Film-Tech Forum ARCHIVE: Correcting clock on non-networked GDC

This is topic Correcting clock on non-networked GDC in forum Digital Cinema Forum at Film-Tech Forum ARCHIVE.

To visit this topic, use this URL:
https://ft-forum.com/ft/cgi-bin/ubb/ultimatebb.cgi?ubb=get_topic;f=16;t=002088

Posted by Bob Healey (Member # 1003) on 11-08-2014, 01:59 AM:

A college cinema group I still maintain some connections with has asked me for help correcting the accumulated clock drift on their 18 month old Christie/GDC standalone projector unit prior to an advanced screening scheduled for Monday. The projector clock is currently running 3 hours behind, which has not yet been an issue since they keys are generally for 72 hours and they only screen a title one night.

Was curious if this was possible, or something mere mortals are not allowed to touch, due to potential embarrassment of having to delay an advance screening 3 hours to wait for the key to activate.

Thanks

Posted by Steve Guttag (Member # 268) on 11-08-2014, 08:08 AM:

STOP!!!!!

Before you go adjusting any clocks (and there is a 6 limit per/year allowed as per DCI...applies if your GDC is on Software 8.0.x or higher)...FIRST and I MEAN FIRST...determine if the GDC is in the right Time Zone!!!!

You will need Administrator privileges to change the time zone. Go to:

Admin Panel>Diagnostics/Maintenance>Configure Time Zone.

Make sure that is correct first or you will forever be chasing your tail and the secure clock vs. show clock will always seem to be at odds. That is another thing...there is the secure clock and the show clock...the KDM only cares about the secure clock...not what is showing on the control screen. The secure clock is always working on UTC time. So, if your secure clock is correct reference to UTC...your key will work regardless of what the show clock shows.

If you go to the Control Panel>System Monitor...in the upper-right, you'll see quickly what your show clock thinks it is...down to the second and the time zone.

If you determine that your secure clock is what is really off by 3-hours...you will need to contact GDC and provide a means for them to remote into the server to change the secure clock by more than 6 minutes.

Now, if your GDC software is old enough (pre DCI)...and you haven't configured Network Time (NTP)...which I have to presume you haven't since clearly no NTP source is there...then there is an RTC section in GDC 7.8.

But I would definitely check the time zone first.

Posted by Bob Healey (Member # 1003) on 11-08-2014, 11:08 AM:

Getting the projector to reach an NTP server will be easier than getting GDC remote access in time for Monday. The projection booth is only served by university wifi, and static addresses and external access are strictly forbidden. It is possible to get a one off connection as a client with a laptop set to share its connection, so I could in theory possibly enable NTP and let it take care of itself over the weekend. I'm going to check time zones before doing anything with NTP or networking though. I think they have all the needed access codes.
.

Posted by Mark Gulbrandsen (Member # 72) on 11-08-2014, 11:18 AM:

At any rate you could still use the time zone to offset it the three hours to get it close, just be sure to set it back to your time zone if you are going to have GDC look at it. All you need for GDC to remote in and have them set it is a laptop (wireless) with Windows and Team Viewer on it. Yes, you have a +/- 6 min. a year adjustment but GDC can go in and set it correctly for you no matter how far it has drifted. Once it's set correctly then have NTP track it. I have over 200 GDC's running out there and I seriously doubt that NTP is going to pull it three hours either way so it's correct. Plus the server is only going to update once an hour from NTP anyway. I have seen it pull it as much as 30 minutes though.

P.S., If you can get NTP via a computer I assume then getting GDC remote access is just as easy. If you're using another NTP source such as a GPS locked clock that will also work but probably still won't pull it three hours. Team Viewer is free (shhh!) Unless your warrantly has expired in which case you'll have to extend your warranty before they'll even look at it.

Mark

Posted by Steve Guttag (Member # 268) on 11-08-2014, 01:38 PM:

There are multiple ways NTP can adjust a clock...there is a jump and there is slew...once upon a time...GDC would jump to the right time (the secure clock was the BIOS clock)...but that all changed in the DCI compliant versions of the software.

