W9CR - User contributions [en]

MikroTik-Fail

2025-10-25T15:35:05Z

N4VX: /* RFC3021 /31 links */

[[Category:MikroTik]]

This is a list of basic failures that I've found MikroTik Routers to have. This is by no means exhaustive.

= IS-IS Support =

<s>Mikrotik doesn't support and will not support ISIS. </s>

The stated [https://forum.mikrotik.com/viewtopic.php?t=30587#p149066 reason] is it's not a "coooool protocol" like OSPF.

EDIT- Maybe now it's "coooool". IS-IS is being introduced into RouterOS starting in
v7.13. As of v7.14beta8 there is now IS-IS support being EVE-NG tested.
* [https://discord.com/channels/936294190948687922/1108700927365500978/1199781869470883861 https://discord.com/channels/936294190948687922/1108700927365500978/1199781869470883861]
* [https://mikrotik.com/download/changelogs#show-tab-tree_2-id-fbb68df8e99f8b3afd4862846ad531f7 https://mikrotik.com/download/changelogs#show-tab-tree_2-id-fbb68df8e99f8b3afd4862846ad531f7]

= No ability to show bridge table =
In a bridge wireless network where CPE are bridging the LAN port to Wireless, then to the AP, and out the AP Ethernet port, one cannot find the MAC address of the CPE radio and what MAC's it's bridging to the AP. There has to be a table of this internally in the AP, but it is not exposed. This makes locating a misbehaving MAC address complex as you have to look at each CPE device's MAC table.

Alvarion/Cisco/Symbol/Karlnet/Canopy has had this since like 1995.

= VRF table ignored for local responses =

In a VRF, where you have a traceroute going through it, MT will source it's ICMP TTL packets using an IP from the main routing table. This means anyone tracrouting to the VRF will be able to see IP it's going over, or if it's a private IP that the main table has, it will likely just show "* * *" as the IP will be unreachable.

This is a [https://forum.mikrotik.com/viewtopic.php?t=78816&start=100 known issue].

https://old.reddit.com/r/mikrotik/comments/5ixk1u/intermediate_hop_dont_show_in_traceroutes_when/

= RFC3021 /31 links =

<s>Mikrotik doesn't support this. This is an over 20 year old RFC. Come on.

https://forum.mikrotik.com/viewtopic.php?p=163163 </s>

RFC3021 /31 addresses for PtP links has been supported in RouterOS since v7.18

https://help.mikrotik.com/docs/spaces/ROS/pages/28606515/Routing+Protocol+Overview

= /export changes at random across different firmware =

/export is not idempotent between OS upgrades on the same hardware.

This means config backups are basically worthless unless you can input them manually and see what breaks. There's no revision testing on it either by MT.

= 4 byte ASN =

Per [https://mailman.nanog.org/pipermail/nanog/2022-August/220138.html this message] on NANOG, they can't do 4 byte ASN's

MikroTik-Fail

2024-01-24T18:56:17Z

N4VX: /* IS-IS Support */

This is a list of basic failures that I've found MikroTik Routers to have. This is by no means exhaustive.

= IS-IS Support =

<s>Mikrotik doesn't support and will not support ISIS. </s>

The stated [https://forum.mikrotik.com/viewtopic.php?t=30587#p149066 reason] is it's not a "coooool protocol" like OSPF.

EDIT- Maybe now it's "coooool". IS-IS is being introduced into RouterOS starting in
v7.13. As of v7.14beta8 there is now IS-IS support being EVE-NG tested.
* [https://discord.com/channels/936294190948687922/1108700927365500978/1199781869470883861 https://discord.com/channels/936294190948687922/1108700927365500978/1199781869470883861]
* [https://mikrotik.com/download/changelogs#show-tab-tree_2-id-fbb68df8e99f8b3afd4862846ad531f7 https://mikrotik.com/download/changelogs#show-tab-tree_2-id-fbb68df8e99f8b3afd4862846ad531f7]

= No ability to show bridge table =
In a bridge wireless network where CPE are bridging the LAN port to Wireless, then to the AP, and out the AP Ethernet port, one cannot find the MAC address of the CPE radio and what MAC's it's bridging to the AP. There has to be a table of this internally in the AP, but it is not exposed. This makes locating a misbehaving MAC address complex as you have to look at each CPE device's MAC table.

Alvarion/Cisco/Symbol/Karlnet/Canopy has had this since like 1995.

= VRF table ignored for local responses =

In a VRF, where you have a traceroute going through it, MT will source it's ICMP TTL packets using an IP from the main routing table. This means anyone tracrouting to the VRF will be able to see IP it's going over, or if it's a private IP that the main table has, it will likely just show "* * *" as the IP will be unreachable.

This is a [https://forum.mikrotik.com/viewtopic.php?t=78816&start=100 known issue].

https://old.reddit.com/r/mikrotik/comments/5ixk1u/intermediate_hop_dont_show_in_traceroutes_when/

= RFC3021 /31 links =

Mikrotik doesn't support this. This is an over 20 year old RFC. Come on.

https://forum.mikrotik.com/viewtopic.php?p=163163

= /export changes at random across different firmware =

/export is not idempotent between OS upgrades on the same hardware.

This means config backups are basically worthless unless you can input them manually and see what breaks. There's no revision testing on it either by MT.

= 4 byte ASN =

Per [https://mailman.nanog.org/pipermail/nanog/2022-August/220138.html this message] on NANOG, they can't do 4 byte ASN's

EPIC II

2022-03-22T21:22:51Z

N4VX: /* CLN6686F */

=Photos=
===CLN6686F===
These photos are from an EPIC II(?) SCM supposedly out of an old 800MHz RD-LAP MDT Data station even though the numbers indicate it to be an EPIC II from a PDR3500. The EEPROMs appear to be Atmel 27C040's instead of the 27C020 listed in the schematics from document 68P81090E02-B from Motorola.
 
<gallery>
Quantar_EPIC_II_SCM_Front_Full.jpg|Quantar EPIC II SCM Full Frontal
Quantar EPIC II SCM EEPROMs.jpg||Quantar EPIC II SCM EEPROMs
Quantar EPIC II SCM 27C040.jpg|Quantar EPIC II SCM 27C040
Quantar EPIC II SCM CLN6686F.jpg|Quantar EPIC II SCM CLN6686F
Quantar EPIC II SCM CLN6686F Rear.jpg|Quantar EPIC II SCM CLN6686F Rear
</gallery>
[[File:SCM_TTN4094-TRN7900-CLN6686.pdf|SCM_TTN4094-TRN7900-CLN6686.pdf|thumb|left]]

File:Quantar EPIC II SCM 27C040.jpg

2022-03-22T21:22:20Z

N4VX:

Quantar EPIC II SCM 27C040

EPIC II

2022-03-22T21:06:36Z

N4VX: /* CLN6686F */

=Photos=
===CLN6686F===
These photos are from an EPIC II(?) SCM supposedly out of an old 800MHz RD-LAP MDT Data station even though the numbers indicate it to be an EPIC II from a PDR3500.
 
<gallery>
Quantar_EPIC_II_SCM_Front_Full.jpg|Quantar EPIC II SCM Full Frontal
Quantar EPIC II SCM EEPROMs.jpg||Quantar EPIC II SCM EEPROMs
Quantar EPIC II SCM CLN6686F.jpg|Quantar EPIC II SCM CLN6686F
Quantar EPIC II SCM CLN6686F Rear.jpg|Quantar EPIC II SCM CLN6686F Rear
</gallery>
[[File:SCM_TTN4094-TRN7900-CLN6686.pdf|SCM_TTN4094-TRN7900-CLN6686.pdf|thumb|left]]

EPIC II

2022-03-22T20:59:05Z

N4VX: /* Photos */

=Photos=
===CLN6686F===
These photos are supposedly from an EPIC II SCM out of an old 800MHz RD-LAP MDT Data station even though the numbers indicate it to be from a PDR3500.
<gallery>
Quantar_EPIC_II_SCM_Front_Full.jpg|Quantar EPIC II SCM Full Frontal
Quantar EPIC II SCM EEPROMs.jpg||Quantar EPIC II SCM EEPROMs
Quantar EPIC II SCM CLN6686F.jpg|Quantar EPIC II SCM CLN6686F
Quantar EPIC II SCM CLN6686F Rear.jpg|Quantar EPIC II SCM CLN6686F Rear
</gallery>

File:Quantar EPIC II SCM CLN6686F Rear.jpg

2022-03-22T20:57:38Z

N4VX:

Quantar EPIC II SCM CLN6686F Rear

User:N4VX

2022-03-22T20:05:31Z

N4VX:

A Western North Carolina native living, working and playing in the beautiful Blue Ridge Range of the Southern Appalachain Mountains. If you don't do nothing, do it big.
 
*[https://wiki.n4vx.net wiki.n4vx.net]

EPIC II

2022-03-22T20:00:26Z

N4VX: /* Photos */

=Photos=
These photos are supposedly from an SCM out of an old 800MHz RD-LAP MDT Data station even though the numbers indicate it to be from a PDR3500.
<gallery>
Quantar_EPIC_II_SCM_Front_Full.jpg|Quantar EPIC II SCM Full Frontal
Quantar EPIC II SCM EEPROMs.jpg||Quantar EPIC II SCM EEPROMs
Quantar EPIC II SCM CLN6686F.jpg|Quantar EPIC II SCM CLN6686F
</gallery>

EPIC II

2022-03-22T19:14:48Z

N4VX: /* Photos */

=Photos=
These photos are supposedly from an SCM out of an old 800MHz 4.1 Smartzone Trunked IR station even though the numbers indicate it to be from a PDR3500.
<gallery>
Quantar_EPIC_II_SCM_Front_Full.jpg|Quantar EPIC II SCM Full Frontal
Quantar EPIC II SCM EEPROMs.jpg||Quantar EPIC II SCM EEPROMs
Quantar EPIC II SCM CLN6686F.jpg|Quantar EPIC II SCM CLN6686F
</gallery>

File:Quantar EPIC II SCM CLN6686F.jpg

2022-03-22T19:14:21Z

N4VX:

Quantar EPIC II SCM CLN6686F

EPIC II

2022-03-22T19:07:01Z

N4VX: /* Photos */

=Photos=
<gallery>
Quantar_EPIC_II_SCM_Front_Full.jpg|Quantar EPIC II SCM Full Frontal
Quantar EPIC II SCM EEPROMs.jpg||Quantar EPIC II SCM EEPROMs
</gallery>

EPIC II

2022-03-22T19:06:34Z

N4VX: Created page with "=Photos= ==Front== <gallery> Quantar_EPIC_II_SCM_Front_Full.jpg|Quantar EPIC II SCM Full Frontal Quantar EPIC II SCM EEPROMs.jpg||Quantar EPIC II SCM EEPROMs </gallery> ==Rear=="

=Photos=
==Front==
<gallery>
Quantar_EPIC_II_SCM_Front_Full.jpg|Quantar EPIC II SCM Full Frontal
Quantar EPIC II SCM EEPROMs.jpg||Quantar EPIC II SCM EEPROMs
</gallery>
==Rear==

File:Quantar EPIC II SCM EEPROMs.jpg

2022-03-22T19:04:09Z

N4VX:

Quantar EPIC II SCM EEPROMs

File:Quantar EPIC II SCM Front Full.jpg

2022-03-22T17:32:15Z

N4VX:

Quantar EPIC II SCM Front Full

Quantar

2022-03-22T17:20:59Z

N4VX: /* Station Control info */

== Quantar/Quantro info ==

There is a bunch of info here about the technical aspects of the Quantar Stations.

The info on the modification and changing ranges of the various modules is on the respective pages. There is some conversion info below, but it's being migrated and reformatted under the respective pages. I feel this is more logical.

If you find anything to be wrong here, please feel free to make an account and change it. I've had to lock down account creation, so you'll need to have it approved. If you want to email me directly, my email is [mailto:bryan@bryanfields.net bryan@bryanfields.net]

=== Specifications ===

[[Media:Quantar Specifications VHF, UHF, 800 MHz.pdf|Quantar Specifications VHF, UHF, 800 MHz]] - This is the combined spec sheet for the VHF/UHF and 800 base stations.

[[Media:Quantar Data Base Sation Specification Sheet 800 900 MHz.pdf|Quantar Data Base Station Specification Sheet 800 900 MHz]]

[[Media:ASTRO TAC QUANTAR receiver manual.pdf|ASTRO TAC QUANTAR receiver manual]]

=== Programming ===

Links to programming stuff

[[media:CSS_007.13.R022.00.035_12-04.exe|CSS 007.13.R022.0035 for EPIC4 Smart Zone SCM]]

[[Media:WinRSS_R14.08.01.zip|WinRSS 14.08.01 Windows RSS]]

[[Media:Quantar WinRSS R14.10.00 release July 15 2011.zip|WinRSS 14.10.00 release July 15 2011.zip]]

[[Media:WinRSS R14.11.00.zip| WinRSS 14.11.00]]

[[Media:WinRSS R14.12.00.zip| WinRSS R14.12.00]]

[[Media:WinRSS_R14.13.00.zip|WinRSS 14.13.00 April 2015]] Current Winrss

[[Media:DIU CSS Installation.zip|DIU3000 CPS/CSS software 8.00.18 30-APR-2005]]

==== Firmware ====

The newer SCM modules can be upgraded via SLIP connection over the tty port, or via IP over the 10Base2 connector (anyone have a hub?).

The Wireline typically will upgrade during this too, unless it has the older EPROM memory. At that point you'll have to swap the chips.

The exciter is still a hard chip swap upgrade, but programed EPROM's are $20 shipped on eBay. Unless you have more than a few to upgrade it's not cost effective to buy the programer and chips yourself.

