From W9CR
Jump to: navigation, search

Quantar/Quantro info

There is a bunch of info here about the technical aspects of the Quantar Stations.

The info on the modification and changing ranges of the various modules is on the respective pages. There is some conversion info below, but it's being migrated and reformatted under the respective pages. I feel this is more logical.

If you find anything to be wrong here, please feel free to make an account and change it. I've had to lock down account creation, so you'll need to have it approved. If you want to email me directly, my email is bryan@bryanfields.net


Links to programming stuff

CSS 007.13.R022.0035 for EPIC4 Smart Zone SCM

WinRSS 14.08.01 Windows RSS

WinRSS 14.10.00 release July 15 2011.zip -- Current RSS

DIU3000 CPS/CSS software 8.00.18 30-APR-2005


The newer SCM modules can be upgraded via SLIP connection over the tty port, or via IP over the 10Base2 connector (anyone have a hub?).

The Wireline typically will upgrade during this too, unless it has the older EPROM memory. At that point you'll have to swap the chips.

The exciter is still a hard chip swap upgrade, but programed EPROM's are $20 shipped on eBay. Unless you have more than a few to upgrade it's not cost effective to buy the programer and chips yourself.

Quantar Conventional Firmware Upgrade Package R020-14-048

SIMM Images

The SIMM has a boot1 image which is a basic bootloader (0x460-0x3ffff). This runs just after the bootstrap code (0x000 0x45f). The bootloader (boot.o) contains basic code to initialize the hardware and validate the boot2.o, sc.o and wl.o images stored in the SIMM. It also has a slip loader in it. With only the boot.o code running it's possible to reload the entire OS at 9600 baud via the front port.

The boot.o is the only code not able to be upgraded on the SIMM via SLIP/FTP. To upgrade boot.o you need to flash the SIMM directly. Normally boot.o does not matter, but it is different for IR and NIR stations. The other issue is the newer (EPIC III) SCM cards will not boot with boot.o 020.10.001, and need at least the 020.10.008 code. The newest boot code is 020.10.012, and the images below have that code on them.

Conventional Firmware for U1-U4 on the SIMM module 20.14.048

media:NIR-R020.12.048 B2-R020.14.15 B1-R020.10.12.zip -- Most current firmware, works on all SCM boards.
media:Quantar-Flash-Simm-EPIC2-NON-IR-FW-20.14.048-Boot-020.10.001.zip -- Don't use, older code for historical reference only

IntelliRepeater (IR) Firmware for U1-U8 on the two bank SIMM module 20.14.520


Hacking info

How to combine the firmware into a single binary image

srec_cat -Output 20.14.038-SIMM.bin -Binary \
"U4.bin" -Binary -unsplit 4 0 \
"U3.bin" -Binary -unsplit 4 1 \
"U2.bin" -Binary -unsplit 4 2 \
"U1.bin" -Binary -unsplit 4 3

srec_cat -Output 20.14.048-SIMM.bin -Binary \
"20.14.048 - epic 2 - u4.bin" -Binary -unsplit 4 0 \
"20.14.048 - epic 2 - u3.bin" -Binary -unsplit 4 1 \
"20.14.048 - epic 2 - u2.bin" -Binary -unsplit 4 2 \
"20.14.048 - EPIC 2 - U1.bin" -Binary -unsplit 4 3

How to Split it back into a per chip image.

srec_cat 20.14.048-SIMM-920mhz.bin -Binary -split 4 0 -Output U4-920.bin -Binary
srec_cat 20.14.048-SIMM-920mhz.bin -Binary -split 4 1 -Output U3-920.bin -Binary
srec_cat 20.14.048-SIMM-920mhz.bin -Binary -split 4 2 -Output U2-920.bin -Binary
srec_cat 20.14.048-SIMM-920mhz.bin -Binary -split 4 3 -Output U1-920.bin -Binary

0x00000 is the start of boot1
0x40000 is the start of boot2  
BEBE CAFE BEBE CAFE then object name
FEED BEEF FEED BEEF is the end then  4 bytes 
EEnd of ROM
0x80000 is the start of sc.o
0018FC54 is the start of wl.o
Wireline Images

Wireline 20.10.816 for AT27C010 Chips. This works with the 20.14.048 Conventional Firmware

Wireline U134 Upper 20.10.816
Wireline U135 Lower 20.10.816
Exciter Images

This is the matching Exciter Image for a AM27C512 UV EPROM

Exciter 020.09.018

Code Plug format


Hardware info

Part numbers

Here are part numbers and what the correspond to

Station Control info

Station Control Module or SCM is the heart of the Quantar station. The SCM comes in different revisons known as EPIC.

