General Information

Notes on programming MX-300S.

MX-300S and MX-300R radio memory have a maximum of 48 channels, arranged in 4 zones of 12 channels. There are two kinds of memory, early ones that are PROMs and can only be burned once, and EEROMs that can be reprogrammed. Both kinds can be programmed only with the R-1801A or R1821A suitcase programmer, with suitable adapter board and software (RTL5805C adapter and RTL4809C software). This version can program both the write-once and reprogrammable memories, but earlier versions can program only the write-once kind. The late version reprogrammable part is RPX4455A or NLN7302B.

If your radio has an old write-once memory but you aren't using all 48 channels, you can write the new frequencies to an unused zone in the memory and use that bank of 12 channels, and change the jumper on the flex print to select that zone of 12 channels instead of zone 1.

Henry Crun 97

A site you may want to visit is http://www.geocities.com/SiliconValley/5857.

The PROM used in the MX memory modules is a Texas Instruments 28L22 type, a 256x8 bipolar PROM (data-io code 1346).

EPROM Structure

OK, below is the result of many dedicated hours of reverse engineering by one of our contributors, enjoy!

Since the motorola PROM modules are somewhat expensive and require the suitcase programmer (which is also expensive) to program, I thought maybe I could find a way to put together my own PROM using a part that is less expensive to program. To do that, I had to determine the PROM layout and the meaning of the data in the PROM.

The first step was determining the layout of the PROM module. Figure 1 shows a bottom and top (component side) view of the PROM. If you hold the module such that you are viewing the circuit card and the metal housing is away from you and bulge in the housing is on the top you will be oriented to the figure. The left side contacts mate with the controller and the right side mates with the phase detector module.

The pin definitions are as follows:

Controller side

1,2       Time out timer (TOT) disable
3,4       TOT time select
6         +5.2V pulsed
7         PROM enable
8,9,10    Ground
11,12,13  +5.2V
15,16     50 KHz
17        ADDR 7
18        ADDR 6
19        ADDR 5
20        ADDR 4
21        ADDR 3
22        ADDR 2
23        ADDR 1
24        ADDR 0
25        NP LATCH
26        NA LATCH

Phase Detector side

26,25,24,23  Ground
21,22        +5.2V pulsed
19,18        Ground
16,15,14     +5.2V
12,11        50 KHz
10           DATA 0
9            DATA 1
8            DATA 2
7            DATA 3
6            DATA 4
5            DATA 5
4            DATA 6
3            DATA 7
2           NP LATCH
1           NA LATCH

If you carefully remove the metal case from the PROM module, you will see the top view also shown in figure 1. The black dots are vias in the circuit board. The important ones are the address , data, and the +5.2V pulsed. I soldered small wire wrap wire into the via and hooked up the analyzer leads to those wires. I could also use the same set up to actually program the memory locations with my own data. I would need a pulsed voltage supply and some switches to set the address and data to do that and am reading up on that now.

Using a logic analyzer, I tapped into the address and data lines of the PROM. The PROM pinout matches that of an AM27S23 which is a 2K bipolar PROM arranged as 255 x 8.

The PROM pinout is as follows:

1  ADDR 0
2  ADDR 1
3  ADDR 2
4  ADDR 3
5  ADDR 4
6  DATA 0
7  DATA 1
8  DATA 2
9  DATA 3
10 GND
11 DATA 4
12 DATA 5
13 DATA 6
14 DATA 7
15 /CHIP SEL 
16 /CHIP SEL
17 ADDR 5
18 ADDR 6
19 ADDR 7
20 VCC

Whenever a frequency is selected by the channel select or the zone select, the PROM data is sent to the phase controller module to set up the PLL. The 5.2V for the PROM is pulsed on for 320 microseconds. This energizes the PROM and saves battery power since the PROM is only on while the PLL is being loaded with data. Two bytes of data are required to tune the PLL. Based on the logic analyzer display, the controller actually sends the data twice(maybe for redundancy ?).

The next part of the puzzle was to figure out what the data meant and how it was arranged in the PROM. The radio I experimented on was a 400-430MHz MX300-R. It had 2 channels programmed in it, 413.025 and 413.150 MHz in zone B.

