Difference between revisions of "Waris"

From W9CR
Jump to navigation Jump to search
Line 1,136: Line 1,136:
 
  46 - Speed Call Alert
 
  46 - Speed Call Alert
 
  47 - Speed Sel Cal
 
  47 - Speed Sel Cal
 +
 +
=== 0x30 Conventional Personalities ===
 +
 +
RX freq 224.280 to 224.285
 +
 +
0x88 5d80 5ec0 4 f 0 000 0 5b6 50 10 07 31 1 0 00ff0000 0000 0000 ff 27 - Rx only, disables TX, TPL, talkaround, vox, power level, tot tx signaling, compression,
 +
0x88 5d80 5ec0 c f 0 5b6 0 5b6 50 28 07 31 1 1 00000000 0000 0000 ff d2  146.2 encode/decode TPL
 +
0x88 5d80 5ec0 c f 0 5b6 0 5b6 50 08 07 31 1 1 00000000 0000 0000 reverse burst
 +
0x88 5d80 5ec0 c f 0 5b6 0 5b6 50 00 07 31 1 1 00000000 0000 0000  no reverse burst
 +
0x88 5d80 5ec0 c f 0 5b6 0 000 10 28 07 31 1 1 00000000 0000 0000 ff - CSQ on rx, 146.2 on tx
 +
0x88 5d80 5ec0 c f 0 000 0 000 00 28 07 31 1 1 00000000 0000 0000 ff - csq on rx and csq on tx, reverse burst on but grayed out
 +
0x88 5d80 5ec0 c f 0 813 0 000 20 20 07 31 1 1 00000000 0000 0000 ff - CSQ RX, DPL 023 TX, no invert, no turnoff code
 +
0x88 5d80 5ec0 c f 0 815 0 000 20 20 07 31 1 1 00000000 0000 0000 ff - CSQ RX, DPL 025 TX, no invert, no turnoff code
 +
0x88 5d80 5ec0 c f 0 9ec 0 000 28 20 07 31 1 1
 +
0x88 5d80 5ec0 c f 0 9ec 0 000 28 28 07 31 1 1 00000000 0000 0000ff7b
 +
0x88 5d80 5ec0 c f 0 9ec 0 000 20 00 07 31 1 1 00000000 0000 0000ff
 +
0x88 5d80 5ec0 c f 0 9ec 0 000 20 00 47 31 1 1 00000000 0000 0000ff
 +
0x88 5d80 5ec0 c f 0 9ec 0 000 20 00 07 30 1 1 00000000 0000 0000 - low power, tot 180
 +
0x88 5d80 5ec0 c f 0 9ec 0 000 20 00 00 31 1 1 00000000 0000 0000 tot Infinity
 +
0x88 5d80 5ec0 c f 0 9ec 0 000 20 00 01 31 1 1 00000000 0000 0000 ffb1 - tot 15
 +
0x88 5d80 5ec0 c f 0 9ec 0 000 21 00 07 31 1 1
 +
0x88 5d80 5ec0 c f 0 9ec 0 5b6 62 00 07 31 1 1
 +
0x88 5d80 5ec0 c f 0 9ec 0 5b6 60 02 07 31 1 1
 +
0x88 5d80 5ec0 c f 0 9ec 0 5b6 60 03 07 31 1 1 0000 00 00 0000 00 00 FF
 +
0x88 5d80 5ec0 c f 0 5b6 0 5b6 50 28 07 31 1 1 0000 00 00 1234 00 00 FF
 +
  RF TX  RX  E W  tPL  rPL PD TU BM Sc D C      PP SS AAAA DZ DP    CK
 +
 +
RF is reference frequency and channel frequency multiplier
 +
high nibble is TX and low nibble is RX > nibble, high two bits is channel multiplier,
 +
low two bits are reference frequency
 +
  TX    RX
 +
10 00 - 10 00
 +
Mt Rt  Mr Rr
 +
 +
M 00 = 2500
 +
M 01 = 3125
 +
M 10 = 5000
 +
M 11 = 6250
 +
R 00 = default
 +
R 01 = 2.100
 +
R 10 = 2.225
 +
R 11 = 2.400
 +
M = multiplier
 +
R = reference frequency
 +
t/r is transmit or receive 
 +
00 = is default ref frequencies and 2500 on tx and 2500 on rx
 +
44 = is default ref frequencies and 3125 on tx and 3125 on rx
 +
56 = tx 2.100, rx 2.225 and 3125 on tx and 3125 on rx
 +
88 = default ref frequencies and 5000 on tx and 5000 on rx
 +
98 = tx 2.100 and rx default, and 5000 on tx and 5000 on rx
 +
8c is default ref frequencies and 5000 on tx and 6250 on rx
 +
cc is default ref frequencies and 6250 on tx and 6250 on rx
 +
 +
Width - channel
 +
C F0 - 25 khz
 +
C A0 - 20 khz
 +
c 50 - 12.5 KHz
 +
 +
PL
 +
5B6 - 1462d 146.2 hz
 +
5B7 - 1463
 +
 +
DPL is 0x800 + DPL code in Hex:
 +
DPL - OCTAL Hex
 +
813 - \023 0x13
 +
815 - \025
 +
9ec - \754 0x1EC
 +
 +
P is the system enabled, high nibble
 +
5 = TX PL, RX PL
 +
1 = RX PL, RX CSQ
 +
0 = TX CSQ, RX CSQ
 +
 +
D is DPL invert code Low nibble, and Busy channel lockout
 +
00 00
 +
0 = no invert
 +
1 = no invert, on busy channel
 +
2 = no invert, on busy channel with wrong PL code
 +
8 = invert
 +
 +
 +
 +
E is emphasis and option board
 +
0 = none
 +
1 - none and option board
 +
4 = De-Emphasis & no option board
 +
5 = De-Emphasis & option board
 +
8 = Pre-Emphasis & no option board
 +
9 = Pre-Emphasis & option board
 +
C = De and pre and no option board
 +
d - De and Pre and option board
 +
 +
T is Txonly personality and talk around and auto scan
 +
0000 - 0 - No Talkaround,
 +
0010 - 2 - not tx only
 +
1010 - a - tx only
 +
0110 - 6 - Auto scan
 +
 +
U - turn off code or reverse burst Low nibble, and unmute rule
 +
turn off code and reverse burst is bit 3
 +
0000 - 0 - no turn off code, std/std
 +
1000 - 8 - turn off code, std/std
 +
0010 - 2 - no turn off code, and/std
 +
0011 - 3 - no turn off code, and/or
 +
 +
BM  non standard reverse burst and VOX and  TPL/DPL required for Data
 +
upper nibble
 +
bit
 +
0 - Signaling squelch, 0 = OR,  1 = AND
 +
1 - Signaling RX, PL/DPL required for data
 +
2 - VOX, 0 = no, 1 = VOX
 +
3 - Non standard reverse burst, 0 = no, 1 = yes
 +
 +
0000 - 0 - No vox, no RX signaling PL, Or signaling squelch, no non-standard reverse burst
 +
0001 - 1 - RX signaling squelch AND
 +
0100 - 4 - RX Signaling Squelch OR and VOX
 +
0101 - 5 - RX signaling squelch AND and VOX
 +
0110 - 6 - RX Signaling Squelch OR and VOX and TPL/DPL required for Data
 +
0111 - 7 - AND, PL, VOX
 +
1000 - 8 - non standard reverse burst set
 +
 +
M - lower 3 bits
 +
0000 - infinity
 +
0001 - 15 seconds
 +
0010 - 30 seconds
 +
0011 - 45 seconds
 +
0100 - 60 seconds
 +
0101 - 90 Seconds
 +
0110 - 120 Seconds
 +
0111 - 180 seconds
 +
 +
Sc is ExpanSion/compression Type and Tx power
 +
01 - Disabled/disabled - High
 +
21 - AGC/Disabled High
 +
30 - Low Level/Disabled - low
 +
31 - Low Level/Disabled - high
 +
59 - Full/Full - high
 +
81 - disabled/AGC Mode - high
 +
a1 - AGC/AGC - high
 +
 +
D is RX signaling system
 +
0 = none
 +
1 = mdc
 +
2 = QCII
 +
 +
C is the TX signaling system
 +
0 = none
 +
1 = MDC 1
 +
2 = QCII 1
 +
3 = DTMF-1
 +
 +
AAAA is the repeater access ID in hex for mdc
 +
 +
SS is scan list,
 +
FF = disabled
 +
00 = Scan List 1
 +
 +
PP is Phone system, max of 4 phone systems
 +
03 = Phone 4
 +
FF = disabled
 +
 +
DZ = data revert zone
 +
 +
DP = Data revert Personality in the zone
 +
 +
==== options in a conventional personality ====
 +
Options in a Conventional Personality in a mobile
 +
BASIC
 +
Alias - 14 char
 +
Channel bandwidth - 12.5, 20, 25
 +
RX Frequency MHz
 +
Squelch Type - CSQ, TPL, DCS
 +
TPL Freq Hz - 67.0
 +
DPL Code -
 +
DPL Invert
 +
RX Only Personality - binary
 +
TX Frequency MHz
 +
Squelch Type - CSQ, TPL, DCS
 +
TPL Freq Hz - 67.0
 +
Reverse Burst
 +
DPL Code -
 +
DPL Invert - binary
 +
DPL Turn off code - binary
 +
 +
OPTIONS
 +
Talk around - binary
 +
VOX - binary
 +
Edit mode - binary
 +
ARTS Enable - binary
 +
TX Power Level - High or Low
 +
Time out Timer - Infinite, 15, 30, 45, 60, 90, 120, 180
 +
Squelch Setting - HT only
 +
Unmute/Mute Rule - std unmute/std mute, and unmute/std mute, and unmute/or mute
 +
Busy Channel Lockout - disabled, on busy channel, one busy channel with wrong PL code
 +
 +
SIGNALING
 +
RX system, none or MDC or Quick call system
 +
TPL/DPL required for data - binary
 +
Signaling squelch - Or, And
 +
TX system, none or DTMF, or MDC or Quick call system
 +
Repeater Access  ID - MDC 4 hex digits, not for DTMF, nor QCII
 +
 +
SCAN
 +
Scan List selection - available scan lists
 +
auto scan - binary
 +
 +
PHONE
 +
Phone system selection
 +
 +
ADVANCED
 +
Option Board Feature - Binary
 +
Option Board Configuration Index
 +
Noise Blanker - Binary, only on low band radios
 +
TX Only Personality - Binary
 +
Non-Standard Reverse Burst - Binary
 +
Compression Type - Disabled, Full Compression, AGC Mode
 +
Expansion Type - Disabled, Full Expansion, ACG Mode, Low-Level Expansion
 +
Emphasis Selection - None, De-emphasis, Pre-emphasis, De-emphasis & Pre-Emphasis
 +
RX Reference Frequency - Default, 2.100, 2.225, 2.400
 +
TX Reference Frequency - Default, 2.100, 2.225, 2.400
 +
 +
Data Revert
 +
Data Revert Zone - Zone number
 +
Data Revert Channel - Channel number in that zone
  