  • EPIC I - TTN4094
  • EPIC IV - This is only for the Smart Zone trunking. IT will not work for conventional
  • EPIC V

The only difference between the various versions of the EPICs (excluding EPIC IV) is the hardware is newer. There is no difference in functionality for conventional analog/astro/P25 operation.

SIMM info

The SIMM used for firmware in the Quantar EPIC 2/3 is an 80 pin SIMM and is basically unobtanimum. It is possiable to use a Motorola Console Operator Interface Module SIMM if you want to modify it.

The conventional uses 4, 29F040 chips arranged to be 32 bits wide. This means each chip stores every 4th byte.

Example we store "QUANTAR MOTOROLA" in the SIMM

Chip 1 Chip 2 Chip 3 Chip 4

So if we read Chip 1 we'd see QTMR.

The IR uses a two bank SIMM with the same layout (8 chips total)

It's possible to pull these chips and read/write them if you have the right programmer. Taking advantage of this I was able to build a SIMM programmer for the soldered in place SIMM's that essentially programs one chip at a time (8bits).

80 Pin SIMM Programmer

It's not pretty but it works.

The SIMM has the ability to be upgraded via the SCM download procedure, but the IR SIMM and NON-IR SIMMs cannot be interchanged. This is do to the boot code being different. Using the SIMM programmer or the socketed SIMM you can reprogram the SIMM's for either.


Like the rest of the unit the receivers are frequency dependent and consist of their own modules. The basic receiver has a preselector which is 4 MHz wide on VHF and 6 MHz wide on UHF.

The receiver is an excellent high side injection design (exception for 800/900 which is low side). The first IF is +21.45 MHz on VHF and +73.35 MHZ on UHF/800/900. The second IF is 455 KHz. In many cases barefoot (minus preselector) the receiver sensitivity is under .112μV (-126 dBm) for 12 dB SINAD. Couple this with the great built in selectivity and it's truly a bullet proof design idea for high RF sites.

The receiver is pretty dumb, there is not a μP on the board, making it easier to troubleshoot. The devices receive their programming from the main CPU on the SCM via SPI bus. The two main chips are the U2500 receiver IC and U2401 PLL IC. U2401, the PLL, is a custom chip responsible for locking the VCOs to the proper frequency, and selecting the high or low VCO. U2500, the receiver IC, contains the 2nd IF/VCO and final processing of the intended signal. Unlike other designs, the receiver IC presents the recovered audio/data as two digital signals to the SCM where A/D conversion happens (if needed).

There are a couple other chips which present various

UHF R0 was added later and extends the coverage and tuning range of the unit down to 380 MHz. The preselctor for this covers the whole range as well.

Each item has more information on it's own page and covers conversions there as well.

Svc Man P/N CLD FRU P/N Range Preselector Description
TRD6361 CLD1250 TLN3250 VHF R1 TFD6511 VHF Receiver 132-154 MHz
TRD6362 CLD1260 TLN3251 VHF R2 TFR6512 VHF Receiver 150-174 MHz
CRX4022 CRX1027 DLN1215 UHF R0 CRX4001 UHF Receiver 380-433 MHz
TRE6281 CLE1190 TLN3313 UHF R1 TLE5991 UHF Receiver 403-433 MHz
TRE6282 CLE1200 TLN3314 UHF R2 TLE5992 UHF Receiver 438-470 MHz
TRE6283 CLE1210 TLN3373 UHF R3 TLE5993 UHF Receiver 470-490 MHz
TRE6284 CLE1220 TLN3374 UHF R4 TLE5993 UHF Receiver 490-520 MHz
TRF6551 CLF1530 TLN3315 800 N/A 800 MHz Receiver 806-825 MHz
TRF6552 CLF1540 TLN3316 900 N/A 900 MHz Receiver 935-941 MHz


The exciters contain their own CPU which communicates with the SCM over a SPI bus. This CPU runs it's own firmware and requires a socketed UV EPROM to upgrade it. This also controls the PA meeting and the bit of EEPROM in the CPU stores the alignment settings for the exciter and PA. Generally a Exciter/PA pair will not need to be realigned if moved from one chassis to another, although it should be checked.

