Re: Has anyone fully decoded the X9000 memory mapping?
As far as getting signals in and out of the shield can on the personality board, there are at least two options.
1) Put an SMA through the shield can and remote a BT antenna to the lock, label or J1 connector area of the radio with thin coax and stub.
2) Wire BT transceiver externally to the radio via J1 and use spare or other lines to the inside the radio. Specifically there are the following pins available on the option plug J301 of a HLN5299B Personality Board:
J301 Inside shield can boundary of HLN5299B Personality Board:
Pin 15 Spare to JU504/505 (JU504 Normally in to U500 Pin 19 for ???)
Pin 17 KID to J1 Pin 29 via 100 ohm
Pin 18 KEY to J1 Pin 25 via 1000 ohm
Pin 16 /WE to J1 Pin 16 via 100 ohm
If I recall, the /WE line is asserted low for 5 ms when a KVL Keyloader is attached to the radio. For us Part 90 users who may wish to retain Securenet capability, it would be nice if the KVL functionality were maintained. If the lines were run through a transmission gate on the new board such that detection of a KVL keyload reverted the function of the bus to that purpose would be desirable. Pin 15 is apparently a spare (more research needed) and could be used to toggle the functionality. The circuits on J301 could pass through the new board if any other option * (including Securenet) required access to J301.
* The Personality Board has space for option boards stacked above the processor on nylon standoffs. I think, (verification needed) that there is space for two option boards. J301 is a DIP ribbon receptacle.
toggle quoted message
Show quoted text
On Fri, Jul 29, 2022 at 10:30 AM, Skip Hansen wrote:
Let's see... 2K x 8 requires 19 GPIO lines (11 address + 8 data). 8K
x 8 requires 21.
The ESP32-S3 (latest chip) has 45. That's the raw chip, the modules
use some of the GPIO internally and don't bring everything out. The
ESP32-S3-WROOM-1 module brings out 36 GPIOs.
My memory was faulty, it ONLY has 240 Mhz dual core CPUs, not 270. It
has WiFi and Bluetooth but the antenna is part of the module and RF
isn't going to get from a buttoned up case. Maybe far enough??
Personally I would prefer routing a serial port out like we did with
the Xcat rather than having an "intentional emitter" inside of the
radio.
GPIO0->GPIO7 - EEPROM data.
GPIO8->GPIO15 - bottom 8 bits of address line
GPIO16->GPIO20 - top 5 bits of address line
GPIO21 - chip select.
There are a couple of gotchas of course... The ESP32 is NOT 5 volt
tolerant so there would need to be some level conversion (just a bunch
of FETs perhaps?). Additionally some of the pins are strapping pins
that have special meaning at power up. For example if GPIO0 is held
low at reset then the ESP32 enters boot mode.
So my napkin says it can be done, but not as cleanly as just hooking
up the pins.
73's Skip WB6YMH
On Thu, Jul 28, 2022 at 10:04 PM Casey Crane <ccrane148@...> wrote:
Emulation. It's the only viable option. Otherwise, you have to forego all the CTCSS/DCS, and whatever I/O and options the radio is capable of and reproduce them with other devices since the radio's uP does the signalling processing. I think using the radio's native capabilies is the simples, cleanest and most cost effective option.
|
Re: Has anyone fully decoded the X9000 memory mapping?
Been here all my life, never even heard of a ch17 in Houston (in the > analog days anyway), and I'm an devout OTA watcher. Perhaps part of > the digital virtual channel shuffling that has made a mockery of the > (continously shrinking) broadcast TV spectrum? Nono, the chart on that page says *using the T-band for two-way* was only permissible in the channel 17 range, in Houston. I.e. there wasn't a channel 17 in that market, and presumably wouldn't be because of whatever that distribution concept was that they used to keep channels spread far enough apart to avoid mutual interference. The whole T-band concept was an attempt to make some additional LMR space available in large cities where other spectrum was more congested. > RE Flipped T-band...yeah, transplanting the VCO is prolly way easier > than moving those filters that far. Indeed. De
|
Re: Has anyone fully decoded the X9000 memory mapping?
Oh, I didn't look. I have been busing and having a hard time following all this basically reading emails of it all in between running around doing things so I thought the discussion was about the SB9600 document that I already had so I didn't look but yes I see it there.?
BTW, I just sent an email to the address we used to communicate at, if it's still correct.?
For some reason I was thinking that SB9600 spoof was for a Spectra,but Spectras are even simpler. Jumper a pair of pins feeding the CH and it will auto power up on power cycle as desired.
