@Bo
0x40, 0x40, 0x42, 0x6F, 0x00, 0x2D, 0x0D, 0x0A

These messages need to be sent to the REF-0 at the intervals listed above, 9600 baud 8N1. 75ms after the PPS edge, send the @@Ea message, immediately followed by @@En, then any other messages due that second.

BUT there is one small wrinkle. The time sent in the @@Ea message actually needs to increment. The REF-0 keeps its own internal clock. If you don't increment the seconds it will never accept the lock. If you don't increment the minutes and hours, it will initially accept the GPS lock, but when it later checks and finds the time incorrect, it will consider GPS lost. The check character in the message also needs to be updated every time you send the message, since you modified the contents. (The check character is an XOR of each byte in the string after the first two bytes but before the check itself. Sorry I know that's a mouthful.)

If you google search for a Motorola Oncore message format guide, you can see for yourself what I have done to these messages. You can also of course modify them as you like. Don't forget to update the check character.

What You Need to Do

If you want a REF-0, search on eBay for "KS-24361" (I have zero connection to the main seller of these units). Other sources of REF-0s may be available. Prices may go up in the future, and units will eventually dry up. If you are reading this two years from now, sorry. The situation is probably very different.

It goes without saying, be safe when working on electronics and double check every connection before applying power.

To get your REF-0 working standalone, you need to:

1. Program a microcontroller to send the above listed strings at the above intervals. You also need to send the PPS signal to the microcontroller so that it knows when to send the messages. They have to be transmitted 75ms after the PPS edge. There are a few ms of wiggle either way, but timing is still important. I recommend an interrupt.
2. Power up a GPS that has a good, stable PPS output. I used a Venus GPS module, but others will work. Also, you need to find out if your PPS signal is normally low and pulses high, or if it is normally high and pulses low.
3. Hook up a schmitt inverter IC. I used a 74LVC14. A 5V supply will work fine if your inverter IC supports that. If not, 3.3V should work too. You need to send the serial output from the microcontroller through an inverter gate to go to the REF-0. If your GPS PPS is normally low, that also needs to go through a separate inverter gate before going to the REF-0.
4. Wire the pins on the interface connector as described by Bob, and as shown below. You probably want to find a bare DB15 connector and solder this together for reliability after you test it.
5. Power the REF-0 from +24V (up to 2 amps) as described by Steward above, and as shown below.

The power connector on the REF-0.

The interface connector on the REF-0.

What will happen next:

1. A test sequence will flash on the LEDs, then the NO GPS and FAULT lights will come on.
2. After some time (the OCXO is warming up) the FAULT light will go off and the ON LED will come on.
3. Now you are waiting for the NO GPS light to go off. If it does, and only the ON light remains lit, you are successful. Monitor the unit for several hours. If the "NO GPS" light comes on again and stays on, the time in the serial string may not be incrementing properly.
4. If you know what SatStat is and how to use it, hook that up and monitor the status screen for more information.

Assuming only the green ON light is lit, then congratulations, you now have a GPSDO. The outputs should stabilize and be very accurate within a few hours to a few weeks, depending on how you define "accurate" and "stable".

Going Forward

This is a brand new procedure and problems will be found. Some GPS modules with different looking PPS signals may not work. There may be code lurking inside the REF-0 which is checking a field we don't know about yet, and it will eventually become unhappy. But for now, this is a good start.

If you know how to do everything above, including programing a microcontroller of your choice, go for it! Enjoy your newly functioning REF-0 unit. If not, I will post a follow up to this in the future with code and more information.

Again, much credit is due to fellow Time-Nuts members. This is just one project, but much work has been done with these units over the past years. In no particular order: Bob Camp, Steward Cobb, Skip Withrow, Gerhard Hoffmann, Arthur Dent, and Ole Petter Ronningen. There are certainly others and I will add their names here when I learn of them.

Thanks for reading!

-Dan W.