:: [[Media:Quantar Conventional Firmware Upgrade Package R020-14-048.zip|Quantar Conventional Firmware Upgrade Package R020-14-048 ]]

===== SIMM Images =====

The SIMM has a boot1 image which is a basic bootloader (0x460-0x3ffff). This runs just after the bootstrap code (0x000 0x45f). The bootloader (boot.o) contains basic code to initialize the hardware and validate the boot2.o, sc.o and wl.o images stored in the SIMM. It also has a slip loader in it. With only the boot.o code running it's possible to reload the entire OS at 9600 baud via the front port.

The boot.o is the only code not able to be upgraded on the SIMM via SLIP/FTP. To upgrade boot.o you need to flash the SIMM directly. Normally boot.o does not matter, but it is different for IR and NIR stations. The other issue is the newer (EPIC III) SCM cards will not boot with boot.o 020.10.001, and need at least the 020.10.008 code. The newest boot code is 020.10.012, and the images below have that code on them.

Conventional Firmware for U1-U4 on the SIMM module 20.14.048

:: [[media:NIR-R020.12.048 B2-R020.14.15 B1-R020.10.12.zip]] -- Most current firmware, works on all SCM boards.

:: [[media:Quantar-Flash-Simm-EPIC2-NON-IR-FW-20.14.048-Boot-020.10.001.zip]] -- '''Don't use, older code for historical reference only'''

IntelliRepeater (IR) Firmware for U1-U8 on the two bank SIMM module 20.14.520

:: [[Media:IR-SIMM-20.14.520.zip]]

This is for the old B013.05.014 EPIC I firmware that would run from the 27C040 PROMs. It's here for reference, don't use it.

:: [[Media:Quantar 27C040 SCM B013.05.014 EPROM images.zip]]

Hacking info

<pre>
How to combine the firmware into a single binary image

srec_cat -Output 20.14.038-SIMM.bin -Binary \
"U4.bin" -Binary -unsplit 4 0 \
"U3.bin" -Binary -unsplit 4 1 \
"U2.bin" -Binary -unsplit 4 2 \
"U1.bin" -Binary -unsplit 4 3

srec_cat -Output 20.14.048-SIMM.bin -Binary \
"20.14.048 - epic 2 - u4.bin" -Binary -unsplit 4 0 \
"20.14.048 - epic 2 - u3.bin" -Binary -unsplit 4 1 \
"20.14.048 - epic 2 - u2.bin" -Binary -unsplit 4 2 \
"20.14.048 - EPIC 2 - U1.bin" -Binary -unsplit 4 3

How to Split it back into a per chip image.

srec_cat 20.14.048-SIMM-920mhz.bin -Binary -split 4 0 -Output U4-920.bin -Binary
srec_cat 20.14.048-SIMM-920mhz.bin -Binary -split 4 1 -Output U3-920.bin -Binary
srec_cat 20.14.048-SIMM-920mhz.bin -Binary -split 4 2 -Output U2-920.bin -Binary
srec_cat 20.14.048-SIMM-920mhz.bin -Binary -split 4 3 -Output U1-920.bin -Binary

0x00000 is the start of boot1

boot1 is never updated by the station. When you go to flash the station, the ftp server an everything runs from this code. The main sc.o code doesn't have the FTP server in it.

0x40000 is the start of boot2
BEBE CAFE BEBE CAFE then object name
FEED BEEF FEED BEEF is the end then 4 bytes
EEnd of ROM
0x80000 is the start of sc.o
0018FC54 is the start of wl.o
</pre>

===== Wireline Images =====

'''Go check out the [[Wireline|wireline page]] for updated info the below is not the most current.'''

Wireline 20.10.816 for AT27C010 Chips. This works with the 20.14.048 Conventional Firmware

:: [[Media:wlb_2000_20.10.816_u134_upper_AT27C010.bin|Wireline U134 Upper 20.10.816 ]]
:: [[Media:wlb_2000_20.10.816_u135_lower_AT27C010.bin|Wireline U135 Lower 20.10.816 ]]

===== Exciter Images =====

This is the matching Exciter Image for a AM27C512 UV EPROM

:: [[Media:exciter_r020.09.018_matches-scm-20.14.048__U3701__am27c512.bin|Exciter 020.09.018]]

==== Code Plug format ====

=== Manuals ===

* [[media:Service_manual.pdf|Quantar Service Manual 68P81088E90-G]] - this is the full service manual for the Quantar/Quantro and AstroTac
* [[media:Quantar RSS Manual R14.10.00.pdf|Quantar RSS Manual R14.10.00]]

* [[Media:6881085E35-AT Quantar RSS Manual R14.13.00.pdf|Quantar RSS Manual R14.13.00]]

* [[:Category:Quantar Service Bulletin |a complete listing of service bulletins for the Quantar]]

The PDR3500 is basically a quantar in a portable format using a PA from a Spectra mid power radio. The basic service manual has a diagram of the backplane and glue circuits that tie this all together. It's very interesting to read as it explains quite a bit more of how the ID resistors and SPI bus works. If you're hacking quantar's, it's a must read.

* [[Media:PDR 3500 Transportable Repeater Basic Service Manual.pdf|PDR 3500 Transportable Repeater Basic Service Manual]]

* [[Media:ASTRO 25 Conventional Systems System Planner ASTRO 3.1 Convl Sys.Planner.pdf|ASTRO 25 Conventional Systems System Planner ASTRO 3.1 Convl Sys.Planner]]

* [[Media:Zhone TeNSr 800 imacs-system-reference-guide-7.2.1.pdf|Zhone TeNSr 800 imacs-system-reference-guide-7.2.1]]

* [[Media:68P81003Y54-O Managing Network Transport Equipment.pdf|68P81003Y54-O Managing Network Transport Equipment]]

* [[Media:GPS Simulcast Installation Manual 68P81098E65-C.pdf|GPS Simulcast Installation Manual 68P81098E65-C]]

== Hardware info ==

=== Part numbers ===
Here are part numbers and what the correspond to.

=== Power Supplies ===

The -48v supplies are easy to see as they have a side to side DC breaker style switch. The Motorola/Onan column refers to the manufacturer of the PS. Many people rag on the Onan power supplies, but I've not had one fail in service yet. The Onan do have a heat activated fan, whereas the Motorola run continuously. This can be good for base use or in the lab, as the base station will not make noise unless it's keyed down for some time.

{| class="wikitable" style="background-color:#D6DCE4; width: 60%;"
| colspan="4" style="text-align:Center" | '''Quantar power supplies'''
|- style="background-color:#D6DCE4;border-bottom:solid 2px;font-weight: bold;"
| P/N ||Description||Motorola/Onan||Watts
|--style="background-color:#EDEDED;
|CPN1031||48/60v input||Yes||600
|--style="background-color:#EDEDED;
|CPN1049||AC no charger||Yes||265
|--style="background-color:#EDEDED;
|CPN1050||AC with Charger||Yes||265
|--style="background-color:#EDEDED;
|CPN1047||AC no charger||Yes||625
|--style="background-color:#EDEDED;
|CPN1048||AC with Charger||Yes||625
|--style="background-color:#EDEDED;
|TRN7802||12/24v DC||No||210
|--style="background-color:#EDEDED;
|TRN7803||48/60v input||No||210
|--style="background-color:#EDEDED;
|TRN7801||24v input||No||600
|--style="background-color:#EDEDED;
|CPN1042||AC||No||700
|--style="background-color:#EDEDED;
|TPN6185||AC w/Charger|| ?||625
|--style="background-color:#EDEDED;
|TPN1186||No idea|| ? ||
|}

=== [[Quantro/Quantar-Backplane|BackPlane]] ===

The [[Quantro/Quantar-Backplane|BackPlane]] modules are different for the Quantar and Quantro.

=== Station Control info ===

'''Station Control Module''' or '''''SCM''''' is the heart of the Quantar station. The SCM comes in different revisons known as EPIC.

* [[EPIC 1|EPIC I - TTN4094]]
* [[EPIC II|EPIC II - CLN6686F]]
* EPIC III - Note the EPIC3 will not work out of band. The modulation will be very low.
* EPIC IV - '''This is only for the Smart Zone trunking. IT will not work for conventional'''
* [[EPIC V| EPIC V - MCLN8447]]

{| class="wikitable" style="background-color:#D6DCE4; width: 60%;"
| colspan="5" style="text-align:Center" | '''Quantar'''
|- style="background-color:#D6DCE4;border-bottom:solid 2px;font-weight: bold;"
| EPIC||P/N Type||Conv/6809||IntelliRepeater||Astro 25 Trunking ONLY
|- style="background-color:#FCE4D6"
| EPIC I||Board||TTN4094||TRN7900||N/A
|- style="background-color:#FCE4D6;
| ||FRU||TLN3397||TLN3398||N/A
|- style="background-color:#DDEBF7;
| EPIC II||Board||CLN6961||CLN6960||N/A
|- style="background-color:#DDEBF7;
| ||FRU||CLN1293||CLN1294||N/A
|- style="background-color:#E2EFDA;
| EPIC III||Board||CLN1614||N/A||N/A
|- style="background-color:#E2EFDA;
| ||FRU||CLN1621||N/A||N/A
|- style="background-color:#FFF2CC;
| EPIC IV||Board||N/A||N/A||CLN7692
|- style="background-color:#FFF2CC;
| ||FRU||N/A||N/A||DLN1229
|- style="background-color:#EDEDED;
| [[EPIC V|EPIC V]]||Board||MCLN8426||MCLN8447||N/A
|-style="background-color:#EDEDED;
| ||FRU||CLN8480||CLN8479||N/A
|}

{| class="wikitable" style="background-color:#D6DCE4; width: 60%;"
| colspan="5" style="text-align:Center" | '''ASTRO-TAC Receiver'''
|- style="background-color:#D6DCE4;border-bottom:solid 2px;font-weight: bold;"
| EPIC||P/N Type||Conv/6809||Astro 25 Trunking ONLY
|- style="background-color:#FCE4D6"
| EPIC I||Board||TTN4094||N/A
|- style="background-color:#FCE4D6;
| ||FRU||TLN3397||N/A
|- style="background-color:#DDEBF7;
| EPIC II||Board||CLN6873||CLN6873
|- style="background-color:#DDEBF7;
| ||FRU||CLN1273||CLN1273
|- style="background-color:#EDEDED;
| EPIC V||Board||MCLN8426||MCLN8426
|-style="background-color:#EDEDED;
| ||FRU||CLN8480||CLN8480
|}

{| class="wikitable" style="background-color:#D6DCE4; width: 75%;"
| colspan="8" style="text-align:Center" | '''Others'''
|- style="background-color:#D6DCE4;border-bottom:solid 2px;font-weight: bold;"
| EPIC||P/N Type||SecureNet||Limited||PDR 3500||DBS||ATAC 3000 ||ATAC9600
|- style="background-color:#DDEBF7;
| EPIC II||Board||CLN6961||CLN7462||CLN6686||CLN7361||CLN7361||[[ASTRO-TAC#CCN4009|CCN4009]]
|- style="background-color:#DDEBF7;
| ||FRU|| ||CLN1609||CLN1177||CLN1914||CLN1914||CCN1009
|- style="background-color:#EDEDED;
| EPIC V||Board||MCLN8426||N/A||N/A||N/A||N/A||N/A
|-style="background-color:#EDEDED;
| ||FRU||Unknown||N/A||N/A||N/A||N/A||N/A
|}

The only difference between the various versions of the EPICs (excluding EPIC IV) is the hardware is newer. There is no difference in functionality for conventional analog/astro/P25 operation.

==== SIMM info ====

The SIMM used for firmware in the Quantar EPIC 2/3 is an 80 pin SIMM and is basically unobtanimum. It is possiable to use a Motorola [[COIM Modification|Console Operator Interface Module SIMM]] if you want to modify it.

The conventional uses 4, 29F040 chips arranged to be 32 bits wide. This means each chip stores every 4th byte.

Example we store "QUANTAR MOTOROLA" in the SIMM

{| class="wikitable"
|-
! Chip 1 !! Chip 2 !! Chip 3 !! Chip 4
|-
| Q || U || A || N
|-
| T || A || R ||
|-
| M || O || T || O
|-
| R || O || L || A
|}

So if we read Chip 1 we'd see QTMR.

The IR uses a two bank SIMM with the same layout (8 chips total)

It's possible to pull these chips and read/write them if you have the right programmer. Taking advantage of this I was able to build a SIMM programmer for the soldered in place SIMM's that essentially programs one chip at a time (8bits).
[[File:SIMM Programmer.jpeg|thumbnail|80 Pin SIMM Programmer]]

It's not pretty but it works.

The SIMM has the ability to be upgraded via the SCM download procedure, but the IR SIMM and NON-IR SIMMs cannot be interchanged. This is do to the boot code being different. Using the SIMM programmer or the socketed SIMM you can reprogram the SIMM's for either.

==== SIMM-less SCM ====

It is possible to use 29F040 chips in the sockets on the EPIC 1 with just a flick of the Flash switch, this makes it easy to use the current Quantar Firmware in the EPIC 1 with just standard DIP chips.

In the later revision EPIC's the DIP sockets are only used for 27c040 chips which have a slightly different pinout. It's possible to use the SIMM images as u1-4 maps to U451-454 with a slight modification to the chips. Typically I'll bend up pins 1, (A18 on Flash, VPP on EEPROM) and 31 (!WE on Flash, A18 on EEPROM), and then connect a wire from the board at pin 31 to pin 1 on the chip. A connection to !WE on the chip is optional unless you want to be able to upgrade the chips. In this case you'll need to make a conection from SIMM pins 53, 29, 6, & 5 to the !WE lines on U451-U454 respectively.

The Quantar doesn't care about the ID pins on the SIMM, but I typically will tie 74, 75, 76, 79 to ground/pin 80. If you're doing an ATAC 3k, the ATAC does care about this and you need pins 76 and 79 tied to ground.

Of course the Intelerepeater and ATAC9k will not work in this configuration as they need two banks on the SIMM, so you can't do this if that's your requirement. For most ham stuff, there's no reason you need anything more than NIR code for Quantar and ATAC 3000.