Svc Man P/N CLD FRU P/N Range Description
TLD9831 CLD1270 TLN3252 VHF R1 VHF Exciter 132-154 MHz
TLD9832 CLD1280 TLN3253 VHF R2 VHF Exciter 150-174 MHz
CLX4000 CLX1000 DLN1214 UHF R0 UHF Exciter 380-433 MHz
TLE5971 CLE1230 TLN3305 UHF R1 UHF Exciter 403-433 MHz
TLE5972 CLE1240 TLN3306 UHF R2 UHF Exciter 438-470 MHz
TLE5973 CLE1210 TLN3375 UHF R3 UHF Exciter 470-490 MHz
TLE5974 CLE1220 TLN3376 UHF R4 UHF Exciter 490-520 MHz
TLF6920 CLF1510 TLN3307 900 800 MHz Exciter 850-870 MHz
TLF6930 CLF1520 TLN3308 900 900 MHz Exciter 935-941 MHz

Troof Table

There is a ID code representing the exciter type, it consists of R3700 to R3710. These are either pull up or down resistors on a 6 bit code and are identified on the schematic on the left side of U3700, the μP. Below is the table in MSB-LSB format, with a 1 being high (5v) and a 0 being a low (0v).

Dip switch! Band! Binary! Notes in the RSS!
0 VHF_R1 000000
1 VHF_R2 000001 VHF R2 SL
2 UHF_R1 000010
3 UHF_R2 000011
4 800 000100
5 VHF_R3 000101 sl
6 VHF_R4 000110
7 VHF_R1 000111
8 VHF_R2 001000 VHF R2 FL
9 VHF_R3 001001
10 VHF_R4 001010
11 900 001011
12 UHF_R3 001100
13 UHF_R4 001101
14 blank 001110
15 blank 001111
16 blank 010000
17 blank 010001
18 blank 010010
19 blank 010011 uhf r0 from book
20 blank 010100
21 blank 010101
22 blank 010110
23 blank 010111
24 blank 011000
25 blank 011001
26 blank 011010
27 blank 011011
28 blank 011100
29 blank 011101
30 blank 011110
31 blank 011111
32 blank 100000
33 blank 100001
34 blank 100010
35 blank 100011
36 blank 100100
37 blank 100101 boot
38 blank 100110
39 blank 100111
40 blank 101000
41 blank 101001
42 blank 101010
43 blank 101011
44 blank 101100
45 blank 101101
46 blank 101110
47 blank 101111 "RSS only"
48 blank 110000
49 blank 110001
50 blank 110010
51 blank 110011
52 blank 110100 RAP says VHF_R2 SL
53 blank 110101
54 blank 110110
55 blank 110111
56 blank 111000
57 blank 111001
58 blank 111010
59 blank 111011
60 blank 111100
61 blank 111101
62 blank 111110
63 INVALID 111111 Exciter is in reset all LED's are on and the PA fans turn on

Power Amp

The power amps are actually a cool design.

Their are two basic power amps, a 25W, and a 100/110/125w (depending on band). The power amps all use the same general board layout, with the frequency dependent parts separate from the support components. The 25W PA is a passively cooled unit with a massive heatsink, while the 100/110/125W unit has active cooling with a horizontal heatsink and two cooling fans moving air front to back.

There are a couple different revisions of the PA's so the main PCB has changed a bit over time.

PCB Layout High Power
PCB Layout Low Power


The PA doesn't contain any CPU, it's controlled via the exciter CPU with basic analog level lines going over to the exciter. Some of what's measured by the exciter

  • Intermediate PA drive level - this is the output of the IPA to the final PA pallet
  • Driver PA Level - output of the final PA before the circulator (FPA_DETECT).
  • TX Power Forward - Output measured at the output of the Low Pass Filter
  • TX Power Reverse - Reflected Power from the antenna port
  • OMNI voltage - this is the control voltage on the IPA which comes from the SCM as a 0-5V control signal (V_CONT). This 0-5v controls a transistor making a 0-14v signal to provide the gain of the IPA. This is the basis of the power control. The Control Voltage from the SCM is only present during keydown.
  • IPA Current detect
  • DPA Side A & B current sense
  • Temperature of the PA
  • Fan on/off and alarm
  • PA_ID bits A & B - resistor divider that programs to reference voltages in .5v increments to ID the PA hardware to the exciter.

All these are measured over an TDM bus that selects each at a 200ms interval using a single analog input on the exciter CPU.