 
= Flashing =
 
= Flashing =

Revision as of 00:26, 27 October 2020

Contents

Waris

This was originally put together when I got into the HT1250 200 MHz radios. They modified ok, but the way of doing it as suggested left much to be desired, and the DTMF pad didn't work and the radios were narrow band only.

Over time, I've gotten more into these with the CDM1250/1550 and other waris series radios. I've not seen any of the European ones, but I've been working with the US versions for FM service in ham radio.

What I've found is the radios features are determined by the "codeplug" settings. This is simply a packed (hex) data written into the eeprom chip of the radio containing tuning, feature and programing data. This is the same area the programing data from CPS is written in, but CPS is unable to change it. The majority of modification of these radios to amateur service is done with modifications to the codeplug. The codeplug layout appears to be the same for most US versions of the radios, but there are some which are different.

The cool things about these radios is any of the limited ones can be "changed" into the highend, or even more.

Every Waris radio can do the following:

  • 255 personalities only limited by the 16kb of eeprom space. If you load up a bunch of MDC and other crap, CPS will limit adding new channels.
  • MDC/QCII/DTMF signaling
  • LTR trunking
  • Passport (with the right board)
  • 4line portables can be flashed to do FPP/edit mode without special battery
  • Flexibility of band edges when re-aligned properly
  • it is impossible to "brick" a radio. You can fuck it up so it won't boot, but it can be recovered.
  • ability to flash the firmware between EU Select 5 calling and US MDC models (not done too much on this) Even MPT should be possible.
  • mobiles will support any control head, even the 4 line display from the GM380/1280.

Types of Radios

HT's

HT750 - No Display, 4 or 16 channels

HT1250 - One line display, multiple channels up to 128

HT1250ls - limited version of the HT1250, normally missing MDC on conventional

HT1550xls - 4 line display radio, 160 channels, VHF/UHF only


EX500 - No display, smaller submersible radio, 16 channels

EX560xls - one line, smaller submersible radio,

EX600 - one line

EX600xls - one line, 160 channels


CP200 - no display, 4/16 channels

CP200xls -

PR400 - VHF 1/VHF 2, UHF 1/UHF 2/UHF 3 - comes in 16, 32 or, 64 channels

GP series from EMEA

These have EMEA (Latin America/export) versions known as GP

GP340 - HT750

Note I got a GP340 in LB2 when I was in Germany. As they use the euro CPS for 5 tone I wanted to get it going as a US version with MDC and newer firmware. The 5 tone HT's all use 512k flash memory, not the 128k of the HT750/1250 (1550 is 512k), and I was able to flash it using the unofficial kit, then put a default codeplug in it. It took me trying a couple default codeplugs to find one that works. After this I flashed it to R05.18.01 using the normal tools.

What might be interesting would being able to convert the LB GP340 to HT1550 as the GP's all have the 512k Flash ram. A default code plug would need to be edited from an HT1550 for low-band. Theoretically this should work, the parts line up.


GP344 - EX500

GP360 - HT1250

GP366 - EX560xls

GP380 - HT1250

GP580 - HT1250 ls?

GP680 - MPT 1250

GP1280 - MPT 1550

Mobiles

CDM/PRO US/CALA/APAC MDC

These are the series most people see here in the USA. They will do analog voice and come in many different models determined by the control head.

There is no N head for these.


GM EMEA 5-Tone/MPT1327

These are 5 Tone or MPT radios and come in different models, determined by the control head.

GM140/GM340/GM640 - C control head GM160/GM360/GM660 - F control head GM380/GM1280 - N control head (4 line)


MTM700 TETRA

This is not really a waris radio, but the build is similar. These are tetra models for the EU market.

The 4 line control head on this will work on the Waris radios, but the fixed icons for the LCD are different. It may be possiable to replace the LCD module in this control head with the GM380 control head module (P/N 5164313B02) and get it back. I've found this doesn't really effect function, but the talkaround/scan/etc indicators are way different in the TETRA radio.

Control Heads

It's possible to put a 4 line control head on a Waris mobile. This can be the control head from the MTM700 as well, but the LCD ICONS will be different.

GM380 LCD Icons
MTM700 LCD Icons

  • MTM700 LCD

  • LCD Module

  • LCD Module

4 Line Display Use

First ensure your display works before going further. If it's the MTM700 LCD or Display module, the Icons will be different, scan will show up as a period on it for example. The keys will be different and the Menu key can be especially confusing.

  • Check your codeplug
    • is the existing codeplug a Major version 3? Does it have an FDB2 size of 0x09? If not, you'll have to get a binary codeplug and push it into the radio that is
    • This is done by selecting a default codeplug that matches your needs closely. I find a code plug that has analog only, no LTR and the options I need. Then I edit this codeplug in a hex editor and past it from 0x280 to the end into the existing codeplug. Using the tools to convert this to an srec file makes it easy to open in CPS with out needing to write it to a radio.
    • once this is working how you like it, program it into the radio using Codeplug tool.
  • connect up your control head and enjoy!

Remote mount works with the 4 line head too. I've taken to calling this a CDM1850 :)

  • CDM 1850 220 MHz.JPG
  • CDM 1850 Remote Mount Head.JPG
  • CDM 1850 Remote Mount Body.JPG
  • CDM 1850 with GM380 LCD.JPG
  • Waris CPS with CDM1850 220 Mhz.png

Option boards

Option boards are the keypad in the HT1250, and can be installed in the CDM mobile radios as well.

Known boards are below:

AAHLN9725C - Voice Storage Option board

AAHLN9729C - DTMF decode board

AAENLN4150A - Mandown board

The Mandown Option Board is compatible with all 5-Tone, MPT and MDC/Conv portable radios of the Professional Radio Series in all bands (except P040/P080 and GP320).

It is also operational with all connected original Motorola accessories for the GP Professional Radios Series portables.

Installation in any Intrinsically Safe (IS) radios will invalidate the radio’s IS approval (i.e. FM-radios).

Mandown Option Board ENLN4150A Study Guide 68P64121B10 Manual

WARIS Mandown OSS R01.01.01 2001-01-11 Programing Software - Mandown Option Board Service Software

Passport board - PTCB

The Passport Board was used in both HTs and Mobiles. Most (all?) 200 MHz radios will have them. It can be removed from the mobile and disabled if desired.

  • Passport Board 01.JPG
  • Passport Board 02.JPG
  • Passport Board 03.JPG
  • Passport Board 04.JPG
  • Passport Board 05.JPG
  • Passport Board 06.JPG
  • Passport Board 07.JPG

Removal is simple, just open it and remove it. I save the flex cables as they make great replacements in the HTs

  • remove and install in order

  • CDM with Option Board.JPG
  • CDM With Option Board 02.JPG
  • CDM With Option Board Case.JPG

Software

Passport uses it own firmware and CPS to program the PTCB. There is a complex interaction of programing of the option board and the radio it self.