As Mark said, if you can get it to an NTP source via a laptop...then you can also get GDC into your system. Your laptop becomes their means of access. Presuming your software is DCI compliant (8.01 or 9.00...click the little "i" on the SMS screen and it will give you a bit of information or go to the Control Panel)...then at best you can do is +/-6 minutes as an RTC offset.

I'm still thinking it is just a time-zone thing...3-hours isn't drift.

Posted by Bob Healey (Member # 1003) on 11-08-2014, 02:34 PM:

Dealing with university red tape is the network issue. Can't leave machines on the wireless network for long periods of time, and can't have static addresses. Can have a machine on the wireless provide NAT to connect projector out to world thought. Getting a hard line run is 6-8 weeks and about $1K. My day job is IT running the HPC research clusters at the university.

Posted by Carsten Kurz (Member # 5396) on 11-08-2014, 04:25 PM:

If they are not complete paranoid at your site, then Teamviewer will work over that connection just as well. Just negotiate with GDC beforehand, and activate the connection when needed. As Steve pointed out, it's important to understand the difference between system/show clock and secure clock, so check the timezone first.

- Carsten

Posted by Bob Healey (Member # 1003) on 11-08-2014, 04:29 PM:

Had to reset time zone from LA to NYC, and do some creative wireless to wired bridging to point it at the university NTP server, but times are now all correct correct.

Posted by Monte L Fullmer (Member # 2797) on 11-09-2014, 12:32 AM:

(I'm learning as I go along with digital, thus love to ask questions, if possible:)

I've heard this about all of this DCI regulations pertaining to time settings.

Why all of this DCI "big brother" requirements with the time settings?

For heard if you go over the DCI limits with the time thing, you just "bricked" up the system to eternity.

-Monte

Posted by Frank Cox (Member # 6258) on 11-09-2014, 01:11 AM:

The digital key system works on time; a key allows you to play a movie from this date and time to that date and time.

If you could arbitrarily change the time on your server, you could make a key work forever simply by keeping your local time set to a time when that key is valid.

This is a scheme that was occasionally used by people back in the days of DOS and whatnot to keep trial versions of software running for months or years even though the trial was supposed to be for one week or whatever.

Posted by Marco Giustini (Member # 4544) on 11-09-2014, 06:25 AM:

Monte, as far as I know if you try and set a DCI secure clock outside its allowed range, it simply won't accept it.

Posted by Dave Macaulay (Member # 813) on 11-09-2014, 07:23 AM:

The server security manager should just refuse to change the clock and warn you that it has reached the adjustment limit if you do.
Doremi can supply a license to change it more than 6 min/year but that has a limit as well but that carries a cryptic warning about overriding the 6 min/year change limit saying that some security compliance is broken. I can't find the warning right now but my guess at what it means is that, should a distributor supply a KDM that enforces very strict security, the server would not play the respective clip.
Several available security switches are being left "off" in current KDMs - many (many!) cinemas would be dark if they were all turned on.

Posted by Marco Giustini (Member # 4544) on 11-09-2014, 10:59 AM:

I believe if you request a DLM to increase the allowed time to 30m, your system won't be DCI anymore.

Posted by Monte L Fullmer (Member # 2797) on 11-09-2014, 02:03 PM:

Thx for the replies on this adjusting time issue, for when we had Dolby DSS200 servers on loan, those things would drift like crazy - like 15 minutes a week where I had to do reboots just to get them synced back to the time on the TMS which was GDC.

I asked our tech on if these servers could be locked in with the GDC TMS and he did mention something on why they couldn't, or something else I didn't understand.

It was funny to compare that a 12 buck watch from Wally World can keep a lot better time than a mega price DSS200 server.

Yet, it wasn't important since we were waiting for GDC to handle ATMOS streams to the CP850 processors, in which that was accomplished and those DSS200's left our location shortly afterwards.

-thx Monte

Posted by Mike Blakesley (Member # 26) on 11-09-2014, 03:13 PM:

Welcome to the 2010s, where for only $30,000 you can buy an amazing machine that can create up to 60 pictures per second using millions of tiny mirrors, and can play dozens of audio channels in synchronization with those pictures, but can't tell the correct time.