PA types

Svc Man P/N Other P/N Rated Power Range Description
CTX1146 DLN1216 110 UHF R0 Second Generation UHF PA 380-433 MHz
TTE2061 TLN3444 110 UHF R1 First Generation UHF PA 403-433 MHz
CLE6164 Example 110 UHF R1 Second Generation UHF PA 403-433 MHz
TTE2062 TLN3446 110 UHF R2 First Generation UHF PA 438-470 MHz
CLE6165 CLE1308 110 UHF R2 Second Generation UHF PA 438-470 MHz
TTE2063 110 UHF R3 First Generation UHF PA 470-490 MHz
TTE6373 110 UHF R3 Second Generation UHF PA 470-490 MHz
TTE2064 100 UHF R4 First Generation UHF PA 490-520 MHz
TTE6374 100 UHF R4 Second Generation UHF PA 490-520 MHz
CTF1091A TLN3442 100 800 800 MHz 100W PA
CTF1092A TLN3299 100 900 900 MHz 100W PA
PA Type PA_ID_A PA_ID_B R4162 R4163 R4164 R4165 Official?
900 100W 3.0 .5 20.5k 10k 1k OPEN YES
800 100W 0.5 1.0 OPEN 0 1.5K 15K YES
800 20W 0.0 1.0 OPEN 1k 1.5K 15K YES
UHF 110W R0 0.0 1.5 OPEN 0 390 1k YES
UHF 110W R1 1.0 0.5 15k 1.5k 560 10k YES
UHF 110W R2 1.5 0.5 1k 390 100 1k YES
UHF 110W R3 3.0 1.0 2.2k 2.7k 1.5k 15k YES
UHF 100W R4 3.5 1.0 18k 15k 1.5k 15k YES
UHF 25W R1 5.0 0.0 33.2k OPEN 0 OPEN YES
UHF 25W R2 0.0 0.5 OPEN 0 1k OPEN YES
VHF 125W R1 3.0 0.0 20.5k 10k 0 OPEN YES
VHF 125W R2 0.0 0.0 OPEN 0 0 OPEN YES
VHF 25W R1/R2 4.5 0.0 12k 68k 0 OPEN YES
VHF 25W R1 3.5 0.0 NO

UHF 110W Generation 1 UHF 110W Generation 2

CTF1091A 100 W 800 MHz CTF1092A 100 W 900 MHz CTX1146A Range 0 Power Amplifier TLF1800B 100W Power Amplifier Module TLF1930C 100W Power Amplifier Module TLF1940B 20W Power Amplifier Module TTE2061A 110W Power Amplifier UHF R1 TTE2062A 110W Power Amplifier UHF R2 TTE2063A 110W Power Amplifier UHF R3 TTE2064A 110W Power Amplifier UHF R4

TLE2511A/ 110W Power Amplifier Module TLE2512A TLE2521 TLE2572 TLE2731B 25W Power Amplifier Module UHF R1 TLE2732B 25W Power Amplifier Module UHF R2 TLD3101G 125W Power Amplifier Module VHF R1 TLD3102G 125W Power Amplifier Module VHF R2 TLD3110C 25W Power Amplifier Module VHF R1/R2 CLX4002A 100/110W Power Amplifier Module (UHF; R1-R4) CLE6164A 100/110W Power Amplifier CLE6165A Module (UHF; R1-R4)

TTE6373A/ 100/110W Power Amplifier TTE6374A Module (UHF; R1-R4)


Work in progress on moving Qunatar bands. These are depreciated, refer to the pages on each FRU.

Going to move this to the various exciter/PA/receiver pages verses having its own page.

VHF R2 to R1

Looks like it should work


Parts difference and re-tune the VCO's


25W PA

This covers both R1 and R2.

125W PA MODELS TLD3101/TLD3102

The 125W PA is the same PA pallet, Low Pass Filter, and IPA. The circulator is different, and about 300 from MOTO. Should be a matter of changing the ID bits

CLD1298 and CLD1299 newer 125W PA's look like they are them same.

VHF R2 to 220 MHz

Software works, it's putting the R4 code plug in, verified the 212.5 cross over frequency for the VCO's. Still need to work out some bugs in it. Should use the 800 MHz for the 220 MHz programing.

Exciter is working.

PA is a complete rebuild, working on it, circulator is being reworked. The A+B voltage feeds are a problem. Right now it keys up, and then shits the bed as the PA is fail. I've tested it by putting good voltage on the IPA, PA, FPA and SWR sense lines. Still doesn't like the PA not drawing current and craps out after like 30 seconds, but it was long enough to test the output from the exciter, it's 13.5 dBm on the Rigol.

Receiver VCO is working, need to modify the image filter and test.