=== Receiver ===
Like the rest of the unit the receivers are frequency dependent and consist of their own modules. The basic receiver has a preselector which is 4 MHz wide on VHF and 6 MHz wide on UHF.

The receiver is an excellent high side injection design (exception for 800/900 which is low side). The first IF is +21.45 MHz on VHF and +73.35 MHZ on UHF/800/900. The second IF is 455 KHz. In many cases barefoot (minus preselector) the receiver sensitivity is under .112μV (-126 dBm) for 12 dB SINAD. Couple this with the great built in selectivity and it's truly a bullet proof design idea for high RF sites.

The receiver is pretty dumb, there is not a μP on the board, making it easier to troubleshoot. The devices receive their programming from the main CPU on the SCM via SPI bus. The two main chips are the U2500 receiver IC and U2401 PLL IC. U2401, the PLL, is a custom chip responsible for locking the VCOs to the proper frequency, and selecting the high or low VCO. U2500, the receiver IC, contains the 2nd IF/VCO and final processing of the intended signal. Unlike other designs, the receiver IC presents the recovered audio/data as two digital signals to the SCM where A/D conversion happens (if needed).

There are a couple other chips which present various

UHF R0 was added later and extends the coverage and tuning range of the unit down to 380 MHz. The preselctor for this covers the whole range as well.

Each item has more information on it's own page and covers conversions there as well.

{| class="wikitable sortable"
|-
! Svc Man P/N !! CLD !! FRU P/N !! Range !! Preselector !! Description
|-
| TRD6361 || CLD1250 || TLN3250 || VHF R1 || [[VHF Preselector|TFD6511]] || [[VHF Receiver|VHF Receiver 132-154 MHz]]
|-
| TRD6362 || CLD1260 || TLN3251 || VHF R2 || [[VHF Preselector|TFR6512]] || [[VHF Receiver|VHF Receiver 150-174 MHz]]
|-
| CRX4022 || CRX1027 || DLN1215 || UHF R0 || [[UHF Preselector|CRX4001]] || [[UHF R0 Receiver|UHF Receiver 380-433 MHz]]
|-
| TRE6281 || CLE1190 || TLN3313 || UHF R1 || [[UHF Preselector|TLE5991]] || [[UHF Receiver|UHF Receiver 403-433 MHz]]
|-
| TRE6282 || CLE1200 || TLN3314 || UHF R2 || [[UHF Preselector|TLE5992]] || [[UHF Receiver|UHF Receiver 438-470 MHz]]
|-
| TRE6283 || CLE1210 || TLN3373 || UHF R3 || [[UHF Preselector|TLE5993]] || [[UHF Receiver|UHF Receiver 470-490 MHz]]
|-
| TRE6284 || CLE1220 || TLN3374 || UHF R4 || [[UHF Preselector|TLE5993]] ||[[UHF Receiver|UHF Receiver 490-520 MHz]]
|-
| TRF6551 || CLF1530 || TLN3315 || 800 || N/A || [[800 MHz Receiver|800 MHz Receiver 806-825 MHz]]
|-
| TRF6552 || CLF1540 || TLN3316 || 900 || N/A || [[900 MHz Receiver|900 MHz Receiver 935-941 MHz]]
|}

=== Exciter ===

The exciters contain their own CPU which communicates with the SCM over a SPI bus. This CPU runs it's own firmware and requires a socketed UV EPROM to upgrade it. This also controls the PA meeting and the bit of EEPROM in the CPU stores the alignment settings for the exciter and PA. Generally a Exciter/PA pair will not need to be realigned if moved from one chassis to another, although it should be checked.

{| class="wikitable sortable"
|-
! Svc Man P/N !! CLD !! FRU P/N !! Range !! Description
|-
| TLD9831 || CLD1270 || TLN3252 || VHF R1 || [[VHF Exciter|VHF Exciter 132-154 MHz]]
|-
| TLD9832 || CLD1280 || TLN3253 || VHF R2 || [[VHF Exciter|VHF Exciter 150-174 MHz]]
|-
| CLX4000 || CLX1000 || DLN1214 || UHF R0 || [[UHF R0 Exciter|UHF Exciter 380-433 MHz]]
|-
| TLE5971 || CLE1230 || TLN3305 || UHF R1 || [[UHF Exciter|UHF Exciter 403-433 MHz]]
|-
| TLE5972 || CLE1240 || TLN3306 || UHF R2 || [[UHF Exciter|UHF Exciter 438-470 MHz]]
|-
| TLE5973 || CLE1210 || TLN3375 || UHF R3 || [[UHF Exciter|UHF Exciter 470-490 MHz]]
|-
| TLE5974 || CLE1220 || TLN3376 || UHF R4 || [[UHF Exciter|UHF Exciter 490-520 MHz]]
|-
| TLF6920 || CLF1510 || TLN3307 || 900 || [[800 MHz Exciter|800 MHz Exciter 850-870 MHz]]
|-
| TLF6930 || CLF1520 || TLN3308 || 900 || [[900 MHz Exciter|900 MHz Exciter 935-941 MHz]]
|}

=== Station Access Module ===
[[Station Access Module|Check here for SAM info]]

==== Troof Table ====
There is a ID code representing the exciter type, it consists of R3700 to R3710. These are either pull up or down resistors on a 6 bit code and are identified on the schematic on the left side of U3700, the μP.
Below is the table in MSB-LSB format, with a 1 being high (5v) and a 0 being a low (0v).

{| class="wikitable sortable"
|-
!'''Dip switch'''!
!'''Band'''!
!'''Binary'''!
!'''Notes in the RSS'''!
|-
| 0||VHF_R1||000000||
|-
| 1||VHF_R2||000001||VHF R2 SL
|-
| 2||UHF_R1||000010||
|-
| 3||UHF_R2||000011||
|-
| 4||800||000100||
|-
| 5||VHF_R3||000101||sl
|-
| 6||VHF_R4||000110||
|-
| 7||VHF_R1||000111||
|-
| 8||VHF_R2||001000||VHF R2 FL
|-
| 9||VHF_R3||001001||
|-
| 10||VHF_R4||001010||
|-
| 11||900||001011||
|-
| 12||UHF_R3||001100||
|-
| 13||UHF_R4||001101||
|-
| 14||blank||001110||
|-
| 15||blank||001111||
|-
| 16||blank||010000||
|-
| 17||blank||010001||
|-
| 18||blank||010010||
|-
| 19||blank||010011||uhf r0 from book
|-
| 20||blank||010100||
|-
| 21||blank||010101||
|-
| 22||blank||010110||
|-
| 23||blank||010111||
|-
| 24||blank||011000||
|-
| 25||blank||011001||
|-
| 26||blank||011010||
|-
| 27||blank||011011||
|-
| 28||blank||011100||
|-
| 29||blank||011101||
|-
| 30||blank||011110||
|-
| 31||blank||011111||
|-
| 32||blank||100000||
|-
| 33||blank||100001||
|-
| 34||blank||100010||
|-
| 35||blank||100011||
|-
| 36||blank||100100||
|-
| 37||blank||100101||boot
|-
| 38||blank||100110||
|-
| 39||blank||100111||
|-
| 40||blank||101000||
|-
| 41||blank||101001||
|-
| 42||blank||101010||
|-
| 43||blank||101011||
|-
| 44||blank||101100||
|-
| 45||blank||101101||
|-
| 46||blank||101110||
|-
| 47||blank||101111|| "RSS only"
|-
| 48||blank||110000||
|-
| 49||blank||110001||
|-
| 50||blank||110010||
|-
| 51||blank||110011||
|-
| 52||blank||110100||RAP says VHF_R2 SL
|-
| 53||blank||110101||
|-
| 54||blank||110110||
|-
| 55||blank||110111||
|-
| 56||blank||111000||
|-
| 57||blank||111001||
|-
| 58||blank||111010||
|-
| 59||blank||111011||
|-
| 60||blank||111100||
|-
| 61||blank||111101||
|-
| 62||blank||111110||
|-
| 63||INVALID||111111||Exciter is in reset all LED's are on and the PA fans turn on
|}

=== Power Amp ===
The power amps are actually a cool design.

Their are two basic power amps, a 25W, and a 100/110/125w (depending on band). The power amps all use the same general board layout, with the frequency dependent parts separate from the support components. The 25W PA is a passively cooled unit with a massive heatsink, while the 100/110/125W unit has active cooling with a horizontal heatsink and two cooling fans moving air front to back.

There are a couple different revisions of the PA's so the main PCB has changed a bit over time.

[[File:125W VHF PA layout.png|400px|thumbnail|left|PCB Layout High Power]]

[[File:25W UHF PA Layout.png|400px|thumbnail|center|PCB Layout Low Power]]

[[|thumbnail|center]]

The PA doesn't contain any CPU, it's controlled via the exciter CPU with basic analog level lines going over to the exciter.
Some of what's measured by the exciter
* Intermediate PA drive level - this is the output of the IPA to the final PA pallet
* Driver PA Level - output of the final PA before the circulator (FPA_DETECT).
* TX Power Forward - Output measured at the output of the Low Pass Filter
* TX Power Reverse - Reflected Power from the antenna port
* OMNI voltage - this is the control voltage on the IPA which comes from the SCM as a 0-5V control signal (V_CONT). This 0-5v controls a transistor making a 0-14v signal to provide the gain of the IPA. This is the basis of the power control. The Control Voltage from the SCM is only present during keydown.
* IPA Current detect
* DPA Side A & B current sense
* Temperature of the PA
* Fan on/off and alarm
* PA_ID bits A & B - resistor divider that programs to reference voltages in .5v increments to ID the PA hardware to the exciter.

All these are measured over an TDM bus that selects each at a 200ms interval using a single analog input on the exciter CPU.

PA types
{| class="wikitable sortable"
|-
! Svc Man P/N !! Other P/N !! Rated Power !! Range !! Description
|-
| CTX1146 || DLN1216 || 110 || UHF R0 || [[Second Generation PA|Second Generation UHF PA 380-433 MHz]]
|-
| TTE2061 || TLN3444 || 110 || UHF R1 || [[First Generation PA|First Generation UHF PA 403-433 MHz]]
|-
| CLE6164 || Example || 110 || UHF R1 || [[Second Generation PA|Second Generation UHF PA 403-433 MHz]]
|-
| TTE2062 || TLN3446 || 110 || UHF R2 || [[First Generation PA|First Generation UHF PA 438-470 MHz]]
|-
| CLE6165 || CLE1308 || 110 || UHF R2 || [[Second Generation PA|Second Generation UHF PA 438-470 MHz]]
|-
| TTE2063 || || 110 || UHF R3 || [[First Generation PA|First Generation UHF PA 470-490 MHz]]
|-
| TTE6373 || || 110 || UHF R3 || [[Second Generation PA|Second Generation UHF PA 470-490 MHz]]
|-
| TTE2064 || || 100 || UHF R4 || [[First Generation PA|First Generation UHF PA 490-520 MHz]]
|-
| TTE6374 || || 100 || UHF R4 || [[Second Generation PA|Second Generation UHF PA 490-520 MHz]]
|-
| CTF1091A/TLF1930 || TLN3442 || 100 || 800 || [[800 MHz 100W PA| 800 MHz 100W PA]]
|-
| CTF1092A/TLF1800 || TLN3299 || 100 || 900 || [[900 MHz 100W PA| 900 MHz 100W PA]]
|}

{| class="wikitable sortable"
|-
! PA Type !! PA_ID_A !! PA_ID_B !! R4162 !! R4163 !! R4164 !! R4165 !! Official?
|-
| 900 100W || 3.0 || .5 || 20.5k || 10k || 1k || OPEN || YES
|-
| 800 100W || 0.5 || 1.0 || OPEN || 0 || 1.5K || 15K || YES
|-
| 800 20W || 0.0 || 1.0 || OPEN || 1k || 1.5K || 15K || YES
|-
| UHF 110W R0 || 0.0 || 1.5 || OPEN || 0 || 390 || 1k || YES
|-
| UHF 110W R1 || 1.0 || 0.5 || 15k || 1.5k || 560 || 10k || YES
|-
| UHF 110W R2 || 1.5 || 0.5 || 1k || 390 || 100 || 1k || YES
|-
| UHF 110W R3 || 3.0 || 1.0 || 2.2k || 2.7k || 1.5k || 15k || YES
|-
| UHF 100W R4 || 3.5 || 1.0 || 18k || 15k || 1.5k || 15k || YES
|-
| UHF 25W R1 || 5.0 || 0.0 || 33.2k || OPEN || 0 || OPEN || YES
|-
| UHF 25W R2 || 0.0 || 0.5 || OPEN || 0 || 1k || OPEN || YES
|-
| VHF 125W R1 || 3.0 || 0.0 || 20.5k || 10k || 0 || OPEN || YES
|-
| VHF 125W R2 || 0.0 || 0.0 || OPEN || 0 || 0 || OPEN || YES
|-
| VHF 25W R1/R2 || 4.5 || 0.0 || 12k || 68k || 0 || OPEN || YES
|-
| VHF 25W R1 || 3.5 || 0.0 || || || || NO
|}

UHF 110W Generation 1
UHF 110W Generation 2

CTF1091A 100 W 800 MHz
CTF1092A 100 W 900 MHz
CTX1146A Range 0 Power Amplifier
TLF1800B 100W Power Amplifier Module
TLF1930C 100W Power Amplifier Module
TLF1940B 20W Power Amplifier Module
TTE2061A 110W Power Amplifier UHF R1
TTE2062A 110W Power Amplifier UHF R2
TTE2063A 110W Power Amplifier UHF R3
TTE2064A 110W Power Amplifier UHF R4

TLE2511A/ 110W Power Amplifier Module
TLE2512A
TLE2521
TLE2572
TLE2731B 25W Power Amplifier Module UHF R1
TLE2732B 25W Power Amplifier Module UHF R2
TLD3101G 125W Power Amplifier Module VHF R1
TLD3102G 125W Power Amplifier Module VHF R2
TLD3110C 25W Power Amplifier Module VHF R1/R2
CLX4002A 100/110W Power Amplifier Module (UHF; R1-R4)
CLE6164A 100/110W Power Amplifier CLE6165A Module (UHF; R1-R4)

TTE6373A/ 100/110W Power Amplifier
TTE6374A Module (UHF; R1-R4)

== Conversions ==

Work in progress on moving Qunatar bands.
These are depreciated, refer to the pages on each FRU.

