Archive for March, 2012

Vertex Standard CE39 Manufacturer Mode

Sunday, March 11th, 2012

Hi all… I have two Vertex Standard VX-900 VHF portable radios which I’ve been having issues with, because they always TX DPL’s in inverted polarity, rather than normal polarity. I did some looking around and realized that the standard file in CE39 for Windows has the option “DCS TX Data” in the “Common > Hardware” menu set to “Inverted”. However, there is no way to change this! The option is generally greyed out, along with others!

I had recently learned of the “Dealer” mode for some Vertex Standard software, where you right click on the shortcut to the programming software, and add a “-d” at the end of the target line. So, for example, “C:\Program Files (x86)\Vertex Standard\CE39Win.exe” -d would give you “dealer mode”, which appears to not exist for CE39, but does for CE60 for the VXR9000 and I imagine some others as well.

Anyhow, I was looking for a way to get into those greyed-out dropdown menus in the VX900 software, which would allow you to change squelch hysteresis, squelch attack time, squelch release time, etc. What I ended up doing was running CE39Win.exe with every single switch possible (-a,-b,-c,-d…) until the menu items became ungreyed. Well, they never came ungreyed, but with the switch “-m”, a password dialog popped up. I tried “password” and the program started up, but the boxes were still greyed out. So, it turns out, “password” was not the password. So, after a little bit of resourceful hacking, I was able to find the password, which is “ansho-bango” (no quotes).

So, in short, change the target of your program shortcut to append a “-m” at the end of the target line, save the shortcut, run the program, and type in “ansho-bango”, and ansho-bango, you’re ready to go!

Icom IC-F1721/1821/2721/2821 Serial Snooping

Thursday, March 1st, 2012

This is not really a complete post, but rather a quick snippet about snooping the serial data from Icom IC-F1721/1821/2721/2821 P25/analog mobile radios. There are a number of serial buses within the radio: one on the DB25 connector for accessories such as GPS, an internal NMEA GPS serial bus, a CLONE IN/OUT serial bus for radio programming, and the FMDA/MFDA bus which goes between the main microprocessor on the main board and the microprocessor on the control head. This snippet of info has to do with the final option, the FMDA/MFDA bus for control head communication. It operates at 5v TTL levels, at a baud rate close to 57600 (as best I could tell… It may not be an even baud rate.) I was impressed with how fast this bus was running, compared to the 9600 baud rate of Motorola’s internal SB9600 serial bus. Unfortunately, the only place to tap into this bus is inside the radio. I found that the data I was receiving from the bus was not error-free, either (probably due to lack of a buffer on the line, or incorrect baud rate), but I could clearly make out some of the channel names being printed on the display, and I could see what I thought were button codes. I believe FMDA stands for the TX from the control head to Main board, and MFDA stands for TX from Main unit to control head,  but I cannot be sure; One would have to check the service manual. The connection points I tapped into were very close to the ribbon cable connector on the main board for the control head ribbon cable:

The white wire is soldered to a plated-through hole which has either FMDA or MFDA on it (I can’t remember which I had at the time…). The other line (either FMDA or MFDA) is on the plated-through hole just below and left of the one that I have the white wire soldered to in the picture. In theory, you could inject your own “packets” into the serial bus to the radio or control head and control what channel the radio is on, emulate button presses, write to the display, etc.  (even PTT) via serial commands.

Motorola MCS2000 MIII No Power Up

Thursday, March 1st, 2012

OK, here’s another fix/modification… I received an MCS2000 with the FL 01/90 error code, which was extremely common in early production runs of this radio. This error disappeared when I removed the radio PCB from the actual body of the radio deck. So, I went to reinstall the PCB in the radio, installing a single screw at a time and powering up after each screw was added. When I added one of the metal clips that pressed some voltage regulators and the audio amplifier IC against the heatsink, the radio gave the fail code. After some research, it turns out that one of the regulators (the 5v regulator) can come unsoldered from the board due to the pressure of the metal clip pressing it down onto the heatsink. Motorola’s fix, rumor has it, is to shorten the metal tang of the heatsink clip to keep the clip from pressing down so hard on the regulator. I simply reflowed the regulator and added more solder, crossed my fingers, and hoped it would work for another while. Buttoned back up, the radio works like a charm!

Then, I decided to construct a programming cable for the radio using the schematics from BatLabs, and in the process I shorted the SW B+ line on the mic jack (pin 1) to ground, causing the display to go out on the control head, and all that was left on were the LEDs backlighting the keys. I removed power from the radio, let it sit a minute, and tried again, but to no avail. The radio would not power up!

Turns out, I burned some traces from the SW B+ pin on the 18-pin connector that goes from the radio deck to the control head, so the control head was not getting SW B+. This can be verified by checking both sides of a blue 10ohm resistor close to the mic jack, on the back (component) side of the control head board. It should show somewhere around 13v, or SW B+. In my case, it was showing only 2-3v, for some reason… So, I jumpered from pin 17 on the control head connector to the bottom side of that resistor, as such:

I also jumpered from the bottom side of the one capacitor shown to the transistor which is a part of the OPT SEL/SW B+ sensing circuit. Depending on the current drawn through the SW B+ pin on the mic connector, the radio decides whether SB9600 serial lines get sent to the mic jack, or if standard microphone/audio signals get sent to the mic jack. If current is zilch, it assumes that it is a microphone. If current is > 2 mA (I believe that’s the figure…) it decides that the attached device is a “SB9600 SMART” device, and sends the SB9600 to the mic connector. This is why a programming cable for the MCS has a 1k resistor from SW B+ (pin 1) to GND (causes 13mA of current to flow from SW B+, switching MCS into SB9600 Accessory mode). I found that I had no continuity between pin 1 of the mic jack and the 470ohm pullup resistor (possibly R0729) which supplies the SW B+ to the mic jack.

Like I said, the board layout is actually from a GM900 service manual (all I could find) but is *very* similar to the MCS2000’s layout. Hope this helps somebody down the road! The radio is now working like a charm once again.

Icom IC-F5061/F6061 External Footswitch Modifications

Thursday, March 1st, 2012

So, I had to interface an external footswitch to an Icom IC-F6061 being used as a control station (dispatch position) for a customer, and found that the PTT input on the DB25 of the radio does not use the audio from the front panel mic jack. It uses the audio from the external modulation input on the DB25 connector. While this is well and good in some applications, in this instance, it’s just a pain. So, I wrote up a little modification to accommodate a desk microphone plugged into the front mic jack which can be PTT’ed by either the microphone PTT button or the external footswitch.

Here is the PDF of the modification: Icom F5061-6061 Footswitch Mods