Posted by Mark Gulbrandsen (Member # 72) on 11-09-2014, 03:29 PM:

Bob Healey... ANy laptop can be temporarily connected to the Local projector switch so GDC can gain access. This eliminates the permanent connection issue you face. It need not be permanent. Only for powered up for their remote access, or yours if an issue arises. I have had projector manufacturers also remote in to look at a projector issue..

Posted by Steve Guttag (Member # 268) on 11-09-2014, 04:11 PM:

Monte...if your clocks are drifting like crazy (Dolby or other)...then the clocks were not set right to begin with. If rebooting reset the clock properly, then the secure clock is probably not the problem since when a Dolby boots up...it first checks NTP...failing that it asks the mediablock (CAT862 or the <cough, cough> CAT745) and finally its own BIOS clock. As I've said before, the CAT745's "clock" is less precise than a sundial. It will easily drift minutes a year.

But moving onto your statement on having the Dolby's set their clock via your GDC TMS system...absolutely they can. Note, the Dolby server will know if your GDC TMS has a real NTP source. So if your TMS server is really getting its reference from NTP, then the Dolby server is all to happy to use it. However, it is best to get both the secure clock (CAT862, CAT745 or DSP100) set as close as possible and then set the BIOS clock as close as possible first. When the DSS200 boots up, it will call out to the set NTP source (set in the configuration when it was installed) and perform an NTPDATE command and step the clock to whatever NTP is telling it.

Starting with Dolby 4.7.0...NTP for Dolby became MUCH more reliable and it polls NTP much more often to keep it more reliable.

4.8.2. made further improvements to the NTP implementation in Dolby.

I completely agree that getting an accurate clock should not be such a hard thing in this day and age when even a cheap watch can keep very good time without NTP as a reference. I think the designers presumed NTP so much with all of this networking business that the clocks were allowed to be rather sloppy.

GDC started out by having its BIOS clock being the "secure clock"...anyone that knows computers knows that the BIOS clock is never all that accurate...but again, with an NTP source...big deal...GDC's clocks, with an NTP source in 7.8 and earlier were right on the tick. When DCI came about and 8.01...so went GDC's clock...it was forced to use the mediablock's clock. Now, those systems are typically 10-20 seconds off (perpetually). I believe it tries to reset itself at show start during the DCI check. You can try to tweak it via the RTC offset in the Admin Panel. Most seem to be completely unaware of it. This applies to the older SX-2001As...the 2000AR and 3000 function differently, clock wise...particularly the 3000 since there is no BIOS clock from a "server" to work with...it is all on the IMB. Honestly, I have not studied that clock system as much.

Posted by Bob Healey (Member # 1003) on 11-09-2014, 11:52 PM:

Mark, this particular university is pretty strict about what it allows in/out of its firewalls, and on what sorts of connections. I don't know if team view would actually work get past the packet inspection on the firewall. Student groups can only get http traffic permitted on port 80 to wired hosts with static addresses. Staff members like me can also get https permitted. Anything else requires documentation that an academic need will not be fulfilled, or paying for a guest access account for a specific person (3-4 week process to setup).

Posted by Frank Cox (Member # 6258) on 11-10-2014, 01:08 AM:

The IT department is there to serve the needs of the university. Not the other way around.

Tell them that you require this access for the purpose of maintaining your digital cinema equipment. If they refuse, take it up with the university president or whoever is supposed to be in charge of the place. Active obstruction of a legitimate and necessary activity should not be permitted.

I don't understand the attitude of some IT departments (and sometimes individual sys admins). Their role is to assist you and provide what what you need when you need it.

Posted by Randy Stankey (Member # 64) on 11-10-2014, 01:39 AM:

I work for a place that has "institutional obsessive compulsive disorder" but, if I really need to do something, I can talk to a certain person who is in charge. He won't say yes nor will he say no. His answer is, "Just don't screw anything up."

Point being, there is always a way. [Wink]

Posted by Pete Naples (Member # 761) on 11-10-2014, 02:47 AM:

Frank, amen!

University and Local Authority IT here are usually a total PITA.

Generally we bypass them altogether by using a dedicated connection, it's a T&C of our maintenance and monitoring agreement.

Posted by Steve Guttag (Member # 268) on 11-10-2014, 06:12 AM:

IT's motto..."If you are doing your job, we aren't doing ours."