PassPort CPS R03.02.00

PassPort CPS R04.00.01

PassPort CPS R04.03.24

PassPort ServicePak R07.02.09

PassPort ServicePak R08.02.07

PassPort CPS R05.00.14

PassPort R05.02.04

Passport Docs

PassPort Data Configuration Guide

PassPort RSSI Charts

PassPort Site Search

PassPort Software Compatibility

THEORY OF OPERATION: PASSPORT SITE SEARCH

PassPort CPS R03.02.00 Programming Hints


Release Notes

PassPort Firmware R06.02.13 - Release Notes 122002

PassPort Firmware R06.02.14 - Release Notes 042003

PassPort Firmware R06.02.16 Customer Release Notes

PassPort Firmware R06.02.16 - Release Notes

PassPort Firmware R07.01.11 - Release Notes 112003

PassPort Firmware R07.01.19 Release Notes

PassPort Firmware R07.02.09 Release Notes

PassPort Firmware R08.02.05 Release Notes

PassPort Firmware R08.02.06 Release Notes

PassPort Firmware R08.02.07 Release Notes

PassPort Firmware R08.00.17 Release Notes

Service pack

PassPort Firmware R06.02.13 ServicePak - Release Notes 122002

PassPort Firmware R06.02.14 ServicePak - Release Notes 042003

PassPort R06.02.16 ServicePak - Release Notes

PassPort CPS R03.02.00 Customer Release Notes

PassPort CPS R04.00.00 - Release Notes

PassPort CPS R05.00.10 Release Notes

PassPort CPS R05.00.14 Release Notes

Unknown Boards

There was an API/developers guide a company could license from Motorola. Several companies made add ons for these, but I have very little information on them. I belive this is known as "Professional Radio Option Interface Specifications" or PROIS. Rotronix Ltd. was a company known to make a controller for this.

There is a manual "Motorola PROIS v2.03 Manual" which is mentioned in the LC828 manual. A copy of this would be awesome to have. This may have a part number 1202899J28

Here is a picture of one with a DB-9 connector on it. Any information on these would be appreciated.

Option Interface Board.jpg

Rotronix Ltd. made the LC828 which was a special radio based on a PROIS board and a waris radio.

https://web.archive.org/web/20130207012450/http://rotronix.co.nz/Mobile_radio_PROIS_interface.aspx

LC828 radio mods - modification to a HT750/1250 needed to make a LC828

LC828 interface manual - This has a complete document on the "Motorola Professional Portable Radio Interface Option Board(IOB) Manual". It includes a schematic of the board and parts list as well. This is the same board used in all the interfaces.

Computer controlled Radio Interface - CCRI - This is the Manual to the CCRI interface spoken by the Rotronix PROIS board. The mnaul says this is based on the CCRI protocol by T.L. Parker Ltd.


Here is a comment posted by the developer of this board on batlabs forum

Programming and Flash Cables

The CDM and HT series are programmed using windows based CPS. A rs-232 level converter is needed to talk to the radio, and in the OEM Motorola soultion consists of a Programming Test cable (AARKN4083/AARKN4074), a RIB (level converter) and a test box (RLN4460A/B).

<#gallery of shti>

The HT series program and flash via the 13 pin accessory port. The CDM mobiles program and flash via the back 20 pin accessory port or via the front RJ-50 (10 pin) connector. The font connector presents some issues when programming and flashing a unit with a remote head, and the rear connector should be used for that.

The CDM accessory cable connector is a TE AMP connector, Digi-key part number 104422-2-ND, and uses Digi-Key Part number A25989-ND for the pins.

Notes on the RIB based Cables

You should not use a RIB to Flash the radio at anything other than 9600 bps. Even then I've run into issues with this setup. Programing works well though.

A very strange issue popped up using the built in serial port on the Dell Latitude D830 with docking station. When using the docking station serial port the radio will "lock-up" and require the cable to be disconnected to be programed.

I've found the Prolific and FTDI serial adapters to work fine with the RIB for flashing/cptool. However the Prolific adapters have an issue in CPS unless they run the right version of the driver, 2.0.2.5.

File:Prolific USB-to-Serial Comm Port 2303 VER 2.0.2.5 del 17-04-2006 OK.zip

Notes on RIB-less Cables

RIB-less cables are the preferred way to work with the radio. These can be either serial or USB based. In the USB case it's simply a FTDI or Prolific serial port with a level converter.

I've used the following cables for programming

Be sure you use the proper drivers if using the prolific cable.

Flashing and Flash adapters

If you want to flash the radio you need to put it in bootstrap mode. This is done using a flash adapter that puts the CPU (68HC11) into a special mode. The flash program loads a boot loader/flash application via the serial port and then writes the new image to flash chip.

The US Waris unofficial upgrade kit is something that was built by possibly a internal Motorola programmer, or a hack based off the official upgrade kit. Using this tool you can load any of the images on any radio, but you must ensure the image selected is the same size as the flash chip. Note this tool requires all images and default codeplugs as srecord format.

The official upgrade kit includes default codeplugs, firmware images and boot images. These are in an encrypted format, and it appears the unofficial kit has decoded these as the included codeplugs/firmware.

Flash adapter for CDM1250 radio

220 HT1250ls and CDM 1550ls

This is the same as any other to modify to the amateur service from a software perspective. The issue is these radios are narrow band only on the receive path, as the 200 MHz band was never used for 25 KHz channels. Transmit will support wide band (and must be aligned for wide band first!) The IF filters simply need to be swapped with their wide band parts and wide band receive alignment performed.

Hardware Mod

Their are 3 filters in the radio, 1 at 44.85 MHz 1st IF and 2 at 455khz, 2nd IF.

In a VHF/UHF Waris there is a 15KHz filter at the 1st IF followed by a 15KHz filter at the second IF and then followed by another filter. It's this last filter that is switched between narrow and wide in the VHF/UHF radios. TX deviation is a setting in programming/alignment.

In the 220 version, there 1st IF Filter is the same, but it has a 12KHz and then a 9 KHz filter at the second IF.

I've changed out the second filters and found it works much better on the ham bands. You need to adjust the squelch for 20/25khz channels after doing this. The tuner software (2.00.02) will do this for the HT1250 only, it will not work with the mobiles. Use winabler to access the greyed out menus in tuner 2.16.

HT1250 Filters: 

Function                         Part      Manu P/N      Moto P/N     Desc
220 front end     44.85MHz       FL3201    MXF45         9180022M10   4-pole +-7.5khz bandwidth
IF2 First filter  455KHz         FL3204    CFUCJ455F     9180468V04   4-pole 12khz                
IF2 filter narrow band filter    FL3206    CFWC455G      9180469V03   6-pole 9khz


The UHF handhelds use the same arrangement, but with a wider middle filter (1st @455). In wide band they switch only the 2nd 2nd IF filter to a narrow band filter. 


uhf front end     44.85MHz       FL301    MXF45          9180022M11  
IF2 First filter  455KHz         FL302    CFUCJ455E      9180468V05   4-pole  *                
IF2 filter wide band filter      FL303    CFWC455E       9180469V05   6-pole  *
IF2 filter narrow band filter    FL304    CFWC455G       9180469V03   6-pole

You'll need to order the parts with the * from motorola parts for the 220 radios. The mobile and HT use the same filters.

In the HT the 1st IF is under the shield, and very hard to remove. I've not messed with it, as it appears to be the same part in the UHF, and doesn't look like it's limiting.

Based on the following codes for muratta filters 

Muratta filters 
E is +- 7.5 (15)
F is +-6 (12)
G is +- 4.5 (9)

The 220 Filters are 12 and 9 Khz wide at the 2nd IF. Switching them to the E filters of the UHF HT1250 is rather easy, as they are just on the underside of the board, not under a shield. An under board heater with a hot air station makes this rather easy.

Ive found an under-board board pre-heater is mandatory to work with this and 630f at 7 l/m of airflow will prevent hurting the board/parts/

I've found the sensitivity to be a bit better and no squelch clipping on 3.2kc tone at 7khz of deviation (Most ham rigs on 220 have WIDE deviation!).

Pictures of CDM1550

These show the filter change out on a CDM 1550. Kapton tape is used to protect the adjacent parts as they will reflow and move. An underboard heater is used to bring the board up to 500f (260c) while a hot air wand is used to supply the last bit of heat needed.

  • Old filters for narrowband

  • leaded solder prep

  • prepped pads

  • replaced filters (E)

  • replaced filters (E)

Software mod

All this below is not needed. Check out using the UHF 450-527 Ham Band Mod for using waris.py and chirp.

Using Chirp is the way to do it and you can change everything. I typically set the signaling bits to FF enabling all signaling supported, but some radios may not work with this. Always read the radio and save the data before making changes. The data file format is the same binary on the radio EEPROM and use by cptool.

old way

This is easiest with CP tool and a hex editor.

First upgrade the Firmware using the firmware update. This will load the default codeplug back in the radio.