Going to move this to the various exciter/PA/receiver pages verses having its own page.

=== VHF R2 to R1 ===

Looks like it should work

==== Exciter ====
Parts difference and re-tune the VCO's

==== Amplifier ====

===== 25W PA =====
This covers both R1 and R2.

===== 125W PA MODELS TLD3101/TLD3102 =====
The 125W PA is the same PA pallet, Low Pass Filter, and IPA. The circulator is different, and about 300 from MOTO. Should be a matter of changing the ID bits

CLD1298 and CLD1299 newer 125W PA's look like they are them same.

=== VHF R2 to 220 MHz ===

Software works, it's putting the R4 code plug in, verified the 212.5 cross over frequency for the VCO's. Still need to work out some bugs in it. Should use the 800 MHz for the 220 MHz programing.

Exciter is working.

PA is a complete rebuild, working on it, circulator is being reworked. The A+B voltage feeds are a problem.
Right now it keys up, and then shits the bed as the PA is fail. I've tested it by putting good voltage on the IPA, PA, FPA and SWR sense lines. Still doesn't like the PA not drawing current and craps out after like 30 seconds, but it was long enough to test the output from the exciter, it's 13.5 dBm on the Rigol.

Receiver VCO is working, need to modify the image filter and test.

[[Category:Quantar]]

HT1550XLS LCD Repair

2020-12-10T04:03:32Z

N4VX: Created page with "==HT1550 XLS Display Repair== ~Guest post by Jonathan Williams, N4VX Missing vertical and horizontal lines This is..."

==HT1550 XLS Display Repair==
~Guest post by Jonathan Williams, N4VX
[[File:HT1550XLS LCD Missing Lines.jpg|thumb|right|170px|Missing vertical and horizontal lines]]
This is the guide that I followed on repairing a failing LCD Dot Matrix display on my HT1550-XLS UHF R2 radio. These WARIS portable models are highly desirable and are great radios. The custom Samsung made 4 line LCD Dot Matrix used in the HT1550XLS is discontinued and apparently unobtanium. If you can find a NOS or good used one it will cost as much as an entire eBay radio. I took the gamble to attempt to repair it knowing that I could break it very easily. I could learn from the experience and share this info with you!!
 
====Credit====
I followed a guide found online at the link below as the inspiration for this repair. Top shelf tips!
*[[http://p1repair.com/blog/2013/05/30/lcd-repair-missing-lines/ LCD Repair guide - http://p1repair.com/blog/2013/05/30/lcd-repair-missing-lines/]]
 
<big>'''Step 1: Disassembly'''</big>
[[File:HT1550XLS LCD Assembly.jpg|frameless|thumb|right|99px]]
*I won't cover destuffing the radio or getting down to the LCD. You should be able to find several examples of destuffing and disassembly on YouTube to get you to the guts of the radio or device you are working on.
[[File:HT1550XLS LCD PCB.jpg|99px|frameless|thumb|right|HT1550XLS LCD PCB]]
*When you get down to the LCD board itself you have to peel off a protective sheet from the PCB side of the assembly. Then you will have access to the six (6) LED backlight solder points that connect the rear PCB to the glass LCD display itself. Unsolder these 6 connections carefully.
*Once you unsolder the backlight, carefully flip the PCB and glass LCD away from each other using the micro-ribbon flex cable as a hinge. You are now fully disassembled and ready to begin the actual repair procedure.
[[File:HT1550XLS LCD Flex Cable.jpg|99px|frameless|thumb|right|HT1550XLS LCD Flex Cable]]
*According to Ben's article, the failure point is the connection of the flex cable to the PCB, not the flex cable to the LCD (thank goodness..) Let's resolder it!!
 
<big>'''Step 2: LCD flex cable re-soldering'''</big>
*This cable is of a plastic film of some sort. It appears to be able to withstand heat enough to melt solder but will surely have a melt point that causes damage. Finding that sweet temperature spot can be a risky undertaking.
*USE A DRY IRON TIP!!! No flux, no solder.
*I tried using the low (400`F) setting recommended in the guide linked but even using something as thin as a post-it note I was not able to achieve the melt point of the solder used to allow the connections to reestablish.
[[File:HT1550XLS Flex Cable Test Area.jpg|99px|frameless|thumb|right|HT1550XLS Flex Cable Test Area]]
*The outermost 4-5 circuits on the ribbon flex cable were not connected to a trace on the PCB. I used this small unused area of the ribbon flex cable to test heat settings and how much damage a direct contact with the soldering would cause.
*After experimenting with temperature on my Weller iron and found that I could go up to ~480'F and not melt the material that the flex cable is made of in short 2-3 second contact using direct iron contact (no silicone or paper head dispersion layer). This seemed to achieve solder melt but avoid damage to the membrane itself.
*'''EXPERIMENT WITH YOUR HEAT SETTINGS BEFORE YOU COMMIT TO TOUCHING THE CABLE WITH YOUR IRON!!!!'''
*I took the gamble and used the clean, dry 480'F iron in a slow to moderate speed pass across the flex cable spending ~2 seconds over each solder joint. The pass was at the very last 1-2mm of the cable. I noticed very slight distortion of the flex cable membrane indicating heat transfer but no harmful membrane melting was observed. It did appear to melt the underlying solder of the cable connections though.
*I then moved up the cable ~3-4mm and made another pass slowly across the solder interface area noting the same minimal membrane heat distortion.
[[File:HT1550XLS Flex Cable Resoldering.jpg|99px|frameless|thumb|right|HT1550XLS Flex Cable Resoldering]]
*That should be it. Hope it worked.....
 
<big>'''Step 3: Test your repair'''</big>
*I connected all the radio PCB boards back together outside the chassis of the radio and held a battery in place with a rubber band to power up the unit to ensure my repair was successful before reassembling the radio.
[[File:HT1550XLS Repaired LCD.jpg|99px|frameless|thumb|right|HT1550XLS Repaired LCD]]
*<big>'''IT WORKED!!!'''</big>
*I then reassembled the radio and powered it up to a fully functioning LCD display.
[[File:Repaired HT1550XLS Display.jpg|150px|frameless|thumb|left|Repaired HT1550XLS Display]]
 
*'''Thanks Ben at [[http://p1repair.com/blog/2013/05/30/lcd-repair-missing-lines/ P1Repair Blog]] for the instructions on how to undertake this kind of repair!!
'''
 
N4VX - 12/09/20

File:Repaired HT1550XLS Display.jpg

2020-12-10T04:00:16Z

N4VX:

Repaired HT1550XLS Display

File:HT1550XLS Repaired LCD.jpg

2020-12-10T03:58:51Z

N4VX:

HT1550XLS Repaired LCD

File:HT1550XLS Flex Cable Resoldering.jpg

2020-12-10T03:57:32Z

N4VX:

HT1550XLS Flex Cable Resoldering

File:HT1550XLS Flex Cable Test Area.jpg

2020-12-10T03:56:00Z

N4VX:

HT1550XLS Flex Cable Test Area

File:HT1550XLS LCD Flex Cable.jpg

2020-12-10T03:54:37Z

N4VX:

HT1550XLS LCD Flex Cable

File:HT1550XLS LCD PCB.jpg

2020-12-10T03:52:19Z

N4VX:

HT1550XLS LCD PCB

File:HT1550XLS LCD Assembly.jpg

2020-12-10T03:50:52Z

N4VX: User created page with UploadWizard

=={{int:filedesc}}==
{{Information
|description={{en|1=HT1550XLS LCD Assembly}}
|date=2020-12-09 08:07:59
|source={{own}}
|author=[[User:N4VX|N4VX]]
|permission=
|other versions=
}}
{{Location|35.5|-82.5}}

=={{int:license-header}}==
{{self|cc-by-sa-4.0}}

Waris

2020-12-10T03:44:01Z

N4VX: /* HT 1550 */

[[Category:Waris]]
= Waris =

This was originally put together when I got into the HT1250 200 MHz radios. They modified ok, but the way of doing it as suggested left much to be desired, and the DTMF pad didn't work and the radios were narrow band only.

Over time, I've gotten more into these with the CDM1250/1550 and other waris series radios. I've not seen any of the European ones, but I've been working with the US versions for FM service in ham radio.

What I've found is the radios features are determined by the "codeplug" settings. This is simply a packed (hex) data written into the eeprom chip of the radio containing tuning, feature and programing data. This is the same area the programing data from CPS is written in, but CPS is unable to change it. The majority of modification of these radios to amateur service is done with modifications to the codeplug. The codeplug layout appears to be the same for most US versions of the radios, but there are some which are different.

The cool things about these radios is any of the limited ones can be "changed" into the highend, or even more.

'''Every Waris radio can do the following:'''
* 255 personalities only limited by the 16kb of eeprom space. If you load up a bunch of MDC and other crap, CPS will limit adding new channels.
* MDC/QCII/DTMF signaling
* LTR trunking
* Passport (with the right board)
* 4line portables can be flashed to do FPP/edit mode without special battery
* Flexibility of band edges when re-aligned properly
* it is impossible to "brick" a radio. You can fuck it up so it won't boot, but it can be recovered.
* ability to flash the firmware between EU [https://en.wikipedia.org/wiki/Selcall Select 5 calling] and US MDC models (not done too much on this) Even MPT should be possible.
* mobiles will support any control head, even the 4 line display from the GM380/1280.

== Types of Radios ==

=== HT's ===

'''HT750''' - No Display, 4 or 16 channels

'''HT1250''' - One line display, multiple channels up to 128

'''HT1250ls''' - limited version of the HT1250, normally missing MDC on conventional

'''HT1550xls''' - 4 line display radio, 160 channels, VHF/UHF only

'''EX500''' - No display, smaller submersible radio, 16 channels

'''EX560xls''' - one line, smaller submersible radio,

'''EX600''' - one line

'''EX600xls''' - one line, 160 channels

'''CP200''' - no display, 4/16 channels

'''CP200xls''' -

'''PR400''' - VHF 1/VHF 2, UHF 1/UHF 2/UHF 3 - comes in 16, 32 or, 64 channels

==== GP series from EMEA ====
These have EMEA (Latin America/export) versions known as GP

===== GP340 - HT750 =====

Note I got a GP340 in LB2 when I was in Germany. As they use the euro CPS for 5 tone I wanted to get it going as a US version with MDC and newer firmware. The 5 tone HT's all use 512k flash memory, not the 128k of the HT750/1250 (1550 is 512k), and I was able to flash it using the unofficial kit, then put a default codeplug in it. It took me trying a couple default codeplugs to find one that works. After this I flashed it to R05.18.01 using the normal tools.

What might be interesting would being able to convert the LB GP340 to HT1550 as the GP's all have the 512k Flash ram. A default code plug would need to be edited from an HT1550 for low-band. Theoretically this should work, the parts line up.

GP344 - EX500

GP360 - HT1250

GP366 - EX560xls

GP380 - HT1250

GP580 - HT1250 ls?

GP680 - MPT 1250

GP1280 - MPT 1550

== Mobiles ==

=== '''CDM/PRO''' US/CALA/APAC MDC ===

These are the series most people see here in the USA. They will do analog voice and come in many different models determined by the control head.

There is no N head for these.

=== '''GM''' EMEA 5-Tone/MPT1327 ===

These are 5 Tone or MPT radios and come in different models, determined by the control head.

GM140/GM340/GM640 - C control head
GM160/GM360/GM660 - F control head
GM380/GM1280 - N control head (4 line)

=== '''MTM700''' TETRA ===

This is not really a waris radio, but the build is similar. These are tetra models for the EU market.

The 4 line control head on this will work on the Waris radios, but the fixed icons for the LCD are different. It may be possiable to replace the LCD module in this control head with the GM380 control head module (P/N 5164313B02) and get it back. I've found this doesn't really effect function, but the talkaround/scan/etc indicators are way different in the TETRA radio.

=== Control Heads ===

It's possible to put a 4 line control head on a Waris mobile. This can be the control head from the MTM700 as well, but the LCD ICONS will be different.

[[File:GM380 Dispaly.JPG|thumb|GM380 LCD Icons]]
[[File:MTM700 Display.JPG|thumb|MTM700 LCD Icons]]

<gallery mode=packed-hover>
MTM700 LCD.JPG|MTM700 LCD
LCD Module.JPG|LCD Module
LDC Mdoule2.JPG|LCD Module
</gallery>

==== 4 Line Display Use ====

First ensure your display works before going further. If it's the MTM700 LCD or Display module, the Icons will be different, scan will show up as a period on it for example. The keys will be different and the Menu key can be especially confusing.

* Check your codeplug
** is the existing codeplug a Major version 3? Does it have an FDB2 size of 0x09? If not, you'll have to get a binary codeplug and push it into the radio that is
** This is done by selecting a default codeplug that matches your needs closely. I find a code plug that has analog only, no LTR and the options I need. Then I edit this codeplug in a hex editor and past it from 0x280 to the end into the existing codeplug. Using the [https://github.com/W9CR/CPSsrec tools to convert this to an srec file] makes it easy to open in CPS with out needing to write it to a radio.
** once this is working how you like it, program it into the radio using Codeplug tool.
* connect up your control head and enjoy!

Remote mount works with the 4 line head too. I've taken to calling this a CDM1850 :)

<gallery mode=packed-hover widths=300px>
CDM 1850 220 MHz.JPG
CDM 1850 Remote Mount Head.JPG
CDM 1850 Remote Mount Body.JPG
CDM 1850 with GM380 LCD.JPG
Waris CPS with CDM1850 220 Mhz.png
</gallery>

== Option boards ==

Option boards are the keypad in the HT1250, and can be installed in the CDM mobile radios as well.