In such situations, I normally ask for their NTP clock's IP address. I don't need to go find my own. I'd be surprised if that was not available...sometimes, you need get no further than the gateway.

There is definitely a territory thiefdom with many IT departments. After all, they are partly the security department. At the university level, they are in the breeding grounds for viruses and such. I can definitely understand their desire to lock things down. College age people can be rather clever and stupid at the same time. I never had such virus protection on my stuff as when I was in college. ANYTIME I put one of my floppy discs on a University computer...it came back with a virus on it. I had to keep that stuff separate.

Posted by Carsten Kurz (Member # 5396) on 11-10-2014, 08:09 AM:

In tough cases, I check if I have 3G reception somewhere on site, then simply use my iPhone HotSpot Feature for a short-term TeamViewer connection. Yes, there are some caves with no coverage, but one way or the other will usually work.

- Carsten

Posted by Pete Naples (Member # 761) on 11-10-2014, 02:18 PM:

Carsten, I've a couple of places where installing a physical ADSL line was not possible due to the layers of red tape. One of them the IT guy was actually smug that he had 'won'. The smug grin was wiped off his face when he couldn't provide anything in their rulebook that said we couldn't use 3G.

So, the workaround was to install a mobile broadband dongle to the USB port of a Draytek VPN enable router. They can use multiple WAN connections for fallback, including USB 3/4G. As far as the router is concerned WAN1 (ADSL) and WAN2 (Ethernet) have failed, so it looks to WAN3 (USB).

Not the fastest nor most cost effective method, but needs must.

Posted by Mark Gulbrandsen (Member # 72) on 11-13-2014, 10:22 AM:

Bob Healey... What Carsten says! Screw the IT Department! I have had to do the exact same thing at drive ins that have no internet and that works fine.

Mark

Posted by David Buckley (Member # 2600) on 11-14-2014, 05:58 AM:

I'm just wondering what sort of university doesn't have an NTP infrastructure.

Posted by Steve Guttag (Member # 268) on 11-14-2014, 06:39 AM:

Exactly...Where I've had to be on IT's infrastructure...I just ask THEM for the NTP address...never had an issue getting that.

Posted by Carsten Kurz (Member # 5396) on 11-14-2014, 07:49 AM:

I think we were not talking about NTP, but remote access to fix it?

Other than that - yes, even getting local NTP can be a problem if the IT considers the server unsecure. I know enough IT departments not granting ANY network access to machines they do not have under their own control. And they do not work or configure cinema servers.

- Carsten

Posted by Mark Gulbrandsen (Member # 72) on 11-14-2014, 10:44 AM:

Exactly. Hence the title of this thread....

Posted by Steve Guttag (Member # 268) on 11-14-2014, 01:29 PM:

What I have come across this far are two extremes (when other ITs are involved)...

1) ANYTHING with an Ethernet jack is to be under their "control". And no, you are not likely to get an easy remote service to that...though it is certainly possible.

2) They want NONE of the Cinema stuff on their network and we merely need to find out own means of Internet.

By far, the most common for us is to not have any interaction with other IT systems...after all, we are as leery of them as they are of us!

Posted by Mark Gulbrandsen (Member # 72) on 11-15-2014, 06:41 AM:

This would keep your server permanently locked!

[URL=http://www.css-timemachines.com/TM1000A-GPS-Network-Time-Server/dp/B002RC3Q4Q?field_availability=-1&field_browse=8955171011&id=TM1000A+GPS+Network+Time+Server&ie=UTF8&refinementHistory=subjectbin&searchNodeID=8955171011&searchPage=1&searchRank=s alesrank&searchSize=12]Inexpensive stratum 1 time server[/URL]

Posted by Steve Guttag (Member # 268) on 11-15-2014, 07:05 AM:

So close Mark...you didn't "box" your "URL" opening.

Posted by Mark Gulbrandsen (Member # 72) on 11-15-2014, 03:44 PM:

Actually the site did that via my eye pad!

Stratum 1 NTP Clocks

Posted by Pete Naples (Member # 761) on 11-16-2014, 10:46 AM:

That's very reasonably priced!

We use an even cheaper solution, we've come to christen it the NTPi [Wink]