Can you see Mototools in the files section I posted earlier?
|
Re: Has anyone fully decoded the X9000 memory mapping?
For some reason I was thinking that SB9600 spoof was for a Spectra,but Spectras are even simpler. Jumper a pair of pins feeding the CH and it will auto power up on power cycle as desired.
Can you see Mototools in the files section I posted earlier?
|
Re: Has anyone fully decoded the X9000 memory mapping?
Wow this sure brings back memories to me, not good ones. Of arranging some engineers from Westinghouse Transportation to sign an NDA for a class on this at Plantation in about 1994, and then getting a call from "Suits" in Schaumburg that "the deal was off". Me: Sorry..big guy.. too late they are already in the classroom, no big guy, I won't be dragging them out.
Moto Corporate was perturbed by rumors that Westinghouse might be developing a smart police car, and in usual fashion Motorola blew off their own foot to tune of $48 millions.
toggle quoted message
Show quoted text
On Fri, Jul 29, 2022 at 12:48 PM, Skip Hansen wrote:
I just found this:??are you guy's aware of it?? I remember searching and searching for SB9600 "back in the day" and finding little., times have changed!
I think my Spectra speaks SB9600 ... I sense a time sink coming.
73's Skip WB6YMH
|
Re: Has anyone fully decoded the X9000 memory mapping?
Good to know you and Mike preserved it. I was cleaning up bookmarks one day and found it a dead link. I hit the wayback machine, saved it as a.html, then converter that to a.pdf. A while later, poking around on Mike's site I did see he had preserved it as well...and now I see you have a link near the bottom of you site too.
My idea was that anyone following and interested in the nuts & bolts of the discussion might want to check out that documentation.
Been here all my life, never even heard of a ch17 in Houston (in the analog days anyway), and I'm an devout OTA watcher.
Perhaps part of the digital virtual channel shuffling that has made a mockery of the (continously shrinking) broadcast TV spectrum?
RE Flipped T-band...yeah, transplanting the VCO is prolly way easier than moving those filters that far.
|
Re: Has anyone fully decoded the X9000 memory mapping?
Another point of order in all this is the X9000 does a form of POST/BITE upon power-up. I found this out when trying to run one headless for a 6 meter repeater project. If it doesn't see certain extremeties such as a control head it will time out and go dormant. What I did was program an Arduino Nano with the data it's looking for then tied the Arduino to the radio's 5v source of course. Upon powering up the Arduino will wait 1 second then transmit hex 00,00,00,05,3B,0D over the SB9600 data lines using a cheap TTL to RS485 converter board from Amazon. It works perfectly. The Arduino then goes dormant and it doesn't seem to affect anything on the SB9600 lines. I found the command by watching the radio's SB9600 data using a RIB attached to it and an RS232 sniffer program. Actually, I believe the program was called Mototools and a sort of SB9600 comms diagnostic program written by some Russian guy. I could control all aspects of the user interace of the radio via the SB9600 lines externally with it such as volume, mode etc...
|
Re: Has anyone fully decoded the X9000 memory mapping?
PS Can I upload some non X/X9000 stuf for Lee if he is interested? I > also found a .pdf I generated from the site that had the SyntorX > codeplug breakdown...dont recall the authors but need to credit them > if you allow me to upload it. The people who did that work were Paul Kasley (W9TS) and Mike Blenderman (K7IC). The original web page was at: That's long gone. There are copies of the web page at: > @ Dennis....I've passed up T-Band stuff, including X family > radios. Back when TV was analog, and men were men and however else > that goes...Houston had both a ch14 and a ch 20 so anything 470-512 > was pretty much useless. I never considered flipping one for link > service. Looks like only channel 17 (488-494) was available in the T-band in Houston. De
|
Re: Has anyone fully decoded the X9000 memory mapping?
@ Skip...it's in the files section, at least I can see it bt I uploaded it. Did I need to set a global flag or someyhing?
PS Can I upload some non X/X9000 stuf for Lee if he is interested? I also found a .pdf I generated from the site that had the SyntorX codeplug breakdown...dont recall the authors but need to credit them if you allow me to upload it.
@ Casey....yeah just glimpsed you code...it's there...............
@ Dennis....I've passed up T-Band stuff, including X family radios. Back when TV was analog, and men were men and however else that goes...Houston had both a ch14 and a ch 20 so anything 470-512 was pretty much useless.
I never considered flipping one for link service.
|
Re: Has anyone fully decoded the X9000 memory mapping?
Lee,
?Not to discourage you from getting your hands on that X9000, but have you seen/hard about a project called Maxduino?
|
Re: Has anyone fully decoded the X9000 memory mapping?