Read the radio using the CP tool and save the binary codeplug. I typically will read this from 0x0000 to 0x1000 which will capture the entire default codeplug (Tuning, Features, and Programing). Save this file and set is aside for safe keeping. If anything goes wrong, you can blow it back into the radio and restore it to defaults with out needing to retune.

If you want to use the pre-made binary codeplugs, if one exists, rather than edit your own you can go right to Writing the Modified Codeplug below.

Editing the Codeplug

Now open up a copy of this code plug and edit it based on the Codeplug Map for the feature blocks. This is from 0x280 to 0x2ff.

You'll need to change the following parts:

  1. Serial number, ASCII spaces are blank (optional)
  2. Channel step needs to be 0x01
  3. Upper Frequency: 0x5F50 for 225 MHz
  4. Signaling: 0xFF is everything enabled (MDC, QCII, DTMF) for trunking and conventional
  5. Conventional Personalities: 0xFF for 255 channels

Once this is done, be sure the checksum 8 on both FDB blocks are 5A. You will need to adjust the checksum bytes for this.

Writing the Modified Codeplug

Open this file with the CP tool and put 0x280 to 0x2ff into the radio, no need to write the entire file. This makes it easy to do many units at once, just blow the Feature Block in, while leaving the tuning and programing alone.

Codeplug tool with a fdb ready to be written to a HT1250

Tune the radio

You'll need to now tune the 20 and 25 KHz squelch settings in the tuner software. The issue here is the tuner software will not let you select the 20 and 25 KHz from the drop down menu. Using Winabler this can capture the tuner menu and enable these.

  • Tuner showing disabled 20-25 khz

  • Tuner with Winabler and showing 25 KHz Tuning

I use the auto squelch setup and found a good value is -127.5 dBm for hams. My radio is -124 dBm for 12db SINAD so this is about 6 dB SINAD at -128, very noisy but understandable. Auto tune makes this really easy. You can always program a button to set the squelch to tight in CPS.

I've found I needed to play with the RSSI settings too, as the S meter was setup for commercial strong signal service. I've only seen this with certian 220 radios.

It's also a good idea to check the frequency/modulation/power out alignments too. The CDM1550's from the New Jersey Turnpike all were aligned wrong for the power output, and we 20W out when set for 30W. Align it in tuner properly, and then use CPS to lower the power if you want.

If you've set the serial number to blank, it's a good time to set it to what you want in tuner before you disconnect.

Once you're done with all this, you should have a great radio that covers 216-225 MHz, wide band FM, MDC/QCII/DTMF, 30W power out, and damn sensitive squelch.

UHF 450-527 Ham Band Mod

The basic issue with modifying these radios to cover down to 440 by only adjusting the High & [[#Low Frequency|Low] Frequency settings in the feature region of the codeplug is the tuning for deviation/squelch/signaling/etc. is setup on 7 frequencies. When the radio tunes between two of these frequencies the value is interpolated based on the curve of the tuning values. For example deviation response will vary from 450 to 520 MHz, the same voltage at 450 will be an unacceptable amount of deviation at 520.

As the frequency "piers" only go down to 450 MHz, the radio has nothing to interpolate with if it's programed 440.450 MHz. This causes this interpolate calibration code to fail and deviation and other calibrations are all over the place. Luckily this is a rather easy fix.

Video of how to do the hex editing of the code plug from a HT1250ls 450-527.

There is a new way to do this using chirp and the plugin below:

http://wiki.w9cr.net/index.php/Waris#Unofficial_software

video explaining the new way using chirp

Preselector Tuning

Using this procedure on a number of EX600xls radios has worked well, but some don't seam to work down at 440 on receive. I've found this to be due to the preselector alignment. Once this is re-aligned on the new frequencies in global tuner, the radios receive properly.

Since you have to load global tuner up anyways, it's worth checking the refference frequency oscillator warp. While not off much, the batch I've seen have been off 600-1000 Hz.

CDM Low Band Range 3 to 46-54 MHz

N9IAA has reported much success moving the CDM's to cover 46-54 MHz (from 42-50 MHz) after modifying the programing using chip and changing the following parts in yellow on this spreadsheet. A complete retuning is necessary of course.

HT 1550

The HT1550 was the high end portable at the time, they can do 160 channels (of course modifiable to 255), but were VHF/UHF only.

Edit mode (FPP)

The Front Pad Programming (Edit Mode/FPP) was an option on the 1550, but required a special government only battery. Recently I was able to work on the firmware and jump over this check. The crux of this is you cannot upgrade firmware without losing this, but as R05.18.01 is the last firmware made for the 4 line models, this shouldn't be an issue. You will need to use the US Waris Firmware Flashtool from the unofficial lab kit and the firmware image below.

Ensure you have edit mode enabled on the personality and enjoy editing without using the special battery.

Code Plug Map

This is based on the Srecord file loaded as binary 

0x000 - 0x27f group, 5A checksum. 0x27f is the checksum byte
This group contains the tuning information for the radios.  
The frequencies it's aligned on are in the same format as the band limits.  
There are 3 groups of frequencies in here, not sure what they all do, but can confirm 
changing them all moved the tuning frequencies on a 6 meter CDM.

0x282 - 0x2D7 - group, needs to be 5A checksum, adjust 0x2D7 to make it.
0x285-0x28E - Serial number
0x291-0x2A0 - Model number, Blank should be spaces 0x20

0x2AC      Channel steps 
*0x01   - 12.5, 20 and 25 KHz
*0x05   - 12.5 only
 
0x2AF       Lower Frequency Limit 
0x2B1       Upper frequency limit 
Desired limit - Base freq (200mhz models the base freq is 103mhz) times 1000 then 
divided by 5. this gives you the new value in dec, you have to change it to hex 
216 MHz is 5848
225 MHZ is 5F50
58485F50 across both bytes



Below is only valid for the 3.08 codeplug tool codeplugs
0x2D8 to 0x2E9 - group, needs to be 5A checksum, adjust 0x2E9 to make it.

0x2E2 - Number of personalities is at in hex.    
*128 - 0x80
*160 - 0xA0
*255 - 0xFF

Below is only valid for the 2.08 codeplug tool codeplugs
0x2D8 to 0x2E4 - group, needs to be 5A checksum, adjust 0x2E4 to make it.

0x2E2 - Number of personalities is at in hex.    
*128 - 0x80
*160 - 0xA0
*255 - 0xFF


The 8 bit checksum must be 0x5A for this bit of code. Byte 0x2E9 is the checksum fix bit. Find the difference after editing between the checksum and 0x5A, then add or subtract this from the value in offset 0x2E9.

passwords

The CPS password is stored in plain text in the codeplug, while the radio lock password is a bit more involved.

My notes are based on a ht1250, so it might be a bit different.

Use the code plug tool to dump the radio to at least 0x400.

Open the resulting binary file in a hex editor and look at or around 0x33e to 0x345 (7 bytes). This is the CPS password. Read the radio with CPS and use this password to recover it.

The radio lock password is a bit trickier, it's at 0x3a4 and is 2 bytes. It's the 0000-9999 numeric password added with 0x4000.


Tuning and FDB Codeplug Map

Waris Tuning and FDB CP Map
Byte Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F
0x000000 Tuning len Tuning Data
0x000010 Tuning Data Cont.
SKIP SKIP
0x000270 Tuning Data Cont. Checksum
0x000280 Feature len FDB 1 Header Serial Number Null
0x000290 Null Model Number
0x0002A0 Mod Cont. Null CP version CP Source CP Date Chan Step Base Freq Low Frequency
0x0002b0 Low Freq Cont. High Frequency CP Part Number
0x0002c0 CP P/N Cont. Unknown Null Pad TANAPA LPWR
0x0002d0 HPWR Unknown Region Checksum FDB 2 Header Trunk Pers Signaling CHD M/H Unknown
0x0002e0 Unknown FPP Conv Pers Unknown Checksum 9
0x0002f0 Unused FDB Checksum

Tuning length

These two bytes are the length of the tuning block. Typically 0x0280

Tuning Checksum

This is a byte which is modified to make the Checksum(8) of the tuning block 0x5A

Feature Length

These two bytes are the length of the feature block. Typically 0x0080

Block Header

This is the block header for the FDB. This is a recurring format for storing data throughout the codeplug

In this case it's typically 0x805201

This is a magic number of 0x80 a length of 52 and a repeat of the length of 01.

In this case it would start at 0x285 and go to 0x2D7 (the checksum correction byte). Note the 3 bytes of the Block Header are not counted, but are included in the checksum calculation.

Serial Number

These are 10 bytes of the serial number. You can make it whatever you want or keep it blank with spaces (0x20) to allow you to set it in tuner.

Model Number

These 16 bytes are the model number. This must match exactly if you want to use the CPS to program the same CP into multiple radios (along with the other FDB blocks).

Codeplug Version

The version of the Code plug 2 bytes, Major.Minor in BCD format

Note that this determines the length of block for FDB2 as follows. If this is not set correctly, it will not work. This also has effected the N control head, 

FB2 Size  Major Version
       9  1,2,3,5
       A  5,7 (5 is only on conv_pmor_16ch and 7 on the Mobile 50 units)
       E  4,11 ( and no minor versions, all are 0)
      10  9 (9.2 Only handheld 65 and 50 units)

This also has effected the N control head on a 220 radio. I was unable to get the N head to work at all with a FDB 2 length of 14 and a version of 11. the version needed to be changed to 3.2 and FDB2 to a 9 long one. It would then work.