Known boards are below:
=== AAHLN9725C - Voice Storage Option board ===
=== AAHLN9729C - DTMF decode board ===
=== AAENLN4150A - Mandown board ===

The Mandown Option Board is compatible with all 5-Tone, MPT and MDC/Conv portable radios of
the Professional Radio Series in all bands (except P040/P080 and GP320).

It is also operational with all connected original Motorola accessories for the GP Professional Radios
Series portables.

Installation in any Intrinsically Safe (IS) radios will invalidate the radio’s IS approval (i.e. FM-radios).

[[Media:Mandown Option Board ENLN4150A Study Guide 68P64121B10.pdf|Mandown Option Board ENLN4150A Study Guide 68P64121B10]] Manual

[[Media:WARIS Mandown OSS R01.01.01 2001-01-11.zip|WARIS Mandown OSS R01.01.01 2001-01-11]] Programing Software - Mandown Option Board Service Software

=== Passport board - PTCB ===

The Passport Board was used in both HTs and Mobiles. Most (all?) 200 MHz radios will have them. It can be removed from the mobile and disabled if desired.

<gallery mode=packed-hover>
Passport Board 01.JPG
Passport Board 02.JPG
Passport Board 03.JPG
Passport Board 04.JPG
Passport Board 05.JPG
Passport Board 06.JPG
Passport Board 07.JPG
</gallery>

Removal is simple, just open it and remove it. I save the flex cables as they make great replacements in the HTs
<gallery mode=packed-hover>
CDM Case Screws.JPG | remove and install in order
CDM with Option Board.JPG
CDM With Option Board 02.JPG
CDM With Option Board Case.JPG
</gallery>

==== Software ====

Passport uses it own firmware and CPS to program the PTCB. There is a complex interaction of programing of the option board and the radio it self.

[[Media:PassPort CPS R03.02.00.zip|PassPort CPS R03.02.00]]

[[Media:PassPort CPS R04.00.01.zip|PassPort CPS R04.00.01]]

[[Media:PassPort CPS R04.03.24.zip|PassPort CPS R04.03.24]]

[[Media:PassPort ServicePak R07.02.09.zip|PassPort ServicePak R07.02.09]]

[[Media:PassPort ServicePak R08.02.07.zip|PassPort ServicePak R08.02.07]]

[[Media:PassPort CPS R05.00.14.zip|PassPort CPS R05.00.14]]

[[Media:PassPort R05.02.04.zip|PassPort R05.02.04]]

==== Passport Docs ====

[[Media:PassPort Data Configuration Guide.pdf|PassPort Data Configuration Guide]]

[[Media:PassPort RSSI Charts.pdf|PassPort RSSI Charts]]

[[Media:PassPort Site Search.pdf|PassPort Site Search]]

[[Media:PassPort Software Compatibility.pdf|PassPort Software Compatibility]]

[[Media:THEORY OF OPERATION PASSPORT SITE SEARCH.pdf|THEORY OF OPERATION: PASSPORT SITE SEARCH]]

[[Media:PassPort CPS R03.02.00 Programming Hints.pdf|PassPort CPS R03.02.00 Programming Hints]]

===== Release Notes =====

[[Media:PassPort Firmware R06.02.13 - Release Notes 122002.pdf|PassPort Firmware R06.02.13 - Release Notes 122002]]

[[Media:PassPort Firmware R06.02.14 - Release Notes 042003.pdf|PassPort Firmware R06.02.14 - Release Notes 042003]]

[[Media:PassPort Firmware R06.02.16 Customer Release Notes.pdf|PassPort Firmware R06.02.16 Customer Release Notes]]

[[Media:PassPort Firmware R06.02.16 - Release Notes.pdf|PassPort Firmware R06.02.16 - Release Notes]]

[[Media:PassPort Firmware R07.01.11 - Release Notes 112003.pdf|PassPort Firmware R07.01.11 - Release Notes 112003]]

[[Media:PassPort Firmware R07.01.19 Release Notes.pdf|PassPort Firmware R07.01.19 Release Notes]]

[[Media:PassPort Firmware R07.02.09 Release Notes.pdf|PassPort Firmware R07.02.09 Release Notes]]

[[Media:PassPort Firmware R08.02.05 Release Notes.pdf|PassPort Firmware R08.02.05 Release Notes]]

[[Media:PassPort Firmware R08.02.06 Release Notes.pdf|PassPort Firmware R08.02.06 Release Notes]]

[[Media:PassPort Firmware R08.02.07 Release Notes.pdf|PassPort Firmware R08.02.07 Release Notes]]

[[Media:PassPort Firmware R08.00.17 Release Notes.pdf|PassPort Firmware R08.00.17 Release Notes]]

:: Service pack

[[Media:PassPort Firmware R06.02.13 ServicePak - Release Notes 122002.pdf|PassPort Firmware R06.02.13 ServicePak - Release Notes 122002]]

[[Media:PassPort Firmware R06.02.14 ServicePak - Release Notes 042003.pdf|PassPort Firmware R06.02.14 ServicePak - Release Notes 042003]]

[[Media:PassPort R06.02.16 ServicePak - Release Notes.pdf|PassPort R06.02.16 ServicePak - Release Notes]]

[[Media:PassPort CPS R03.02.00 Customer Release Notes.pdf|PassPort CPS R03.02.00 Customer Release Notes]]

[[Media:PassPort CPS R04.00.00 - Release Notes.pdf|PassPort CPS R04.00.00 - Release Notes]]

[[Media:PassPort CPS R05.00.10 Release Notes.pdf|PassPort CPS R05.00.10 Release Notes]]

[[Media:PassPort CPS R05.00.14 Release Notes.pdf|PassPort CPS R05.00.14 Release Notes]]

=== Unknown Boards ===

There was an API/developers guide a company could license from Motorola. Several companies made add ons for these, but I have very little information on them. I belive this is known as "[https://web.archive.org/web/20130207012507/http://rotronix.co.nz/Prois.aspx Professional Radio Option Interface Specifications]" or PROIS. Rotronix Ltd. was a company known to make a controller for this.

There is a manual "Motorola PROIS v2.03 Manual" which is mentioned in the LC828 manual. A copy of this would be awesome to have. This may have a part number 1202899J28

Here is a picture of one with a DB-9 connector on it. Any information on these would be appreciated.
[[file:Option Interface Board.jpg|center|thumb|Option Interface Board.jpg]]

Rotronix Ltd. made the [https://web.archive.org/web/20130207012544/http://rotronix.co.nz/LC828_radio_module.aspx LC828] which was a special radio based on a PROIS board and a waris radio.

https://web.archive.org/web/20130207012450/http://rotronix.co.nz/Mobile_radio_PROIS_interface.aspx

[[media:LC828 Module radio mods.pdf|LC828 radio mods]] - modification to a HT750/1250 needed to make a LC828

[[media:LC828 interface manual.pdf|LC828 interface manual]] - This has a complete document on the "Motorola Professional Portable Radio Interface Option Board(IOB) Manual". It includes a schematic of the board and parts list as well. This is the same board used in all the interfaces.

[[Media:Computer controlled Radio Interface - CCRI.pdf|Computer controlled Radio Interface - CCRI]] - This is the Manual to the CCRI interface spoken by the Rotronix PROIS board. The mnaul says this is based on the CCRI protocol by [https://www.tlparker.co.nz/ T.L. Parker Ltd].

[https://batboard.batlabs.com/viewtopic.php?t=83543 Here is a comment] posted by the developer of this board on batlabs forum

= Programming and Flash Cables =

The CDM and HT series are programmed using windows based CPS. A rs-232 level converter is needed to talk to the radio, and in the OEM Motorola soultion consists of a Programming Test cable (AARKN4083/AARKN4074), a RIB (level converter) and a test box (RLN4460A/B).

<#gallery of shti>

The HT series program and flash via the 13 pin accessory port. The CDM mobiles program and flash via the back 20 pin accessory port or via the front RJ-50 (10 pin) connector. The font connector presents some issues when programming and flashing a unit with a remote head, and the rear connector should be used for that.

The CDM accessory cable connector is a TE AMP connector, [https://www.digikey.com/product-detail/en/te-connectivity-amp-connectors/104422-2/104422-2-ND/550725 Digi-key part number 104422-2-ND], and uses [https://www.digikey.com/product-detail/en/te-connectivity-amp-connectors/86016-2/A25989-ND/290676 Digi-Key Part number A25989-ND] for the pins.

=== Notes on the RIB based Cables ===

You should not use a RIB to Flash the radio at anything other than 9600 bps. Even then I've run into issues with this setup. Programing works well though.

A very strange issue popped up using the built in serial port on the Dell Latitude D830 with docking station. When using the docking station serial port the radio will "lock-up" and require the cable to be disconnected to be programed.

I've found the Prolific and FTDI serial adapters to work fine with the RIB for flashing/cptool. However the Prolific adapters have an issue in CPS unless they run the right version of the driver, 2.0.2.5.

[[File:Prolific USB-to-Serial Comm Port 2303 VER 2.0.2.5 del 17-04-2006 OK.zip|2.0.2.5 Prolific driver]]

=== Notes on RIB-less Cables ===

RIB-less cables are the preferred way to work with the radio. These can be either serial or USB based. In the USB case it's simply a FTDI or Prolific serial port with a level converter.

I've used the following cables for programming

* [http://www.ebay.com/itm/201399649953 2 in 1 prolific cable for Waris and CDM]
* [https://www.amazon.com/gp/product/B00ED2UMMC Valley Enterprises® 5 in 1 FTDI USB Programming Cable Motorola Mobile and Portables]

Be sure you use the proper drivers if using the prolific cable.

=== Flashing and Flash adapters ===

If you want to flash the radio you need to put it in bootstrap mode. This is done using a flash adapter that puts the CPU (68HC11) into a special mode. The flash program loads a boot loader/flash application via the serial port and then writes the new image to flash chip.

The US Waris unofficial upgrade kit is something that was built by possibly a internal Motorola programmer, or a hack based off the official upgrade kit. Using this tool you can load any of the images on any radio, but you must ensure the image selected is the same size as the flash chip. Note this tool requires all images and default codeplugs as srecord format.

The official upgrade kit includes default codeplugs, firmware images and boot images. These are in an encrypted format, and it appears the unofficial kit has decoded these as the included codeplugs/firmware.

[[File:Waris CDM flash cable.png|thumb|center|Flash adapter for CDM1250 radio]]

= 220 HT1250ls and CDM 1550ls =

This is the same as any other to modify to the amateur service from a software perspective. The issue is these radios are narrow band only on the receive path, as the 200 MHz band was never used for 25 KHz channels. Transmit will support wide band (and must be aligned for wide band first!) The IF filters simply need to be swapped with their wide band parts and wide band receive alignment performed.

== Hardware Mod ==

Their are 3 filters in the radio, 1 at 44.85 MHz 1st IF and 2 at 455khz, 2nd IF.

In a VHF/UHF Waris there is a 15KHz filter at the 1st IF followed by a 15KHz filter at the second IF and then followed by another filter. It's this last filter that is switched between narrow and wide in the VHF/UHF radios. TX deviation is a setting in programming/alignment.

In the 220 version, there 1st IF Filter is the same, but it has a 12KHz and then a 9 KHz filter at the second IF.

I've changed out the second filters and found it works much better on the ham bands. You need to adjust the squelch for 20/25khz channels after doing this. The tuner software (2.00.02) will do this for the HT1250 only, it will not work with the mobiles. Use [[#Utilities|winabler]] to access the greyed out menus in tuner 2.16.

HT1250 Filters:

Function Part Manu P/N Moto P/N Desc
220 front end 44.85MHz FL3201 MXF45 9180022M10 4-pole +-7.5khz bandwidth
IF2 First filter 455KHz FL3204 CFUCJ455F 9180468V04 4-pole 12khz
IF2 filter narrow band filter FL3206 CFWC455G 9180469V03 6-pole 9khz

The UHF handhelds use the same arrangement, but with a wider middle filter (1st @455). In wide band they switch only the 2nd 2nd IF filter to a narrow band filter.

uhf front end 44.85MHz FL301 MXF45 9180022M11
IF2 First filter 455KHz FL302 CFUCJ455E 9180468V05 4-pole *
IF2 filter wide band filter FL303 CFWC455E 9180469V05 6-pole *
IF2 filter narrow band filter FL304 CFWC455G 9180469V03 6-pole

You'll need to order the parts with the * from motorola parts for the 220 radios. The mobile and HT use the same filters.

In the HT the 1st IF is under the shield, and very hard to remove. I've not messed with it, as it appears to be the same part in the UHF, and doesn't look like it's limiting.

Based on the following codes for muratta filters

Muratta filters
E is +- 7.5 (15)
F is +-6 (12)
G is +- 4.5 (9)

The 220 Filters are 12 and 9 Khz wide at the 2nd IF. Switching them to the E filters of the UHF HT1250 is rather easy, as they are just on the underside of the board, not under a shield. An under board heater with a hot air station makes this rather easy.

Ive found an under-board board pre-heater is mandatory to work with this and 630f at 7 l/m of airflow will prevent hurting the board/parts/

I've found the sensitivity to be a bit better and no squelch clipping on 3.2kc tone at 7khz of deviation (Most ham rigs on 220 have WIDE deviation!).

=== Pictures of CDM1550 ===

These show the filter change out on a CDM 1550. Kapton tape is used to protect the adjacent parts as they will reflow and move. An underboard heater is used to bring the board up to 500f (260c) while a hot air wand is used to supply the last bit of heat needed.