Yea I believe I used the data from the service manual which defines the vco range splits. Been a minute hah...?
Jeez Casey,
I looked back thru my "archives". Mike's post on the Synth control was 10 years ago this passed Christmas. He call them out in the sequence but didnt make the definition, except 800 Mhz? radios didnt use them.
I guess you determined what they needed to be per the operating freq(s) you were using when you electrified your Frankenstein.
In a real world situation the RSS is hard coded to set those per the engineered "switchpoints".
There was another aspect to the hacked HAM RSS that added some 2m and and 70cm bandsplits where those were edited accordingly.
I wondered if those guys that had issues with a getting a range 2 VHF to move low enough for a stable VCO lock would have benefitted from altering those to suit.
|
Re: Has anyone fully decoded the X9000 memory mapping?
Yup, That was it Range 1.5. It didnt add a 2m enhancement as well? - > Acute CRS. I hope I never get called as an eye witness...lol I have > not looked at that RSS in some time. Pretty sure it enabled direct frequency entry as well. But I never used it, as I wrote syntorxgen first, when I started playing with the radios. > I've never seen a range I UHF. I know they exist and use Hi side > injection while all the rest of the UHF ranges use Low side. I wasnt > aware it fell short in the 430 portion. Years ago we had a need for a packet link in the low 430s, and being a Syntor X nut, I obtained to try to retune it. They just won't go high enough. Sad face. > Using a "flipped" T-band radio is an awesome idea for link radios > presuming the filters will move down there. I figured fiddling with those might be necessary too, but I never found a T-band radio to play with. Would still be a fun project. Speaking of CRS, I can't remember now whether I was planning to just modify the T-bander, or move its VCO into a Range 1. De
|
Re: Has anyone fully decoded the X9000 memory mapping?
Well I can see it, hopefully others can as well.? I think you have to be a member of the list to see files, I tried a different account but I don't even see the files tag on the left.
Thanks, I was starting to google for mototools.? I did see my RIB when I was looking for the Xcats and I even remember (I hope) where it was.
Skip
|
Re: Has anyone fully decoded the X9000 memory mapping?
Would love to see something arduino/pi based on these things.? ?I don't see a whole ton of Syntor X9000's in the wild -- I'm actually actively trying to liberate one from an in-service fire truck (I run a two-way shop) which I've been given full permission to do; however,need to remove the seats and parts of the interior to do so that require drilling out one-time-use pop-in retainers etc...? ??
I always wanted to find a way to remotely operate one of these with the ability to remotely switch between antennas (10M/6M) and Allstarlink gave me a good method to at least get the audio back and forth; however, the remote VCO control has had me using Maratracs (not a bad rig, but, limited to using BCD controls)? and I did come up with a way to re-program the radio remotely, and while that does give me *some* flexibility, it's not what i'd call 'agile' by any means!?
Sincerely,
Lee M. Lemoine
N3LEE - Amateur Radio
"Experience is something you don't get until just after you need it."
On Fri, Jul 29, 2022 at 1:45 PM Joe M. < mch@...> wrote: I would prefer seeing the discussion.
Joe M.
On 7/28/2022 7:42 PM, Skip Hansen wrote:
> Well, I'm the list owner and I have no objections.? ?It's been a
> pretty quiet list for many years. If anyone else has any issues let us
> know.
>
> 73's Skip
>
> On Thu, Jul 28, 2022 at 3:36 PM Bradley Andrews via
> <kb9bpf=[email protected]> wrote:
>>
>> I'm very interested in what you guys have to say so if it were up to me (it's not) I'd say go ahead and continue your discussion here. Isn't it as good a place as any? Does anyone object?
>>
>> Brad
>> On Thursday, July 28, 2022, 04:31:17 PM CDT, Casey Crane <ccrane148@...> wrote:
>>
>>
>> Yes, exactly. The thing was amazingly fast. The "problem" is the radio took on the attributes of whatever mode was selected at the time. So, if mode 1 was selected, had a PL of 151.4 etc.... if I tuned away to a different frequency those attributes followed, being only the frequency was changing. It would basically require duplicating all the other features of the radio in hardware/software to take advantage of this method fully which is of course absurd.
>>
>> My thought was to present the uProcessor with one mode's worth of data and then change that data dynamically, allowing the uP to do all the rest of the work. I have the service manual and it appears it has a strobe line which basically thumbs through pages of the eeprom grabbing data for different modes. If it were fed data that we could dynamically update despite whatever mode (eeprom data offset) it's looking for then we could control it all.