Programing Source

1 Byte that shows the source of original programing

  • 0x0 - Factory
  • 0x1 - Depot
  • 0x2 - CPS

Programing Date

6 bytes showing the original programing date BCD format

Example = 0x1984 06 25 2344

  • 2 bytes year - 1984
  • 1 byte month - 06
  • 1 byte day - 25
  • 1 byte hours - 23
  • 1 byte minutes - 44

Channel Step

1 byte giving the channel step

  • 0x0 - UNKNOWN - only used on VHF Low Band
  • 0x1 - 12.5/20/25 KHz - Used on VHF only
  • 0x2 - UNKNOWN - used on UHF R1, R2 only
  • 0x3 - UNKNOWN - used on 800 MHz Only
  • 0x5 - 12.5 KHz only - used on 200 MHz only
  • 0x6 - UNKNOWN - Used on 700 MHz Only

Base Frequency

2 Bytes

Base frequency in hex expressed as the following formula:

Value * 25000 = Base Frequency in MHz

  • 0x320 - 800d - 20 MHz - VHF Low Band
  • 0x1080 - 4120d - 103 MHZ - VHF and 200 MHz
  • 0x32C8 - 13000d - 325 MHz - 330 MHz
  • 0x3A98 - 15000d - 375 MHz - UHF R1/R2
  • 0x6D88 - 28040d - 701 MHz - 700 MHz
  • 0x7D28 - 32040d - 801 MHz - 800 MHz

Low Frequency

2 bytes - Low Frequency of tuning

Value = (Low Frequency in MHz - Base Frequency in MHz) * 1000 / 5

Example Low at 200 MHz - 0x5848 = 22,600d

22,600/200 = 116 MHz + 103 base = 216 MHz

High Frequency

2 bytes - High Frequency of tuning

Calculated same as Low Frequency

Code Plug Part Number

16 Bytes of the code plug part number No idea what it's used for

TANAPA

16 bytes The TANAPA is a configuration code of the hardware in the radio. Model numbers can vary but the TANAPA can be close or the same. Not sure what TANAPA stands for.

Power

Mobile Power Settings 0x2CF and 0x2D0 are low and high power settings. These are the fixed settings in the radio, not what you can adjust them to in CPS.

All HT's have this set to 0 in both. HT's don't have an info screen in CPS showing the power, that tab is not there for HT's

The setting is not linear. Below is what I've found in the default code plugs. Note the series here is the CDM (25) or the CM (50). Tested means it's not a number that appears in the default codeplugs, but what I got. Power is in watts displayed in the CPS info screen. I don't have this for all the values here. 

Hex     Power   Default Series
16      1       25 Series
19              50 Series
2D      3       Tested
3D              25 Series
6A              25 Series
70      20      25 Series
7B              50 Series
7D              50 Series
7F      26      Tested
84              50 Series
89      30      25 Series
8D      66      25 Series
A6              50 Series
AD      48      25 Series
B1              50 Series
B8              25 Series
D4      72      25 Series
E4      83      Tested
F4      95      Tested
FF      104     Tested

Region

1 byte This is the Region code.

  • 0xFF is the default used in the unofficial codeplugs.
  • 0x00 Super TANAPA ?
  • 0x01 - US


0x2DD - CHD

Control head. Not sure if this is bits active or the entire byte.

Known Control head options across all waris radios: 

A, C, D, F, G, H, J, K, N

HT 

C - No Display, PR860/HT750/GP140/320/330/240/340/540/640
D - Keypad 
F - 1 Line Display, Limited Keypad GP360 HT1250
G - In H25 only
H - 1 Line display, Full Keypad, HT1250/GP280/380/580/680
J - in H65 only - 16chan only, no or limited keypad, conv_pmor_16ch_pnk/plk
K - in H65 Only - 16chan only, full keypad conv_pmor_16ch_pfk
N - 4 Line Display, HT1550/GP1280

Mobile 

A - No Display, No Keypad - Databox
C - No Display, Basic Keypad CDM750/GM140/340/640 
D - 1 Line Display, Limited Keypad CDM1250
F - One Line Display, Standard Keypad,  CDM1550/GM160/360/660
N - GM380/1280

Please read the notes under the codeplug version information regarding this.

Byte value vs CHD

 0 - C, Mobile, 25 
10 - C, H/M, 25, 34, 38, 45, 50 
11 - D, M, 25
20 - D, H, 34
21 - F & H, 25, 34, 38, display H is only onHT's, but F is on mobile and HT's 
30 - C K & J, 65 series HT only
31 - F & H, 34 series HT only
32 - N, 25 series only, HT and Mobile
33 - F & H, 50 & 65 Series, Mobile and HT for 65, Mobile only for 50 
40 - A, 25 series only, Mobile only


0x2DE

Looks to be a bit mask. Changing from 0xA1 to 0x81 (toggle bit 5) changed an HT to a mobile. On the mobile, squelch adjustment went away, along with radio password. The buttons changed to be Mobile config.

Bit 5 on makes a mobile

changes in radio configuration

  • Auto power mode and radio-radio cloning, and hook defeats pl was lost.
  • Auto backlight and Tx Low battery LED were removed. Mobile backlight intensity was added.
  • TX low battery alert an wrap-around were lost.
  • Gained revert scan and hook
  • monitor sticky permanent alert was removed
  • control head mic was gained
  • default display stayed the same (this was a 4 line radio)
  • Lost radio lock password
  • TX Power, aux control, accessory pins and accessory config tabs gained.

controls and menus

  • conventional buttons changed to mobile
  • Utilities menu lost squelch, light disable, when available and radio lock.

conventional personality

  • advanced tab gained tx only personality
  • new tab "data revert"

MDC

  • mdc system config gained remote monitor tab


2E0:1

Not sure what this does, but I encountered a UHF R1 HT model H25RDH9DP5, that was 0xCC78 and it would not load the codeplug from a H25RDH9DP9 HT with everything in the FDB being the same other than the source CP was 0xCE79.

I tried changing each byte independently and CPS still would not allow the CP to be written to the HT. Only with both flipped to the proper 0xCE79 of the source radio would CPS write the unit.

Any more information would be helpful


0x2E0

Unknown, but appears to have something to do with features on a bitmask basis changed from 0xFF to 0xCF and lost remote monitor option in the radio call sub menu.

0x2E1 - FPP

This has more features on a bit mask basis.

Lower nibble known options 

Bit 3 is FPP, unsure about the other bits.
5 - 0101 - FPP
D - 1101 - FPP
B - 1011 - No FPP
9 - 1001 - no FPP
8 - 1000 - No FPP 
4 - 0100 - No FPP ? - maybe a fluke? - only on 65 and 50 series radios have this bit set.
1 - 0001 - No FPP
0 - 0000 - No FPP

Note that enabling FPP is possible in the mobile and HT1250 (even 750) radios. It will show up in the CPS, allow you to add it to the menu and everything, but it won't work. Edit mode also needs to be enabled on that channel and you need the red battery or hacked firmware. If anyone has Ideas for the CDM, let me know.

0x2E3

Unsure what this is, but when opening an srecord and saving it again, CPS changed this from from 0x30 to 0x10 (and low power from 0x16 to 0x19).

Programing block

The programing block is the next block after the tuning and FDB blocks, typically starting at 0x300. The programing block is made up of "chonks" which are variable length packed data types. These chonks are laid out following the Table of Contents block and enabled based on the TOC header. Chonks are identified based on their order in the TOC header, which is not in order in the address space of the codeplug.

A chonk typically has it's own format, and the code plug version determines what formats the chonks follow. Chonks can further be subdivided into wads which would be the rows of ordered data in a list. Chonks are checksum(8) including the header and checksum byte to make 0x5A. Block 15 doesn't follow this.

Block > Chonk > Wad


Waris programing Codeplug Map
Byte Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F
0x000000 Tuning len Tuning Data
SKIP SKIP
0x000270 Tuning Data Cont. Checksum
0x000280 Feature len Feature Data Cont.
SKIP SKIP
0x000300 Magic # Length TOC Header TOC Programing Data
SKIP SKIP

Programing Magic

This is a magic number of 0x0400 that identifies the start of the programing block

Programing Length

This is the length of the programing block. To calculate the absolute position in the codeplug, add 0x300 to it 

example it's 0x0972 and the programming block starts at 0x0300  
0x972+300 = 0x0C72, so the programing block runs from 0x300:C72 and will have a checksum8 of 0x5A

Programing TOC Header Start

This is a pointer to the TOC Header start address, it is an absolute value from the start of the codeplug.

Programing TOC Start

This is a pointer to the Programing Table of Contents, it is an absolute value from the start of the codeplug.