When I selected channel 1 for receive, the logic analyzer showed ADDR 0x00 = B2h and ADDR 0x01 = 87h. When chl 2 was selected for receive, the analyzer showed ADDR 0x02=BCh ADDR 0x03=87h. For transmit mode, the channel 1 indicated ADDR ox80 = A2 ADDR 0x81 = 85h and channel 2 showed ADDR 0x82 = ACh and ADDR 0x83 = 85h

I had a hint that the PLL used a dual modulus prescaler because of the NA, NP latch signals on the schematic. From the tx and rx frequencies I computed the VCO frequencies. In receive, the VCO = (RF-21.4)/6 and in TX mode, VCO = (TX-21.2)/6

I next assumed a channel step size of 12.5 KHz since the delta between the receive frequencies was 125 KHz and I saw a change from B2h to BCh (delta of 10d) then 125/10 = 12.5 KHz. That would be a reference frequency in the PLL of 12.5KHz/6 = 2.08333 KHz. Even though the radio filters are set up for 25 KHz channel spacing, you could in fact tune the radio in 12.5 KHz channel steps.

The total division ratio from the VCO freq to the reference freq is as follows:

CHL 1 RX = 31330 (65.270833MHz/2.0833KHz) =  VCO/Ref
CHL 2 RX = 31340 (65.291666MHz/2.08333KHz)
CHL 1 TX = 31154 (64.904166MHz/2.0833KHz)
CHL 2 TX = 31164 (64.925 MHz/2.0833KHz)

Now that I have the division ratio N for each frequency, I took a few guesses at the dual modulus prescaler values. 63/64 is a common one but that didn't work out right. I tried 80/81 and that was the one ! For a dual modulus, N(total) = (N * P) + A, where N and A are the 2 values loaded into the PLL.

CHL 1 RX = 31330 N=391  A=50   (391*80)+50=31330
CHL 2 RX = 31340 N=391  A=60
CHL 1 TX = 31154 N=389  A=34
CHL 2 TX = 31164 n=389  a=44

If you write out memory location 0x01 and 0x00 in binary...

87h = 1000 0111   and   B2 =  1011 0010

the N value is represented by addr 0x01 (the second of the pair of addresses for each channel) and the A value is represented by addr 0x00 (or the first of the pair of addresses)

For the N value, add 256d to the binary value (add a leading 1). This now represents the N value. That bit will always be set to 1 for the range the VCO operates over so there is no need to waste memory space with it. The PLL controller just adds it in by itself.

N=   (1) 1000 0111 = 391d   amazing !

For the A value, drop the leading 1

A = ( ) 011 0010  = 50d wow it works !

If you were to program a PROM using a test setup, compute the N and A values for the total N value that is required using N[total]=N*P + A. N[total] is the required VCO frequency divided by the reference frequency (2.0833333KHz). Then subtract 256 from the N value and convert to hex. For the A value add 128 and convert to hex. N should be in the range of 381 to 448 and A will range 0 to 79.

Now that you know what data to put in the PROM to get the right frequency out, you next need to know where all the channels map to in the PROM memory. All I did was capture the addresses for each channel and zone. The PROM memory map is as follows:

RECEIVE FREQUENCIES

0x00  Chl 1  Zone B PLL A value
0x01  Chl 1  Zone B PLL N value
0x02  Chl 2  Zone B PLL A value
0x03  Chl 2  Zone B PLL N value
.
.
0x16  Chl 12  Zone B PLL A value
0x17  Chl 12  Zone B PLL N value
.
.
0x20  Chl 1  Zone A PLL A value
0x21  Chl 1  Zone A PLL N value
.
.

0x37  Chl 12  Zone A PLL N value
.
.
0x40  Chl 1 Zone C PLL A value
.
.
0x57  Chl 12 Zone C PLL N value
.
.
0x60  Chl 1  Zone D PLL A value
.
.
0x77  Chl 12 Zone D PLL N value


TRANSMIT FREQUENCIES

0x80  Chl 1  Zone B PLL A value
0x81  Chl 1  Zone B PLL N value
0x82  Chl 2  Zone B PLL A value
0x83  Chl 2  Zone B PLL N value
.
.
0x96  Chl 12  Zone B PLL A value
0x97  Chl 12  Zone B PLL N value
.
.
0xA0  Chl 1  Zone A PLL A value
0xA1  Chl 1  Zone A PLL N value
.
.
0xB7  Chl 12  Zone A PLL N value
.
.
0xC0  Chl 1 Zone C PLL A value
.
.
0xD7  Chl 12 Zone C PLL N value
.
.
0xE0  Chl 1  Zone D PLL A value
.
.
0xF7  Chl 12 Zone D PLL N value

You can see that Zone B is located first in memory. That is because zone B is the default zone in single zone radios. Also notice that in transmit mode, only the MSB of the address gets set. The transmit addresses are offset from the receive by 80h.

Note that this data isvalid for the UHF radios. I think the VHF radio PLL data will be slightly different because there is a range control bit for the VCO. My guess is the MSB of the PLL A word that was set to 1 for UHF functions as the VHF range control bit.

REEF

Home