<gallery mode=packed-hover heights="200px" widths="200px">
CDM1550 200mhz wideband filters 04.JPG|Old filters for narrowband
CDM1550 200mhz wideband filters 03.JPG|leaded solder prep
CDM1550 200mhz wideband filters 05.JPG|prepped pads
CDM1550 200mhz wideband filters 01.JPG|replaced filters (E)
CDM1550 200mhz wideband filters 02.JPG|replaced filters (E)

</gallery>

== Software mod ==

All this below is not needed. Check out using the [[#UHF 450-527 Ham Band Mod|UHF 450-527 Ham Band Mod]] for using waris.py and chirp.

Using Chirp is the way to do it and you can change everything. I typically set the signaling bits to FF enabling all signaling supported, but some radios may not work with this. Always read the radio and save the data before making changes. The data file format is the same binary on the radio EEPROM and use by cptool.

=== old way ===

This is easiest with [[media:Waris Codeplugtool.zip|CP tool]] and a hex editor.

First upgrade the Firmware using the firmware update. This will load the default codeplug back in the radio.

Read the radio using the CP tool and save the binary codeplug. I typically will read this from 0x0000 to 0x1000 which will capture the entire default codeplug (Tuning, Features, and Programing). Save this file and set is aside for safe keeping. If anything goes wrong, you can blow it back into the radio and restore it to defaults with out needing to retune.

If you want to use the pre-made [[#Binary_Codeplugs|binary codeplugs]], if one exists, rather than edit your own you can go right to [[#Writing the Modified Codeplug|Writing the Modified Codeplug]] below.

==== Editing the Codeplug ====

Now open up a copy of this code plug and edit it based on the Codeplug Map for the feature blocks. This is from 0x280 to 0x2ff.

You'll need to change the following parts:

# Serial number, ASCII spaces are blank (optional)
# Channel step needs to be 0x01
# Upper Frequency: 0x5F50 for 225 MHz
# Signaling: 0xFF is everything enabled (MDC, QCII, DTMF) for trunking and conventional
# Conventional Personalities: 0xFF for 255 channels

Once this is done, be sure the checksum 8 on both FDB blocks are 5A. You will need to adjust the checksum bytes for this.

==== Writing the Modified Codeplug ====

Open this file with the CP tool and put 0x280 to 0x2ff into the radio, no need to write the entire file. This makes it easy to do many units at once, just blow the Feature Block in, while leaving the tuning and programing alone.

[[File:Codeplug tool with a fdb ready to be written to a HT1250.png|center|thumb|200px|Codeplug tool with a fdb ready to be written to a HT1250]]

=== Tune the radio ===

You'll need to now tune the 20 and 25 KHz squelch settings in the tuner software. The issue here is the tuner software will not let you select the 20 and 25 KHz from the drop down menu. Using Winabler this can capture the tuner menu and enable these.

<gallery heights=200px widths=200px mode="packed" >
Tuner showing disabled 20-25 khz.png||Tuner showing disabled 20-25 khz
Tuner with Winabler and showing 25 KHz Tuning.png|Tuner with Winabler and showing 25 KHz Tuning
</gallery>

I use the auto squelch setup and found a good value is -127.5 dBm for hams. My radio is -124 dBm for 12db SINAD so this is about 6 dB SINAD at -128, very noisy but understandable. Auto tune makes this really easy. You can always program a button to set the squelch to tight in CPS.

I've found I needed to play with the RSSI settings too, as the S meter was setup for commercial strong signal service. I've only seen this with certian 220 radios.

It's also a good idea to check the frequency/modulation/power out alignments too. The CDM1550's from the New Jersey Turnpike all were aligned wrong for the power output, and we 20W out when set for 30W. Align it in tuner properly, and then use CPS to lower the power if you want.

If you've set the serial number to blank, it's a good time to set it to what you want in tuner before you disconnect.

Once you're done with all this, you should have a great radio that covers 216-225 MHz, wide band FM, MDC/QCII/DTMF, 30W power out, and damn sensitive squelch.

= UHF 450-527 Ham Band Mod =

The basic issue with modifying these radios to cover down to 440 by only adjusting the [[#High Frequency|High]] & [[#Low Frequency|Low] Frequency settings in the feature region of the codeplug is the tuning for deviation/squelch/signaling/etc. is setup on 7 frequencies. When the radio tunes between two of these frequencies the value is interpolated based on the curve of the tuning values. For example deviation response will vary from 450 to 520 MHz, the same voltage at 450 will be an unacceptable amount of deviation at 520.

As the frequency "piers" only go down to 450 MHz, the radio has nothing to interpolate with if it's programed 440.450 MHz. This causes this interpolate calibration code to fail and deviation and other calibrations are all over the place. Luckily this is a rather easy fix.

[https://www.youtube.com/watch?v=aJWndL4dAB4 Video of how to do the hex editing] of the code plug from a HT1250ls 450-527.

There is a new way to do this using [http://chirp.danplanet.com/projects/chirp/wiki/Home chirp] and the plugin below:

http://wiki.w9cr.net/index.php/Waris#Unofficial_software

[https://www.youtube.com/watch?v=QKpG_1buX5g video explaining the new way using chirp]

== Preselector Tuning ==

Using this procedure on a number of EX600xls radios has worked well, but some don't seam to work down at 440 on receive. I've found this to be due to the preselector alignment. Once this is re-aligned on the new frequencies in global tuner, the radios receive properly.

Since you have to load global tuner up anyways, it's worth checking the refference frequency oscillator warp. While not off much, the batch I've seen have been off 600-1000 Hz.

= CDM Low Band Range 3 to 46-54 MHz =

N9IAA has reported much success moving the CDM's to cover 46-54 MHz (from 42-50 MHz) after modifying the programing using chip and changing the following parts in yellow on [https://docs.google.com/spreadsheets/d/1vWFhZXn8z1iWo6HxrNn8Le5SOv-1GtE4imuL8RZ9O00/edit?usp=sharing this spreadsheet]. A complete retuning is necessary of course.

= HT 1550 =
The HT1550 was the high end portable at the time, they can do 160 channels (of course modifiable to 255), but were VHF/UHF only.

==Dot Matrix LCD Repair==
[[File:HT1550XLS LCD Missing Lines.jpg|99px|frameless|thumb|left|HT1550XLS LCD Missing Lines]]
Have missing lines on your HT1550 Dot Matrix LCD? Try this to bring your pixels back to life.
*[[HT1550XLS LCD Repair]]
It's a risky repair but can salvage an otherwise junk LCD.

== Edit mode (FPP) ==

The Front Pad Programming (Edit Mode/FPP) was an option on the 1550, but required a special government only battery. Recently I was able to work on the firmware and jump over this check. The crux of this is you cannot upgrade firmware without losing this, but as R05.18.01 is the last firmware made for the 4 line models, this shouldn't be an issue. You will need to use the US Waris Firmware Flashtool from the unofficial lab kit and the firmware image below.

* First upgrade your radio using the official four line kit.
* Use the US Waris Firmware Flashtool and flash the [[media:R05.18.01 Four Line HT1550 with FPP.0|R05.18.01 Four Line HT1550 with FPP.0]] firmware

Ensure you have edit mode enabled on the personality and enjoy editing without using the special battery.

= Code Plug Map =
This is based on the Srecord file loaded as binary

0x000 - 0x27f group, 5A checksum. 0x27f is the checksum byte
This group contains the tuning information for the radios.
The frequencies it's aligned on are in the same format as the band limits.
There are 3 groups of frequencies in here, not sure what they all do, but can confirm
changing them all moved the tuning frequencies on a 6 meter CDM.

0x282 - 0x2D7 - group, needs to be 5A checksum, adjust 0x2D7 to make it.
0x285-0x28E - Serial number
0x291-0x2A0 - Model number, Blank should be spaces 0x20

0x2AC Channel steps
*0x01 - 12.5, 20 and 25 KHz
*0x05 - 12.5 only

0x2AF Lower Frequency Limit
0x2B1 Upper frequency limit
Desired limit - Base freq (200mhz models the base freq is 103mhz) times 1000 then
divided by 5. this gives you the new value in dec, you have to change it to hex
216 MHz is 5848
225 MHZ is 5F50
58485F50 across both bytes

Below is only valid for the 3.08 codeplug tool codeplugs
0x2D8 to 0x2E9 - group, needs to be 5A checksum, adjust 0x2E9 to make it.

0x2E2 - Number of personalities is at in hex.
*128 - 0x80
*160 - 0xA0
*255 - 0xFF

Below is only valid for the 2.08 codeplug tool codeplugs
0x2D8 to 0x2E4 - group, needs to be 5A checksum, adjust 0x2E4 to make it.

0x2E2 - Number of personalities is at in hex.
*128 - 0x80
*160 - 0xA0
*255 - 0xFF

The 8 bit checksum must be 0x5A for this bit of code. Byte 0x2E9 is the checksum fix bit. Find the difference after editing between the checksum and 0x5A, then add or subtract this from the value in offset 0x2E9.

== passwords ==
The CPS password is stored in plain text in the codeplug, while the radio lock password is a bit more involved.

My notes are based on a ht1250, so it might be a bit different.

Use the code plug tool to dump the radio to at least 0x400.

Open the resulting binary file in a hex editor and look at or around 0x33e to
0x345 (7 bytes). This is the CPS password. Read the radio with CPS and use
this password to recover it.

The radio lock password is a bit trickier, it's at 0x3a4 and is 2 bytes. It's
the 0000-9999 numeric password added with 0x4000.

== Tuning and FDB Codeplug Map ==

{| class="wikitable" style="margin: 0 auto; text-align: center;"
|+ Waris Tuning and FDB CP Map
|-
! style="width:6.0%;"| Byte Offset
! style="width:2.6%;"| 0
! style="width:2.6%;"| 1
! style="width:2.6%;"| 2
! style="width:2.6%;"| 3
! style="width:2.6%;"| 4
! style="width:2.6%;"| 5
! style="width:2.6%;"| 6
! style="width:2.6%;"| 7
! style="width:2.6%;"| 8
! style="width:2.6%;"| 9
! style="width:2.6%;"| A
! style="width:2.6%;"| B
! style="width:2.6%;"| C
! style="width:2.6%;"| D
! style="width:2.6%;"| E
! style="width:2.6%;"| F
|-
! 0x000000
| colspan="2"|[[#Tuning length|Tuning len]]
| style="background: lightpink;" colspan="14"|Tuning Data
|-
! 0x000010
| style="background: lightpink;" colspan="16"|Tuning Data Cont.
|-
! style="background: lightgreen;" | SKIP
| style="background: lightgreen;" colspan="16"|SKIP
|-
! 0x000270
| style="background: lightpink;" colspan="15"|Tuning Data Cont.
| style="background: orange;" colspan="1"|[[#Tuning Checksum|Checksum]]
|-
! 0x000280
| colspan="2"|[[#Feature Length|Feature len]]
| colspan="3"|[[#Block Header|FDB 1 Header]]
| colspan="10"|[[#Serial Number|Serial Number]]
| colspan="1"|[[Null]]
|-
! 0x000290
| colspan="1"|[[Null]]
| colspan="15" |[[#Model Number|Model Number]]
|-
! 0x0002A0
| colspan="1" |[[#Model Num|Mod Cont.]]
| colspan="2"|[[Null]]
| colspan="2"|[[#Codeplug Version|CP version]]
| colspan="1"|[[#Programing Source|CP Source]]
| colspan="6"|[[#Programing Date|CP Date]]
| colspan="1" |[[#Channel Step|Chan Step]]
| colspan="2"|[[#Base Frequency|Base Freq]]
| colspan="1" |[[#Low Frequency|Low Frequency]]
|-
! 0x0002b0
| colspan="1" |[[#Low Frequency|Low Freq Cont.]]
| colspan="2"|[[#High Frequency|High Frequency]]
| colspan="13"|[[#CP Part Number|CP Part Number]]
|-
! 0x0002c0
| colspan="3" |[[#CP Part Number|CP P/N Cont.]]
| colspan="1"|Unknown
| colspan="1"|[[Null Pad]]
| colspan="10"|[[#TANAPA|TANAPA]]
| colspan="1"|[[#Power|LPWR]]
|-
! 0x0002d0
| colspan="1"|[[#Power|HPWR]]
| colspan="5" |Unknown
| colspan="1"|[[#Region|Region]]
| style="background: orange;" colspan="1"|Checksum
| colspan="3"|[[#block header|FDB 2 Header]]
| colspan="1"|[[#Trunk Personalities|Trunk Pers]]
| colspan="1"|[[#Signaling|Signaling]]
| colspan="1"|[[#0x2DD - CHD|CHD]]
| colspan="1"|[[#0x2DE|M/H]]
| colspan="1" |Unknown
|-
! 0x0002e0
| colspan="1" |[[#0x2E0|Unknown]]
| colspan="1" |[[#0x2E1 - FPP|FPP]]
| colspan="1"|[[#Conventional Personalities|Conv Pers]]
| colspan="1" |[[#0x2E3|Unknown]]
| style="background: orange;" colspan="1"|Checksum 9
|-
! 0x0002f0
| colspan="15" |Unused
| style="background: orange;" colspan="1"|FDB Checksum
|}

=== Tuning length ===

These two bytes are the length of the tuning block. Typically 0x0280

=== Tuning Checksum ===

This is a byte which is modified to make the Checksum(8) of the tuning block 0x5A

=== Feature Length ===

These two bytes are the length of the feature block. Typically 0x0080

=== Block Header ===

This is the block header for the FDB. This is a recurring format for storing data throughout the codeplug

In this case it's typically 0x805201

This is a magic number of 0x80 a length of 52 and a repeat of the length of 01.

In this case it would start at 0x285 and go to 0x2D7 (the checksum correction byte). Note the 3 bytes of the Block Header are not counted, but are included in the checksum calculation.

=== Serial Number ===

These are 10 bytes of the serial number. You can make it whatever you want or keep it blank with spaces (0x20) to allow you to set it in tuner.

=== Model Number ===

These 16 bytes are the model number. This must match exactly if you want to use the CPS to program the same CP into multiple radios (along with the other FDB blocks).