Programing TOC Header

This is a block of programing data which tells what blocks are enabled in the TOC. 

A typical block will be as follows:
000A03FFDF03FF7F3FAF

Broken out:  
000A 03FFDF03FF7F3F AF

000A is the length of the block,  10d bytes including header and checksum
AF is the checksum byte which makes the checksum8 of the block 0x5A

0x03FFDF03FF7F3F is the bit map of what chonks are enabled in the codeplug TOC

03 is the first 0-7 chonks 
0000 0011 - 03 
7654 3210 - chonks enabled

FF is the next 8-F
1111 1111 - FF
FEDC BA98 

DF is the 10-17 chonks        
1101 1111 - DF
7654 3210 - chonks enabled

03 is the 18-1F chonks
0000 0011 - 03 
FEDC BA98 - chonks enabled

FF is the next 20-27
1111 1111 - FF
7654 3210 - chonks enabled

7F is the 28-2F chonks
0111 1111 - 7F 
FEDC BA98 - chonks enabled

3F is the 30-37 chonks
0011 1111 - 3F 
7654 3210 - chonks enabled

The way this works is if a bit is 1, that block is active in the programing code plug 
and the TOC will have the address of it's start.  If it's set to 0 the block is not used, but may be present in the code plug and may have the pointer set to 0x0000 if it's not present.

Programing TOC

This will be a block that varies in length, and the first 2 bytes will be the number of 2 byte addresses in the list. 

0036 0282 02D8 0000 0000 0000 0000 0000 - 6   110 0000 
0000 0308 0315 034B 0354 03D3 03E5 04D8 - 14 0111 1111
04BC 0657 064B 0817 07E0 067F 0000 068F - 22 1111 1101
03AF 0369 03C8 0000 0000 0000 0000 0000 - 30 1110 0000 
0000 06B7 06BF 06F6 06DA 0711 0729 0740 - 38 0111 1111
095B 0839 084A 0946 0858 0867 08A6 0939 - 46 1111 1111
0000 07C3 0802 075C 0770 0792 07A9 04   - 53 0111 111

In the above block, 0x0036 is the number of items in the list, 54.  
The final byte is a checksum byte baking the blocks checksum8 0x5A.

The total block length will be the number of items * 2 + 3  In this case the block is 111 bytes long.  

The list is list of absolute pointers from the beginning of the file to each block.  Note that both feature blocks are identified here.   
The first block is 0x282, or FDB1, 0x2D8 is FDB2,

Chonks

The following note on what each chonk does, or what I think it does. 

0x00 - FDB 1
0x01 - FDB 2
0x02 -
 ||  -  These are always blank
0x07 - 
0x08 - Date the code plug was saved 02 0502 2020 10 25 0058
                                    uu NNnn yyyy mm dd hhmm 
       uu is unknown, NNnn is the Latest Codeplug, yyyy-mm-dd hh:mm is the latest programing date  
0x09 - Radio Configuration
0x0A - Personality assignment to zone 
0x0B - Zone names, not present in the A or C or F control head Radios and 0x84 chonk
0x0C - UNKNOWN - only seems to be a few different options
0x0D - Phone List (25 entries)
0x0E - Phone List Names (25 names)
0x0F - Phone Systems
0x10 - scan list config data
0x11 - Scan list channel assignments
0x12 - Trunking Buttons
0x13 - Conventional buttons
0x14 - Menu Items
0x15 - no present on any radio other than GP3688, uses a special chonk type of 0x4.  Some radios use a 0x80 chonk type here and normal checksum. 
0x16 - Option Board Programing info?  Changing the voice storage tab under radio configuration changes this.
0x17 - Accessory Config, Accessory Pins
0x18 - Auxiliary Control 
0x19 - Present in all code plugs, always 0x0000
0x1A - 0
0x1B - 0
0x1C - 0
0x1D - 0
0x1E - 0
0x1F - 0
0x20 - 
0x21 - MDC Call List
0x22 - QCII Call List
0x23 - DTMF Call List
0x24 - MDC Message List
0x25 - MDC status List
0x26 - One Touch Setup
0x27 - ??
0x28 - LS Trunking personalities
0x29 - 
0x2A - LTR Group ID List
0x2B - LS Trunking Universal ID List
0x2C - Trunking universal ID List Names 0x84 
0x2D - Trunking repeater config
0x2E - Trunking site system config
0x2F - blank
0x30 - Conventional Personalities - channel data
0x31 - Conventional Personalities - Names
       0x0E (14) in length, chonk header has the number of fields in it.  They are stored every 14 bytes
0x32 - Signaling Config
0x33 - MDC Systems
0x34 - QCII Systems
0x35 - DTMF Systems

0x12 & 0x13

0x12 is the trunking buttons

0x13 is the conventional buttons

These are two byte values, the first byte is the short press, the last byte is the long press. 

P1   P2   P3   P4                       A    B    C 
0d00 0d00 0d0b 1934 0000 0000 0000 0000 3100 2c00 3000 0000 0000 0000 0000

# Conventional Functions:
Hex  Function
00 - unassigned
05 - Monitor - short press only, Long press must be Open Squelch
07 - Volume Set
09 - Toggle Sytem Scan On/Off - 
0a - Nuisance Delete - must be a long press and short press _must_ be Toggle System Scan On/Off
0b - Toggle High/Low Power
0d - Toggle Repeater/Talkaround
0F - Toggle Option Board On/Off
11 - Speed Dial (Memory)
12 - Radio Call
14 - Voice Storage Playback Exit
15 - Voice Storage Reset 
16 - Voice Storage Playback
17 - Voice Storage Delete 
19 - Backlight Control
1f - Aux Control 1
20 - Aux Control 2
21 - Priority Request to Talk 
22 - Status
23 - Message 
24 - One Touch 1
25 - One Touch 2
26 - One Touch 3
27 - One Touch 4
28 - One Touch 5
29 - One Touch 6
2A - One Touch 7
2B - One Touch 8
2C - Menu/Channel Up   - Long press must be unassigned with this
2D - Menu/Channel Down - Long press must be unassigned with this
30 - Select/Enter - Must be a Short Press and long press must be unassigned
31 - Exit
33 - Direct Channel
34 - Home Revert
35 - Zone - if Long, short must be unassigned, if short long must be unassigned
36 - Open Squelch - Long press only, Short press must be Monitor
37 - Horn and Lights (External Alarm)
39 - Display Clock
3A - Toggle Voice Operated Tx
3C - Toggle Answer Mode On/Off
3D - Scan List Edit
3f - Home Revert 2
40 - Call Alert Member #1
41 - Call Alert Member #2
42 - Call Alert Member #3
43 - Sel Cal Member #1
44 - Sel Cal Member #2
45 - Sel Cal Member #3
46 - Speed Call Alert
47 - Speed Sel Cal

0x30 Conventional Personalities

RX freq 224.280 to 224.285

0x88 5d80 5ec0 4 f 0 000 0 5b6 50 10 07 31 1 0 00ff0000 0000 0000 ff 27 - Rx only, disables TX, TPL, talkaround, vox, power level, tot tx signaling, compression, 
0x88 5d80 5ec0 c f 0 5b6 0 5b6 50 28 07 31 1 1 00000000 0000 0000 ff d2  146.2 encode/decode TPL
0x88 5d80 5ec0 c f 0 5b6 0 5b6 50 08 07 31 1 1 00000000 0000 0000 reverse burst
0x88 5d80 5ec0 c f 0 5b6 0 5b6 50 00 07 31 1 1 00000000 0000 0000  no reverse burst
0x88 5d80 5ec0 c f 0 5b6 0 000 10 28 07 31 1 1 00000000 0000 0000 ff - CSQ on rx, 146.2 on tx
0x88 5d80 5ec0 c f 0 000 0 000 00 28 07 31 1 1 00000000 0000 0000 ff - csq on rx and csq on tx, reverse burst on but grayed out
0x88 5d80 5ec0 c f 0 813 0 000 20 20 07 31 1 1 00000000 0000 0000 ff - CSQ RX, DPL 023 TX, no invert, no turnoff code
0x88 5d80 5ec0 c f 0 815 0 000 20 20 07 31 1 1 00000000 0000 0000 ff - CSQ RX, DPL 025 TX, no invert, no turnoff code
0x88 5d80 5ec0 c f 0 9ec 0 000 28 20 07 31 1 1
0x88 5d80 5ec0 c f 0 9ec 0 000 28 28 07 31 1 1 00000000 0000 0000ff7b
0x88 5d80 5ec0 c f 0 9ec 0 000 20 00 07 31 1 1 00000000 0000 0000ff
0x88 5d80 5ec0 c f 0 9ec 0 000 20 00 47 31 1 1 00000000 0000 0000ff
0x88 5d80 5ec0 c f 0 9ec 0 000 20 00 07 30 1 1 00000000 0000 0000 - low power, tot 180
0x88 5d80 5ec0 c f 0 9ec 0 000 20 00 00 31 1 1 00000000 0000 0000 tot Infinity 
0x88 5d80 5ec0 c f 0 9ec 0 000 20 00 01 31 1 1 00000000 0000 0000 ffb1 - tot 15
0x88 5d80 5ec0 c f 0 9ec 0 000 21 00 07 31 1 1
0x88 5d80 5ec0 c f 0 9ec 0 5b6 62 00 07 31 1 1
0x88 5d80 5ec0 c f 0 9ec 0 5b6 60 02 07 31 1 1
0x88 5d80 5ec0 c f 0 9ec 0 5b6 60 03 07 31 1 1 0000 00 00 0000 00 00 FF
0x88 5d80 5ec0 c f 0 5b6 0 5b6 50 28 07 31 1 1 0000 00 00 1234 00 00 FF
  RF TX   RX   E W   tPL   rPL PD TU BM Sc D C      PP SS AAAA DZ DP    CK

