This article should be about callibrating FA-SY 1 – external clock mounted on USRP, but it is not. When i started to upload photos for this article i didn’t have a clue how this will end. It took a few months, soldering skills, a lot of patience and yelling till we finaly give it up with FA-SY 1. It shouldn’t be that hard to get this oscilator to work with OpenBTS, but an unfortunate coincidence happened. At the same time we tried to callibrate it, one of RFX900 boards suddenly stop working. As you may already know FA-SY 1 requires modification to decrease its output voltage to prevent USRP input burn out. This will be probably the last article about FA-SY 1, hopefully with some useful info for people who will try harder and can get it to work.

Clock accuracy

Acording to GSM 05.10 Section 5.1 the BTS shall use a single frequency source of absolute accuracy better than 0.05 ppm for both RF frequency generation and clocking the timebase.

Taken from GNU Radio Wiki:

The typical GSM handset has a medium-quality VCTCXO. On a cold start, not locked to any outside clock, this clock has a an accuracy of around 20 ppm, or about 18 kHz in the low bands (850/900) and about 36 kHz in the high (1800/1900) bands. So, starting “cold” with no information, the phone runs a time-consuming frequency search over the whole possible drift range of its own clock and continues this search until it finds a beacon signal from a BTS. Once the phone finds a beacon, it uses the carrier from the BTS to correct its own local clock by adjusting the control voltage on the VCTCXO. From that point on, the VCTCXO is just as accurate os the BTS clock as long as it is receiving the BTS signal.

So what this all mean? You should callibrate external clock very accurately! There is Windows software for that called USB_Synth.exe It relies on proper recognition of USRP in Windows operating software, so libusb0.dll is included to handle this. Software itself is a bit weird in my opinion, try it or see another way of calibration listed below.

Another common problem with FA-SY 1 is that once you’ve calibrated it, you can use it for a while, but a few hours later, you’ll need to re-calibrate. So we added temperature compensator to make it more reliable.

Last words about  FA-SY

There is not much info around about FA-SY 1 “in action”. You may want to check GSM Fun by Nicolas Krassas, or pdf guide Installation Guide for OpenBTS by Christoph Kemetmüller (Center for Advanced Security Research Darmstadt) from February 2010.

There is a short mention about FA-SY 2 by Konrad Meier (2010-12-02 ) in openbts-discuss e-mail archive with following text:

Today I assembled the new FA-SY 2 from Funkamateur. The clock worked without any problem with the USRP. I calibrated the clock with Kal and got a max frequency offset of +-60Hz which is very close to the required 0,05 ppm/ 0,1ppm for a BTS. I configured the clock to 52 MHz output. I think the FA-SY 2 is with an output level of 0,7V is more suitable than the FA-SY 1 with CMOS output level. Like Andy Fung mentioned some time ago the input level for the AD9513 should not be more than 2 V. So the FA-SY 2 is more suitable for the USRP. Maybe someone can updated this info in the wiki.

… so if you see following:

FA-SY2 can be bought for 45 euros, and might theoretically be usable, but nobody has reported using it successfully yet. Check the list.

in latest OpenBTS for dummies (August 31, 2011), you might realize this is no longer valid comment. If you managed to get it to work, please let us know about your experience with FA-SY 1 / FA-SY 2. Also we would be glad to publish whatever you want to say about reliability and mounting procedure.


So, lets assume you need to calibrate your external clock but you don’t have an oscilloscope for verification. Kalibrate, or kal, can scan for GSM base stations in a given frequency band and can use those GSM base stations to calculate the local oscillator frequency offset. Please look here for further information. And yes, there is an UHD device support for kalibrate GSM clock offset calculator maintained by Thomas Tsou on Github.

Blind and fried

First i thought clock is badly mounted, second i blamed that crappy windows software used to kalibrate clock. Then we got mad with analyzer accuracy. At that moment we started comparing what worked and what not. We had the software for the original oscillator, we knew what kind of phones are able to register. Nothing…

Don’t be confused with 64 MHz on the pictures, we were not crazy to remove default 64 MHz clock and mount external 64 MHz clock insted of 52 MHz. We were just blind and since we had “working” ISO for default clock this was one of verification experiments. Spectral analyzer shows waveform, we double check everything but still no phones was able to “see” OpenBTS. The signal rises and then falls over and over.

We knew something is broken. A few weeks later Gas discover that one of RFX900 boards is fried. Unfortunately we disabled FA-SY 1 sooner, than we knew that the bug is in the RFX board. And we are not mounting it back for now. No, we are not giving up our experiments, on the contrary a new project was born.

As far as i know, there are only two major external clocks around OpenBTS community -> FA-SY 1 and Clock Tamer. With some luck there should be a third one – easy to mount and cheap external oscilator for OpenBTS enthusiasts and GSM researchers. Clock was initially created for USRP 1, this nice piece of hardware might be what are you looking for. More info later, cross your fingers :)

Súvisiace články: BackTrack 4 & USRP pt.1BackTrack 4 & USRP pt.2Welcome to OpenBTS! |64 MHz clock|USRP | TVRX receiver,|USRP| + |OpenBTS| + |Asterisk| ?!?SUPER SIM & SIM MAX , DBSRX2 + TVRX = 50 MHz to 2.4 GHz receiver system X-Lite & Twinkle @ AsteriskBackTrack R2 USRP Test shot |RFX900|GSM fail ?GSMdump Live-CD Light BTS discoveringBackTrack R2 USRP Test shot IIOpenBTS |FA SY-1| external 52MHz clockOpenBTS P2.8 „Opelousas“, UmTRX – Open Source Hardware Transceiver for GSM

No Comment..

Add Your Comment