=== Codeplug Version ===

The version of the Code plug 2 bytes, Major.Minor in BCD format

Note that this determines the length of block for FDB2 as follows. If this is not set correctly, it will not work.
This also has effected the N control head,

FB2 Size Major Version
9 1,2,3,5
A 5,7 (5 is only on conv_pmor_16ch and 7 on the Mobile 50 units)
E 4,11 ( and no minor versions, all are 0)
10 9 (9.2 Only handheld 65 and 50 units)

This also has effected the N control head on a 220 radio. I was unable to get the N head to work at all with a FDB 2 length of 14 and a version of 11. the version needed to be changed to 3.2 and FDB2 to a 9 long one. It would then work.

=== Programing Source ===

1 Byte that shows the source of original programing

* 0x0 - Factory
* 0x1 - Depot
* 0x2 - CPS

=== Programing Date ===

6 bytes showing the original programing date BCD format

Example = 0x1984 06 25 2344

* 2 bytes year - 1984
* 1 byte month - 06
* 1 byte day - 25
* 1 byte hours - 23
* 1 byte minutes - 44

=== Channel Step ===

1 byte giving the channel step

* 0x0 - UNKNOWN - only used on VHF Low Band
* 0x1 - 12.5/20/25 KHz - Used on VHF only
* 0x2 - UNKNOWN - used on UHF R1, R2 only
* 0x3 - UNKNOWN - used on 800 MHz Only
* 0x5 - 12.5 KHz only - used on 200 MHz only
* 0x6 - UNKNOWN - Used on 700 MHz Only

=== Base Frequency ===
2 Bytes

Base frequency in hex expressed as the following formula:

Value * 25000 = Base Frequency in MHz

* 0x320 - 800d - 20 MHz - VHF Low Band
* 0x1080 - 4120d - 103 MHZ - VHF and 200 MHz
* 0x32C8 - 13000d - 325 MHz - 330 MHz
* 0x3A98 - 15000d - 375 MHz - UHF R1/R2
* 0x6D88 - 28040d - 701 MHz - 700 MHz
* 0x7D28 - 32040d - 801 MHz - 800 MHz

=== Low Frequency ===

2 bytes - Low Frequency of tuning

Value = (Low Frequency in MHz - Base Frequency in MHz) * 1000 / 5

Example Low at 200 MHz - 0x5848 = 22,600d

22,600/200 = 116 MHz + 103 base = 216 MHz

=== High Frequency ===
2 bytes - High Frequency of tuning

Calculated same as Low Frequency

=== Code Plug Part Number ===

16 Bytes of the code plug part number
No idea what it's used for

=== TANAPA ===
16 bytes
The TANAPA is a configuration code of the hardware in the radio. Model numbers can vary but the TANAPA can be close or the same. Not sure what TANAPA stands for.

=== Power ===
Mobile Power Settings
0x2CF and 0x2D0 are low and high power settings. These are the fixed settings in the radio, not what you can adjust them to in CPS.

All HT's have this set to 0 in both. HT's don't have an info screen in CPS showing the power, that tab is not there for HT's

The setting is not linear. Below is what I've found in the default code plugs. Note the series here is the CDM (25) or the CM (50). Tested means it's not a number that appears in the default codeplugs, but what I got. Power is in watts displayed in the CPS info screen. I don't have this for all the values here.

Hex Power Default Series
16 1 25 Series
19 50 Series
2D 3 Tested
3D 25 Series
6A 25 Series
70 20 25 Series
7B 50 Series
7D 50 Series
7F 26 Tested
84 50 Series
89 30 25 Series
8D 66 25 Series
A6 50 Series
AD 48 25 Series
B1 50 Series
B8 25 Series
D4 72 25 Series
E4 83 Tested
F4 95 Tested
FF 104 Tested

=== Region ===
1 byte
This is the Region code.

* 0xFF is the default used in the unofficial codeplugs.
* 0x00 Super TANAPA ?
* 0x01 - US

=== 0x2DD - CHD ===
Control head. Not sure if this is bits active or the entire byte.

Known Control head options across all waris radios:
A, C, D, F, G, H, J, K, N

'''HT'''
C - No Display, PR860/HT750/GP140/320/330/240/340/540/640
D - Keypad
F - 1 Line Display, Limited Keypad GP360 HT1250
G - In H25 only
H - 1 Line display, Full Keypad, HT1250/GP280/380/580/680
J - in H65 only - 16chan only, no or limited keypad, conv_pmor_16ch_pnk/plk
K - in H65 Only - 16chan only, full keypad conv_pmor_16ch_pfk
N - 4 Line Display, HT1550/GP1280

'''Mobile'''
A - No Display, No Keypad - Databox
C - No Display, Basic Keypad CDM750/GM140/340/640
D - 1 Line Display, Limited Keypad CDM1250
F - One Line Display, Standard Keypad, CDM1550/GM160/360/660
N - GM380/1280

Please read the notes under the codeplug version information regarding this.

==== Byte value vs CHD ====
0 - C, Mobile, 25
10 - C, H/M, 25, 34, 38, 45, 50
11 - D, M, 25
20 - D, H, 34
21 - F & H, 25, 34, 38, display H is only onHT's, but F is on mobile and HT's
30 - C K & J, 65 series HT only
31 - F & H, 34 series HT only
32 - N, 25 series only, HT and Mobile
33 - F & H, 50 & 65 Series, Mobile and HT for 65, Mobile only for 50
40 - A, 25 series only, Mobile only

=== 0x2DE ===

Looks to be a bit mask. Changing from 0xA1 to 0x81 (toggle bit 5) changed an HT to a mobile. On the mobile, squelch adjustment went away, along with radio password.
The buttons changed to be Mobile config.

=== Bit 5 on makes a mobile ===
'''changes in radio configuration'''
* Auto power mode and radio-radio cloning, and hook defeats pl was lost.
* Auto backlight and Tx Low battery LED were removed. Mobile backlight intensity was added.
* TX low battery alert an wrap-around were lost.
* Gained revert scan and hook
* monitor sticky permanent alert was removed
* control head mic was gained
* default display stayed the same (this was a 4 line radio)
* Lost radio lock password
* TX Power, aux control, accessory pins and accessory config tabs gained.

''' controls and menus'''
* conventional buttons changed to mobile
* Utilities menu lost squelch, light disable, when available and radio lock.

'''conventional personality '''
* advanced tab gained tx only personality
* new tab "data revert"

''' MDC '''
* mdc system config gained remote monitor tab

=== 2E0:1 ===
Not sure what this does, but I encountered a UHF R1 HT model H25RDH9DP5, that was 0xCC78 and it would not load the codeplug from a H25RDH9DP9 HT with everything in the FDB being the same other than the source CP was 0xCE79.

I tried changing each byte independently and CPS still would not allow the CP to be written to the HT. Only with both flipped to the proper 0xCE79 of the source radio would CPS write the unit.

Any more information would be helpful

=== 0x2E0 ===
Unknown, but appears to have something to do with features on a bitmask basis
changed from 0xFF to 0xCF and lost remote monitor option in the radio call sub menu.

=== 0x2E1 - FPP ===
This has more features on a bit mask basis.

'''Lower nibble known options'''
Bit 3 is FPP, unsure about the other bits.
5 - 0101 - FPP
D - 1101 - FPP
B - 1011 - No FPP
9 - 1001 - no FPP
8 - 1000 - No FPP
4 - 0100 - No FPP ? - maybe a fluke? - only on 65 and 50 series radios have this bit set.
1 - 0001 - No FPP
0 - 0000 - No FPP

Note that enabling FPP is possible in the mobile and HT1250 (even 750) radios. It will show up in the CPS, allow you to add it to the menu and everything, but it won't work. Edit mode also needs to be enabled on that channel and you need the red battery or hacked firmware. If anyone has Ideas for the CDM, let me know.

=== 0x2E3 ===
Unsure what this is, but when opening an srecord and saving it again, CPS changed this from from 0x30 to 0x10 (and low power from 0x16 to 0x19).

== [[Waris_Programing_Block|Programing block]] ==

This now has it's own page

The programing block is the next block after the tuning and FDB blocks, typically starting at 0x300.

= Flashing =

The radio is basically impossible to brick, but the Motorola upgrade tools are notorious for fucking up and leaving you with a dead radio. What's worse, is the official Motorola upgrader has no way to restart a failed upgrade. The Motorola tool must be able to read the code plug first, if it can't, it won't upgrade it. Motorola did this to prevent you from flashing radios to different models (MDC to 5 tone, etc), and the official tool installs a new default codeplug, they wanted to keep you from doing all the fun stuff we can now do in the feature database, by flashing a different default code plug on it.

== Why can't I brick the radio? ==

Easy, the uP they use, a 68hc11, has a boot strap mode. What the CPU looks for at this point in bootstrap mode, is serial data loaded via [https://en.wikipedia.org/wiki/XMODEM XMODEM]. In this 256 bytes of data, you load a program that can get the cpu going. Motorola loads the initial xmodem helper in bootstrap mode, then it loads a flash helper which is larger. This flash helper will write the flash chip on the radio. This is not a "bootloader" or anything like that, it's built into the CPU, and is well documented in the CPU datasheet.

Also side note, the cpu once programmed doesn't have a checksum on the firmware. The flash is memory mapped, and at boot the radio goes to 0xFFFE, reads 2 bytes as a pointer, then jumps there and starts running code. It's simple, but there's no checksum, so you can edit anything in there and not need to run a checksum.

=== Well I was fucking in the codeplug and wrote bytes it does not understand ===

This can get the radio stuck in a boot loop, or look similar to the firmware being corrupted.

No fear, just short out the SPI lines on the serial codeplug chip and boot it, then you should get "EEPROM CS ERROR" and can reprogram the backup codeplug (you did make a backup, right :)

== Recovering a flash dead radio ==

Assuming your radio is truly flash dead, you'll need to reprogram this using the US waris kit. This will allow you to load any firmware on any radio. Simply select the right firmware file and flash it.

Note if using a real Motorola rib, don't go faster than 9600 BPS (20-30 min at this speed is normal)

Once the firmware is loaded, the radio may bitch with CS ERROR or something. This is good, it means you have a working OS on the radio, and you need to load the codeplug now that matches the radio.

=== Firmware files ===

These are text files of the binary firmware in [https://en.wikipedia.org/wiki/SREC_(file_format) S-record] format. The only difference is the header must be removed. The file name must be *.0 as well, and it cannot be loaded via a network filesystem path.

= Software & Docs =

== Docs ==

[[Media:HT1250LS+ 220 700MHz Service Manual.PDF|220 700MHz Service Manual.PDF]]

[[Media:Basic Service Manual HT1250•LS+ 200 MHz 700 MHz 6864110R15-O.pdf|Basic Service Manual HT1250•LS+ 200 MHz 700 MHz 6864110R15-O]]

[[Media:Detailed Service Manual HT1250•LS+ 200 MHz 700 MHz 6864110R12-O.pdf|Detailed Service Manual HT1250•LS+ 200 MHz 700 MHz 6864110R12-O]]

[[Media:CDM1550 200-700 Mhz detailed service manual.pdf|CDM1550 200-700 Mhz detailed service manual]]

[[Media:6881088C46 Motorola HT MTX PRO Detailed Service Manual.pdf|6881088C46 Motorola HT/MTX/PRO Detailed Service Manual]]

[[Media:68P80906Z54-D Motorola HT MTX PRO Basic Service Manual.pdf|68P80906Z54-D Motorola HT/MTX/PRO Basic Service Manual]]

[[Media:6866577D06-A Motorola GP Professional Basic Service Manual.pdf|thumb|6866577D06-A Motorola GP Professional Basic Service Manual]]

[[Media:6866558D04-O Motorola professional GP series including 300R1 Detailed Service Manual.pdf|6866558D04-O Motorola professional GP series including 300R1 Detailed Service Manual]] -- Note this has shit formatting from some gay ass manual site that fucked up the page sizes. Unless you need 300 MHz stuff, use the one below.