RF is reference frequency and channel frequency multiplier 
high nibble is TX and low nibble is RX > nibble, high two bits is channel multiplier,
low two bits are reference frequency
  TX     RX
10 00 - 10 00 
Mt Rt   Mr Rr

M 00 = 2500
M 01 = 3125
M 10 = 5000
M 11 = 6250
R 00 = default
R 01 = 2.100
R 10 = 2.225
R 11 = 2.400 
M = multiplier
R = reference frequency
t/r is transmit or receive  
00 = is default ref frequencies and 2500 on tx and 2500 on rx
44 = is default ref frequencies and 3125 on tx and 3125 on rx
56 = tx 2.100, rx 2.225 and 3125 on tx and 3125 on rx
88 = default ref frequencies and 5000 on tx and 5000 on rx
98 = tx 2.100 and rx default, and 5000 on tx and 5000 on rx
8c is default ref frequencies and 5000 on tx and 6250 on rx
cc is default ref frequencies and 6250 on tx and 6250 on rx

Width - channel
C F0 - 25 khz 
C A0 - 20 khz
c 50 - 12.5 KHz

PL
5B6 - 1462d 146.2 hz
5B7 - 1463 

DPL is 0x800 + DPL code in Hex:
DPL - OCTAL Hex 
813 - \023 	0x13
815 - \025 
9ec - \754 	0x1EC

P is the system enabled, high nibble
5 = TX PL, RX PL
1 = RX PL, RX CSQ
0 = TX CSQ, RX CSQ

D is DPL invert code Low nibble, and Busy channel lockout
00 00
0 = no invert
1 = no invert, on busy channel 
2 = no invert, on busy channel with wrong PL code
8 = invert



E is emphasis and option board 
0 = none
1 - none and option board
4 = De-Emphasis & no option board
5 = De-Emphasis & option board
8 = Pre-Emphasis & no option board 
9 = Pre-Emphasis & option board 
C = De and pre and no option board
d - De and Pre and option board

T is Txonly personality and talk around and auto scan
0000 - 0 - No Talkaround, 
0010 - 2 - not tx only 
1010 - a - tx only
0110 - 6 - Auto scan

U - turn off code or reverse burst Low nibble, and unmute rule 
turn off code and reverse burst is bit 3
0000 - 0 - no turn off code, std/std
1000 - 8 - turn off code, std/std
0010 - 2 - no turn off code, and/std
0011 - 3 - no turn off code, and/or

BM  non standard reverse burst and VOX and  TPL/DPL required for Data
upper nibble
bit
0 - Signaling squelch, 0 = OR,  1 = AND
1 - Signaling RX, PL/DPL required for data 
2 - VOX, 0 = no, 1 = VOX
3 - Non standard reverse burst, 0 = no, 1 = yes

0000 - 0 - No vox, no RX signaling PL, Or signaling squelch, no non-standard reverse burst
0001 - 1 - RX signaling squelch AND
0100 - 4 - RX Signaling Squelch OR and VOX
0101 - 5 - RX signaling squelch AND and VOX
0110 - 6 - RX Signaling Squelch OR and VOX and TPL/DPL required for Data
0111 - 7 - AND, PL, VOX
1000 - 8 - non standard reverse burst set 

M - lower 3 bits
0000 - infinity
0001 - 15 seconds
0010 - 30 seconds
0011 - 45 seconds
0100 - 60 seconds
0101 - 90 Seconds
0110 - 120 Seconds
0111 - 180 seconds

Sc is ExpanSion/compression Type and Tx power
01 - Disabled/disabled - High
21 - AGC/Disabled	High
30 - Low Level/Disabled	- low
31 - Low Level/Disabled	- high
59 - Full/Full - high
81 - disabled/AGC Mode - high
a1 - AGC/AGC - high

D is RX signaling system
0 = none
1 = mdc
2 = QCII

C is the TX signaling system
0 = none
1 = MDC 1
2 = QCII 1
3 = DTMF-1

AAAA is the repeater access ID in hex for mdc

SS is scan list, 
FF = disabled 
00 = Scan List 1

PP is Phone system, max of 4 phone systems
03 = Phone 4
FF = disabled

DZ = data revert zone

DP = Data revert Personality in the zone

options in a conventional personality

Options in a Conventional Personality in a mobile
	BASIC
Alias - 14 char
Channel bandwidth - 12.5, 20, 25
RX Frequency MHz
Squelch Type - CSQ, TPL, DCS
TPL Freq Hz - 67.0
DPL Code - 
DPL Invert
RX Only Personality - binary 
TX Frequency MHz
Squelch Type - CSQ, TPL, DCS
TPL Freq Hz - 67.0 
Reverse Burst 
DPL Code - 
DPL Invert - binary 
DPL Turn off code - binary 

	OPTIONS
Talk around - binary
VOX - binary 
Edit mode - binary 
ARTS Enable - binary
TX Power Level - High or Low
Time out Timer - Infinite, 15, 30, 45, 60, 90, 120, 180
Squelch Setting - HT only
Unmute/Mute Rule - std unmute/std mute, and unmute/std mute, and unmute/or mute
Busy Channel Lockout - disabled, on busy channel, one busy channel with wrong PL code

	SIGNALING
RX system, none or MDC or Quick call system
TPL/DPL required for data - binary
Signaling squelch - Or, And
TX system, none or DTMF, or MDC or Quick call system
Repeater Access  ID - MDC 4 hex digits, not for DTMF, nor QCII

	SCAN
Scan List selection - available scan lists
auto scan - binary

	PHONE
Phone system selection 

	ADVANCED
Option Board Feature - Binary
Option Board Configuration Index
Noise Blanker - Binary, only on low band radios
TX Only Personality - Binary
Non-Standard Reverse Burst - Binary 
Compression Type - Disabled, Full Compression, AGC Mode
Expansion Type - Disabled, Full Expansion, ACG Mode, Low-Level Expansion
Emphasis Selection - None, De-emphasis, Pre-emphasis, De-emphasis & Pre-Emphasis
RX Reference Frequency - Default, 2.100, 2.225, 2.400
TX Reference Frequency - Default, 2.100, 2.225, 2.400

	Data Revert
Data Revert Zone - Zone number
Data Revert Channel - Channel number in that zone

Flashing

The radio is basically impossible to brick, but the Motorola upgrade tools are notorious for fucking up and leaving you with a dead radio. What's worse, is the official Motorola upgrader has no way to restart a failed upgrade. The Motorola tool must be able to read the code plug first, if it can't, it won't upgrade it. Motorola did this to prevent you from flashing radios to different models (MDC to 5 tone, etc), and the official tool installs a new default codeplug, they wanted to keep you from doing all the fun stuff we can now do in the feature database, by flashing a different default code plug on it.

Why can't I brick the radio?

Easy, the uP they use, a 68hc11, has a boot strap mode. What the CPU looks for at this point in bootstrap mode, is serial data loaded via XMODEM. In this 256 bytes of data, you load a program that can get the cpu going. Motorola loads the initial xmodem helper in bootstrap mode, then it loads a flash helper which is larger. This flash helper will write the flash chip on the radio. This is not a "bootloader" or anything like that, it's built into the CPU, and is well documented in the CPU datasheet.

Also side note, the cpu once programmed doesn't have a checksum on the firmware. The flash is memory mapped, and at boot the radio goes to 0xFFFE, reads 2 bytes as a pointer, then jumps there and starts running code. It's simple, but there's no checksum, so you can edit anything in there and not need to run a checksum.

Well I was fucking in the codeplug and wrote bytes it does not understand

This can get the radio stuck in a boot loop, or look similar to the firmware being corrupted.

No fear, just short out the SPI lines on the serial codeplug chip and boot it, then you should get "EEPROM CS ERROR" and can reprogram the backup codeplug (you did make a backup, right :)

Recovering a flash dead radio

Assuming your radio is truly flash dead, you'll need to reprogram this using the US waris kit. This will allow you to load any firmware on any radio. Simply select the right firmware file and flash it.

Note if using a real Motorola rib, don't go faster than 9600 BPS (20-30 min at this speed is normal)

Once the firmware is loaded, the radio may bitch with CS ERROR or something. This is good, it means you have a working OS on the radio, and you need to load the codeplug now that matches the radio.