>>
>> As said earlier, life has taken priority and caused a stall on the project but I do have some very nice code I came up with for the Raspberry Pi which I think could be used to feed an arduino as an internal decoder resulting in a very nice full color capacitive touch screen 4.3" user control interface with infinitely configurable mode names, scan lists, search parameters etc... all fed to the radio via a simple lightweight serial interface or perhaps even via one of the bluetooth serial dongle boards leaving only audio paths to be dealt with.
>>
>> As the solar cycle has heated up it's something that has got me thinking about it all again.
>>
>> I just don't know if this is the place to discuss it and I don't want to infringe or step on any toes regarding the project this group is about so I should probably start another group so as not to clutter this one.
>>
>> Casey
>>
>>
>>
>> On Thu, Jul 28, 2022 at 4:16 PM swguest via <swguest=[email protected]> wrote:
>>
>> Bradley,
>>? ? Let me see what I can find. This was an X9000 but hardware wise at the point he made the connections the X and the X9000 *should* be the same animal. You will need service manuals for both to pursue the project.
>>
>> He basicly severed the uC's data/control lines to the synthesizer and injected data calculated by his arduino from info Mike B. shared about the radio's divider/synthesizer operational process.
>>
>> Again, POC. It would still take a fair amount of designing to hammer out the details and make an operational radio that doesnt resemble an alien autopsy.
>>
>>
>
>
>
>
>
>
|
Re: Has anyone fully decoded the X9000 memory mapping?
Dennis,
Yup, That was it Range 1.5. It didnt add a 2m enhancement as well? - Acute CRS. I hope I never get called as an eye witness...lol? I have not looked at that RSS in some time.
I've never seen a range I UHF. I know they exist and use Hi side injection while all the rest of the UHF ranges use Low side. I wasnt aware it fell short in the 430 portion.
Using a "flipped" T-band radio is an awesome idea for link radios presuming the filters will move down there.
|
Re: Has anyone fully decoded the X9000 memory mapping?
There was another aspect to the hacked HAM RSS that added some 2m and > and 70cm bandsplits where those were edited accordingly. I wondered > if those guys that had issues with a getting a range 2 VHF to move > low enough for a stable VCO lock would have benefitted from altering > those to suit. IIRC that configuration of that hacked RSS was sometimes referred to as "Range 1.5". It had its v-bit splits modified to support the ham band, but the retuned radio would have to be compatible with the implemented ranges in order to get working results. I.e. you'd have to reconfigure the VCO capacitors to get lock, as well as retuning (probably both sets of) filters. This is why syntorxgen lets you set your own v-bit splits. (It'll also let you invert which setup is used for transmit, and which receive, because it looked to me like that might enable converting a UHF T-band VCO for use around 420-440. The Range 1 radio won't go high enough for that. Some ham UHF link channels around here are in the low 430s.) De
|
Re: Has anyone fully decoded the X9000 memory mapping?
Skip,
?I dont know if I ticked "Notify Members" in time. I had already hit upload.....
Anyway Mototools is now in the files section...unless you mod the uploads...I didnt think about that.
|
Re: Has anyone fully decoded the X9000 memory mapping?
Jeez Casey,
I looked back thru my "archives". Mike's post on the Synth control was 10 years ago this passed Christmas. He call them out in the sequence but didnt make the definition, except 800 Mhz? radios didnt use them.
I guess you determined what they needed to be per the operating freq(s) you were using when you electrified your Frankenstein.
In a real world situation the RSS is hard coded to set those per the engineered "switchpoints".
There was another aspect to the hacked HAM RSS that added some 2m and and 70cm bandsplits where those were edited accordingly.
I wondered if those guys that had issues with a getting a range 2 VHF to move low enough for a stable VCO lock would have benefitted from altering those to suit.
|
Re: Has anyone fully decoded the X9000 memory mapping?
Dennis,
? I dont recall the particulars of the reg/latch sequence. I'm not sure his code addressed them. However he was rx'ing in the 10m band so they apparently were in the correct 1 of the 4 possible state for a LB radio.
Yup, those V0/V1 bits can be a gotcha if you dont pay attention...lol
|
Re: Has anyone fully decoded the X9000 memory mapping?
Skip,
? Yup that got a lotta lotta good info in it......and? yes Spectras, A/S, MCS/MTS, and a lot more speak SB9600. To fully appreciate the coms you need to hook up your Spectra to your PC via you RIB and run a proggy called Mototools, the push some buttons etc on your Spectra and see the SB9600 coms in action. Casey prolly has that proggy handy for U/L. I'd have to search a few offline USB devices.........
I'm compiling some Q's regarding the ESP.....
|
RFI-EMI-GUY