[[Media:6866558D03-P Motorola GP Series Detailed Service Manual - Proper Paper Size.pdf|6866558D03-P Motorola GP Series Detailed Service Manual - Proper Paper Size]] Use this one unless you need 300 MHz

[[media:RLN4780 4 line remote mount kit with speaker manual.pdf|RLN4780 4 line remote mount kit with speaker manual]] - This is the remote mount 4 page manual for the GM380/1280 and MTM700

[[Media:Product Comparison Analog Portables.pdf|Product Comparison Analog Portables]]

[[Media:HT1250ls Radio User Guide 6881088C42-G.pdf|HT1250ls Radio User Guide 6881088C42-G]]

[[Media:Final Reflashing Instructions Portable Only-5-29-02.pdf|Final Reflashing Instructions Portable Only-5-29-02]]

==== CP125/CP150/CP200 ====

[[Media:CP125 Portable Two-Way Radio User Guide 6881098C60-O.pdf|CP125 Portable Two-Way Radio User Guide 6881098C60-O]]

[[Media:CP125 Service Manual 6881096C38-B.pdf|CP125 Service Manual 6881096C38-B]]

[[Media:CP150 CP200 Commercial Series Two-Way Radio User Guide 6880309N60.pdf|CP150 CP200 Commercial Series Two-Way Radio User Guide 6880309N60]]

[[Media:CP150 CP200 Commercial Series Two-Way Radio User Guide 6880309N60-A.pdf|CP150 CP200 Commercial Series Two-Way Radio User Guide 6880309N60-A]]

[[Media:CP150 CP200 Basic Service Manual 6880309N61-B.pdf|CP150 CP200 Basic Service Manual 6880309N61-B]]

[[Media:CP150 CP200 Detailed Service Manual 6880309N62-C.pdf|CP150 CP200 Detailed Service Manual 6880309N62-C]]

[[Media:CP150 CP200 Detailed Service Manual 6880309N62-D.pdf|CP150 CP200 Detailed Service Manual 6880309N62-D]]

[[Media:CP200XLS Basic Service Manual 68009328001-A.pdf|CP200XLS Basic Service Manual 68009328001-A]]

[[Media:CP185 Basic Service Manual 68007024004-D.pdf|CP185 Basic Service Manual 68007024004-D]]

[[Media:PR860 User Guide 6881098C02-P.pdf|PR860 User Guide 6881098C02-P]]

[[Media:PR860 Basic Service Manual 6881098C42-P.pdf|PR860 Basic Service Manual 6881098C42-P]]

[[Media:PR860 Detailed Service Manual 6881098C43-P.pdf|PR860 Detailed Service Manual 6881098C43-P]]

==== Expert Series (EX600) ====

[[Media:EX500 Users Guide 6881093C98-C.pdf|EX500 Users Guide 6881093C98-C]]

[[Media:EX600 User Guide 68P81094C70-O.pdf|EX600 User Guide 68P81094C70-O]]

[[Media:EX600•XLS Expert Series Two-Way Radio User Guide 68P81095C10-O.pdf|EX600•XLS Expert Series Two-Way Radio User Guide 68P81095C10-O]]

[[Media:EX500 EX600 EX600•XLS Expert Series Two-Way Radio Basic Service Manual 68P81094C00-B.pdf|EX500 EX600 EX600•XLS Expert Series Two-Way Radio Basic Service Manual 68P81094C00-B]]

[[Media:EX500 EX600 EX560XLS EX600XLS Basic Service Manual 6881094C00-C.pdf|EX500 EX600 EX560XLS EX600XLS Basic Service Manual 6881094C00-C]]

[[Media:Elite Series Detailed Service Manual 6881094C21-A.pdf|Elite Series Detailed Service Manual 6881094C21-A]]

[[Media:MANUAL REVISION FMR-2027-1 EX500 EX600 EX600•XLS Detailed Service Manual 6881094C21-A.pdf|MANUAL REVISION FMR-2027-1 EX500/EX600/EX600•XLS Detailed Service Manual 6881094C21-A]]

[[Media:PRO Series Elite Detailed Service Manual 6881094C21-B.pdf|PRO Series Elite Detailed Service Manual 6881094C21-B]]

=== Release Notes ===

==== Professional CPS ====

[[Media:ProSeries CPS R06.11.05 Notes.pdf|ProSeries CPS R06.11.05 Notes]]

[[Media:ProSeries CPS R06.11.07 Notes.pdf|ProSeries CPS R06.11.07 Notes]]

[[Media:ProSeries CPS R06.11.10 Notes.pdf|ProSeries CPS R06.11.10 Notes]]

[[Media:ProSeries CPS R06.12.02 Notes v4.pdf|ProSeries CPS R06.12.02 Notes v4]]

[[Media:ProSeries CPS R06.12.04 Notes.pdf|ProSeries CPS R06.12.04 Notes]]

[[Media:ProSeries CPS R06.12.05 Notes.pdf|ProSeries CPS R06.12.05 Notes]]

[[Media:ProSeries CPS R06.12.08 Release Notes.pdf|ProSeries CPS R06.12.08 Release Notes]]

[[Media:ProSeries CPS R06.12.09 Notes.pdf|ProSeries CPS R06.12.09 Notes]]

==== Professional Mobile Firmware ====

[[Media:ProSeries Mobile R05.05.17 Notes.pdf|ProSeries Mobile R05.05.17 Notes]]

[[Media:ProSeries Mobile R05.05.19 Notes.pdf|ProSeries Mobile R05.05.19 Notes]]

[[Media:ProSeries Mobile R05.08.01 Notes.pdf|ProSeries Mobile R05.08.01 Notes]]

[[Media:ProSeries Mobile R05.08.05 Notes.pdf|ProSeries Mobile R05.08.05 Notes]]

[[Media:Professional Series Mobile R05.08.05 Notes.pdf|Professional Series Mobile R05.08.05 Notes]]

[[Media:ProSeries Mobile R05.09.01 Notes.pdf|ProSeries Mobile R05.09.01 Notes]]

[[Media:ProSeries Mobile R05.10.01 Notes v.4.pdf|ProSeries Mobile R05.10.01 Notes v.4]]

[[Media:ProSeries Mobile R05.10.02 Notes.pdf|ProSeries Mobile R05.10.02 Notes]]

[[Media:ProSeries Mobile R05.10.03 Notes.pdf|ProSeries Mobile R05.10.03 Notes]]

[[Media:ProSeries Mobile R05.10.04 Notes.pdf|ProSeries Mobile R05.10.04 Notes]]

==== Professional Portable Non-4 Line Display Firmware ====

[[Media:ProSeries Portable R05.09.11 Notes.pdf|ProSeries Portable R05.09.11 Notes]]

[[Media:ProSeries Portable R05.10.05 non4line Notes.pdf|ProSeries Portable R05.10.05 non4line Notes]]

[[Media:ProSeries Portable R05.13.09 non4line Notes.pdf|ProSeries Portable R05.13.09 non4line Notes]]

[[Media:ProSeries Portable R05.14.03 non4line Notes.pdf|ProSeries Portable R05.14.03 non4line Notes]]

[[Media:ProSeries Portable R05.17.01 non4line Notes v4.pdf|ProSeries Portable R05.17.01 non4line Notes v4]]

[[Media:ProSeries Portable R05.17.02 non4line Notes.pdf|ProSeries Portable R05.17.02 non4line Notes]]

[[Media:ProSeries Portable R05.18.00 non4line Notes.pdf|ProSeries Portable R05.18.00 non4line Notes]]

[[Media:ProSeries Portable R05.18.01 non4line Notes.pdf|ProSeries Portable R05.18.01 non4line Notes]]

==== Professional Portable 4 Line Display Firmware ====

[[Media:ProSeries Portable R05.10.05 4line Notes.pdf|ProSeries Portable R05.10.05 4line Notes]]

[[Media:ProSeries Portable R05.13.09 4line Notes.pdf|ProSeries Portable R05.13.09 4line Notes]]

[[Media:ProSeries Portable R05.14.03 4line Notes.pdf|ProSeries Portable R05.14.03 4line Notes]]

[[Media:ProSeries Portable R05.16.01 4line Notes.pdf|ProSeries Portable R05.16.01 4line Notes]]

[[Media:ProSeries Portable R05.17.01 4line Notes v4.pdf|ProSeries Portable R05.17.01 4line Notes v4]]

[[Media:ProSeries Portable R05.17.02 4line Notes.pdf|ProSeries Portable R05.17.02 4line Notes]]

[[Media:ProSeries Portable R05.18.00 4line Notes.pdf|ProSeries Portable R05.18.00 4line Notes]]

[[Media:ProSeries Portable R05.18.01 4line Notes.pdf|ProSeries Portable R05.18.01 4line Notes]]

==== MTX CPS ====

[[Media:PrivacyPlus Portable R01.03.73 Release Notes.pdf|PrivacyPlus Portable R01.03.73 Release Notes]]

[[Media:PrivacyPlus Portable R01.04.01 Release Notes.pdf|PrivacyPlus Portable R01.04.01 Release Notes]]

[[Media:PrivacyPlus Portable R01.04.03 Release Notes.pdf|PrivacyPlus Portable R01.04.03 Release Notes]]

[[Media:PrivacyPlus CPS R02.00.02 Release Notes.pdf|PrivacyPlus CPS R02.00.02 Release Notes]]

[[Media:PrivacyPlus CPS R02.01.03 Release Notes.pdf|PrivacyPlus CPS R02.01.03 Release Notes]]

[[Media:PrivacyPlus CPS R02.03.00 Release Notes.pdf|PrivacyPlus CPS R02.03.00 Release Notes]]

== CPS ==

[[Media:Professional CPS R.06.12.09 AA.zip|Professional CPS R.06.12.09 AA.zip]] - Latest CPS Release as of 12/14/2016

[[Media:Global Tuner R 02.18.00.zip|Global Tuner R 02.18.00.zip]] - Latest Tuner Release as of 12/14/2016

[[Media:HVN9025 v6.12.05.zip|Waris CPS 6.12.05]] Waris CPS 6.12.05

[[Media:R02.02.00 Waris Tuner.zip|Waris Tuner 2.02]] Waris Tuner 2.02

[[Media:PrivacyPlus Portable CPS R01.04.03.exe|PrivacyPlus Portable CPS R01.04.03]] - for the MTX150, MTX1500, MTX450, MTX4500, MTX850, MTX8250, MTX950, MTX9250

[[Media:PrivacyPlus CPS R02.03.00.zip|PrivacyPlus CPS R02.03.00]] - for the MTX150, MTX1500, MTX450, MTX4500, MTX850, MTX8250, MTX950, MTX9250

::'''These are for the EU Waris radios'''

[[Media:Professional GP300 GM300 Series CPS R03.11.16 ENVN400Z.zip|Professional GP300/GM300 Series CPS R03.11.16 ENVN400Z]]

[[Media:MPT CPS R00.02.14 EMEA ENVN4006H.zip|MPT CPS R00.02.14 EMEA ENVN4006H]]

== Firmware Upgrades ==
[[File:Upgradekit Conv Mobile R05.10.04.zip|Waris Mobile upgrade kit R05.10.04]] - Latest Firmware for Mobiles as of 12/14/2016

[[File:UpgradeKit_Portable_R05.18.01_Non_Four_Lines_Display_Radios.zip]] - Latest Firmware for Portables as of 12/14/2016

[[File:UpgradeKit Portable R05.18.01 Four Lines Display.exe|thumb|UpgradeKit Portable R05.18.01 Four Lines Display]] - Latest Firmware for Four Line Portables as of 12/14/2016

== Binary Codeplugs ==

These codeplugs are binary and have been edited for no serial number, 255 channels, 25-20-12.5 KHz deviation and signaling.
Note when writing them using the CP tool you need to write 0x280-0x2ff. If you write the entire codeplug, you'll fuck up your radio. If you fuck it up, rewite your backup (you do have a backup, right?).

[[Media:220 CDM 1550 mobile binary codeplug modified for channels AAM25MNF4DP5A - No Serial.mot|AAM25MNF4DP5A 220 CDM1550 No Serial.mot]]

[[Media:AAH25MDH4DP6A- Blank Default 220 HT.mot|AAH25MDH4DP6A 220 HT1250 binary codeplug edited for 255 channels, 25/20/12.5 KHz width, MDC/QCII/DTMF signaling and blank serial number]]

[[Media:Waris-Binary-Codeplugs.tar.bz2|Waris-Binary-Codeplugs.tar.bz2]] - all the Waris default codeplugs from the upgrade kits converted to binary. You can open it CPS using the bin2srec converter after changing the region to 0x01 and recomputing the checksum. This is all kinds of useful.

== Unofficial software ==
[[File:Waris Codeplugtool.zip| cptool allows writing and reading raw codeplug from a radio.]] allows writing and reading raw codeplug from a radio.

[[File:Unofficial Global Tuner R02.16.05.zip|Hacked global tuner for editing the serial number]] Hacked global tuner for editing the serial number

[[File:Warisdepot R01.04.00.zip|Depot tool to edit serial number and tempeture compensation values.]] Depot tool to edit serial number and tempeture compensation values.

[[File:Us waris lab upgradekit r03.08.00.zip|Waris US lab upgrade kit and codeplug Tool 3.08]] US Waris unofficial upgrade kit and Tools 3.08

[[file:Waris.py|Chirp Waris plugin for editing the tuning piers and feature blocks]] Chirp Waris plugin for editing the tuning piers and feature blocks

[[File:R05.18.01 Four Line HT1550 with FPP.0|thumb|R05.18.01 Four Line HT1550 with FPP]] Four Line Firmware with FPP enabled

[[File:FW-Mobile-R05.10.04.bin|thumb|US Waris Mobile Firmware R05.10.04 Final Version]] The binary of R05.10.04 last version of firmware for the CDM

[[Media:CDM Model Number Recovery Kit.zip|CDM Model Number Recovery Kit]]

[[Media:EU waris lab upgradekit r02.05.01.zip|EU waris lab upgrade kit R02.05.01]]

[[Media:EU Waris LabUpgradekit R03.07.00.zip|EU Waris LabUpgradekit R03.07.00]]

== Utilities ==

[[Media:Winabler.exe|Winabler utility for windows to enable greyed out menus in tuner]]

[[File:Prolific USB-to-Serial Comm Port 2303 VER 2.0.2.5 del 17-04-2006 OK.zip|2.0.2.5 Prolific driver]]

== Software I've written ==

[https://github.com/W9CR/CPSsrec Utiltiy to conver binary codeplug to CPS srecord format] - This allows you to open an binary codeplug directly in CPS.

== Outdated stuff ==

Don't use any of the following srecord format anymore, as CP tool is easier. Only use these with the Unofficial Lab upgrade kit if you plan to. I don't update anything like this anymore.

[[File:HT1250LS 217-222 split to 216-225 split.s19|HT1250ls 160 Channel, 216-225, 12.5/20/25 step srecord]] This has problems when going into alignment. DO NOT USE Based on 3.08 upgrade kit (R05.17.01)

[[Media:HT1250LS Blank Serial Number TANAPA PMUD1760B 216-225 split.0|HT1250ls 255 Channel, 216-225, 12.5/20/25 step srecord for TANAPA PMUD1760B Blank Serial Number]] NOTE: DTMF pad doesn't work in this, don't use. Only up here for reference DO NOT USE

[[Media:Golden_220_modification_Blank_Serial_Number_TANAPA_PMUD1761A_216-225_MHz.0.0|HT1250ls 255 Channel, 216-225, 12.5/20/25 step srecord for TANAPA PMUD1761A Blank Serial Number]], based on 2.08 Lab Upgrade Kit.

File:HT1550XLS LCD Missing Lines.jpg

2020-12-10T03:42:13Z

N4VX:

HT1550XLS LCD Missing Lines