Firmware files

These are text files of the binary firmware in S-record format. The only difference is the header must be removed. The file name must be *.0 as well, and it cannot be loaded via a network filesystem path.

Software & Docs

Docs

220 700MHz Service Manual.PDF

Basic Service Manual HT1250•LS+ 200 MHz 700 MHz 6864110R15-O

Detailed Service Manual HT1250•LS+ 200 MHz 700 MHz 6864110R12-O

CDM1550 200-700 Mhz detailed service manual

6881088C46 Motorola HT/MTX/PRO Detailed Service Manual

68P80906Z54-D Motorola HT/MTX/PRO Basic Service Manual

thumb|6866577D06-A Motorola GP Professional Basic Service Manual

6866558D04-O Motorola professional GP series including 300R1 Detailed Service Manual -- Note this has shit formatting from some gay ass manual site that fucked up the page sizes. Unless you need 300 MHz stuff, use the one below.

6866558D03-P Motorola GP Series Detailed Service Manual - Proper Paper Size Use this one unless you need 300 MHz

RLN4780 4 line remote mount kit with speaker manual - This is the remote mount 4 page manual for the GM380/1280 and MTM700

Product Comparison Analog Portables

HT1250ls Radio User Guide 6881088C42-G

Final Reflashing Instructions Portable Only-5-29-02

CP125/CP150/CP200

CP125 Portable Two-Way Radio User Guide 6881098C60-O

CP125 Service Manual 6881096C38-B


CP150 CP200 Commercial Series Two-Way Radio User Guide 6880309N60

CP150 CP200 Commercial Series Two-Way Radio User Guide 6880309N60-A

CP150 CP200 Basic Service Manual 6880309N61-B

CP150 CP200 Detailed Service Manual 6880309N62-C

CP150 CP200 Detailed Service Manual 6880309N62-D

CP200XLS Basic Service Manual 68009328001-A

CP185 Basic Service Manual 68007024004-D

PR860 User Guide 6881098C02-P

PR860 Basic Service Manual 6881098C42-P

PR860 Detailed Service Manual 6881098C43-P


Expert Series (EX600)

EX500 Users Guide 6881093C98-C

EX600 User Guide 68P81094C70-O

EX600•XLS Expert Series Two-Way Radio User Guide 68P81095C10-O

EX500 EX600 EX600•XLS Expert Series Two-Way Radio Basic Service Manual 68P81094C00-B

EX500 EX600 EX560XLS EX600XLS Basic Service Manual 6881094C00-C

Elite Series Detailed Service Manual 6881094C21-A

MANUAL REVISION FMR-2027-1 EX500/EX600/EX600•XLS Detailed Service Manual 6881094C21-A

PRO Series Elite Detailed Service Manual 6881094C21-B

Release Notes

Professional CPS

ProSeries CPS R06.11.05 Notes

ProSeries CPS R06.11.07 Notes

ProSeries CPS R06.11.10 Notes

ProSeries CPS R06.12.02 Notes v4

ProSeries CPS R06.12.04 Notes

ProSeries CPS R06.12.05 Notes

ProSeries CPS R06.12.08 Release Notes

ProSeries CPS R06.12.09 Notes

Professional Mobile Firmware

ProSeries Mobile R05.05.17 Notes

ProSeries Mobile R05.05.19 Notes

ProSeries Mobile R05.08.01 Notes

ProSeries Mobile R05.08.05 Notes

Professional Series Mobile R05.08.05 Notes

ProSeries Mobile R05.09.01 Notes

ProSeries Mobile R05.10.01 Notes v.4

ProSeries Mobile R05.10.02 Notes

ProSeries Mobile R05.10.03 Notes

ProSeries Mobile R05.10.04 Notes

Professional Portable Non-4 Line Display Firmware

ProSeries Portable R05.09.11 Notes

ProSeries Portable R05.10.05 non4line Notes

ProSeries Portable R05.13.09 non4line Notes

ProSeries Portable R05.14.03 non4line Notes

ProSeries Portable R05.17.01 non4line Notes v4

ProSeries Portable R05.17.02 non4line Notes

ProSeries Portable R05.18.00 non4line Notes

ProSeries Portable R05.18.01 non4line Notes

Professional Portable 4 Line Display Firmware

ProSeries Portable R05.10.05 4line Notes

ProSeries Portable R05.13.09 4line Notes

ProSeries Portable R05.14.03 4line Notes

ProSeries Portable R05.16.01 4line Notes

ProSeries Portable R05.17.01 4line Notes v4

ProSeries Portable R05.17.02 4line Notes

ProSeries Portable R05.18.00 4line Notes

ProSeries Portable R05.18.01 4line Notes

MTX CPS

PrivacyPlus Portable R01.03.73 Release Notes

PrivacyPlus Portable R01.04.01 Release Notes

PrivacyPlus Portable R01.04.03 Release Notes

PrivacyPlus CPS R02.00.02 Release Notes

PrivacyPlus CPS R02.01.03 Release Notes

PrivacyPlus CPS R02.03.00 Release Notes

CPS

Professional CPS R.06.12.09 AA.zip - Latest CPS Release as of 12/14/2016

Global Tuner R 02.18.00.zip - Latest Tuner Release as of 12/14/2016

Waris CPS 6.12.05 Waris CPS 6.12.05

Waris Tuner 2.02 Waris Tuner 2.02

PrivacyPlus Portable CPS R01.04.03 - for the MTX150, MTX1500, MTX450, MTX4500, MTX850, MTX8250, MTX950, MTX9250

PrivacyPlus CPS R02.03.00 - for the MTX150, MTX1500, MTX450, MTX4500, MTX850, MTX8250, MTX950, MTX9250

These are for the EU Waris radios

Professional GP300/GM300 Series CPS R03.11.16 ENVN400Z

MPT CPS R00.02.14 EMEA ENVN4006H

Firmware Upgrades

File:Upgradekit Conv Mobile R05.10.04.zip - Latest Firmware for Mobiles as of 12/14/2016

File:UpgradeKit Portable R05.18.01 Non Four Lines Display Radios.zip - Latest Firmware for Portables as of 12/14/2016

File:UpgradeKit Portable R05.18.01 Four Lines Display.exe - Latest Firmware for Four Line Portables as of 12/14/2016

Binary Codeplugs

These codeplugs are binary and have been edited for no serial number, 255 channels, 25-20-12.5 KHz deviation and signaling. Note when writing them using the CP tool you need to write 0x280-0x2ff. If you write the entire codeplug, you'll fuck up your radio. If you fuck it up, rewite your backup (you do have a backup, right?).

AAM25MNF4DP5A 220 CDM1550 No Serial.mot

AAH25MDH4DP6A 220 HT1250 binary codeplug edited for 255 channels, 25/20/12.5 KHz width, MDC/QCII/DTMF signaling and blank serial number


Waris-Binary-Codeplugs.tar.bz2 - all the Waris default codeplugs from the upgrade kits converted to binary. You can open it CPS using the bin2srec converter after changing the region to 0x01 and recomputing the checksum. This is all kinds of useful.

Unofficial software

File:Waris Codeplugtool.zip allows writing and reading raw codeplug from a radio.

File:Unofficial Global Tuner R02.16.05.zip Hacked global tuner for editing the serial number

File:Warisdepot R01.04.00.zip Depot tool to edit serial number and tempeture compensation values.

File:Us waris lab upgradekit r03.08.00.zip US Waris unofficial upgrade kit and Tools 3.08

File:Waris.py Chirp Waris plugin for editing the tuning piers and feature blocks

File:R05.18.01 Four Line HT1550 with FPP.0 Four Line Firmware with FPP enabled

File:FW-Mobile-R05.10.04.bin The binary of R05.10.04 last version of firmware for the CDM

CDM Model Number Recovery Kit

EU waris lab upgrade kit R02.05.01

EU Waris LabUpgradekit R03.07.00

Utilities

Winabler utility for windows to enable greyed out menus in tuner

File:Prolific USB-to-Serial Comm Port 2303 VER 2.0.2.5 del 17-04-2006 OK.zip

Software I've written

Utiltiy to conver binary codeplug to CPS srecord format - This allows you to open an binary codeplug directly in CPS.

Outdated stuff

Don't use any of the following srecord format anymore, as CP tool is easier. Only use these with the Unofficial Lab upgrade kit if you plan to. I don't update anything like this anymore.

File:HT1250LS 217-222 split to 216-225 split.s19 This has problems when going into alignment. DO NOT USE Based on 3.08 upgrade kit (R05.17.01)

HT1250ls 255 Channel, 216-225, 12.5/20/25 step srecord for TANAPA PMUD1760B Blank Serial Number NOTE: DTMF pad doesn't work in this, don't use. Only up here for reference DO NOT USE

HT1250ls 255 Channel, 216-225, 12.5/20/25 step srecord for TANAPA PMUD1761A Blank Serial Number, based on 2.08 Lab Upgrade Kit.

Retrieved from "https://wiki.w9cr.net/index.php?title=Waris&oldid=5513"