General Information

Notes on programming MX-300S.

MX-300S and MX-300R radio memory have a maximum of 48 channels, arranged in 4 zones of 12 channels. There are two kinds of memory, early ones with an A or B suffix that are PROMs and can only be burned once, and later ones with a C or D suffix which are EEPROMs that can be reprogrammed. Both kinds can be programmed only with the R-1800/1801/1821 suitcase programmer, with suitable adapter board and software. There are two different adapters and four revisions of the software as follows:

PROM      Adapter		Software
"A"	  RTL-5805A or B	RTL-4809A or B
"B"	  RTL-5805B	        RTL-4809B
"C"	  RTL-5070C or D	RTL-4809C or D
"D"	  RTL-5070D	        RTL-4809D

Only the "D" rev PROMs are now available from Motorola, as REX-1090.

If your radio has an old write-once memory but all 4 zones (48 channels) haven't been used, you can write the new frequencies to an unused zone in the memory and use that bank of 12 channels, and change the jumper on the flex print to select that zone of 12 channels instead of the default zone. For radios with 12 or fewer channels, the factory default zone is B; for two zone radios, A and B will be used; A, B and C for three zone radios.

Unlike many newer radios, the MX does not operate over its entire bandsplit without tuning. The maximum channel spread on VHF is about 6 MHz transmit and receive, and this requires stagger tuning of the preselector (4 MHz without). UHF is good for about 2 MHz receive and 6 MHz transmit. The VCO must also be tuned for best synthesizer performance. Besides the different bandsplits of VCO modules, the VCO coil itself changes from one bandsplit extreme to the other (I think that this is the only part soldered on the PC board that changes). The VHF radio VCO's will allow operation only about 3 MHz outside the band edge; a 136-150.8 MHz radio will not make it to 154.400, for example.

PL is generated with an oscillator and Permacode filter like some of the last crystal-controlled radios; it is not programmable. All MX's have capability for PL on the main board. Besides the filter, which sets the frequency, the PL processor is needed for encode and decode, and the PL low pass filter is also needed for decode. Multiple PL radios exist with up to 8 filters selectable with a switch.

Like the crystal controlled MX's, the MX-S's came in a wide variety of optional and SP configurations. MDC signaling and DPL were available as were DES and DVP encryption. There is also an 800 MHz version that was the first Motorola trunking portable, but this was available only in the crystal-controlled version.

There has been a revival of interest in the MX-S as a lot of them have come on the surplus market for $10 to $20, sometimes even less. Performance is almost equal to the most recent Sabers except for the limitations on signaling types and number of channels.

Henry Crun 97 (updated 2002)

A site you may want to visit is http://www.geocities.com/SiliconValley/5857.

The PROM used in the MX memory modules is a Texas Instruments 28L22 type, a 256x8 bipolar PROM (data-io code 1346).

There exists a ConvertaCom for the RUGGEDIZED MX-300-R radios. It is UTTERLY BIZARRE. It is very rare and it was undoubtedly a VERY expensive item. It looks like it was made out of a surplus aircraft carrier. :)

Transpeater II Connections

This is for a circa 1995 Transpeater II with a couple DIN connectors on it. It is made by Transcrypt, Model TR-30-021, Manual 186-0021-02.

You could probably connect a couple MX-300's to it for repeater operation. One has to isolate the DC on the speaker output. Motorola made a SP2703101 and SP2706401 in the late 70's to make a repeater out of a couple MX's. It didn't have any connectors on it other than those for the MX's. So, maybe this Transcrypt box is the same one.

The pinouts for the connectors on this box are as follows:

Vin=6-30 Volts @ <0.5mA
Rx IN : 2-10V p-p, 100 Ohms or 6.8K
Tx OUT: 5mV to 10V p-p 100 Ohms

DIN Connector
1-Ground
2-Level Set, paired with Pin 4
3-Power IN (+) 6-30 VDC
4-Level Set
5-Rx, Audio IN
6-Tx, Audio OUT
7- External PTT
8- connect to Pin 1 to hardwire Relay mode

Level Set Resistor determines level out to the transmit radio @ Pin 6
Ohms    Level
330     5-15 mV
1K     15-50 mV
3.3K   50-150 mV
10K   150-500 mV
33K   500-1500 mV
100K  1.5-5.0 V
open  5.0-10.0 V

Hang Time set by P3-P4-P5-P6
1=right  0=left
0.25 sec 0001
0.50 sec 0010
0.75 sec 0011
1.00     0100
....etc
3.75 sec 1111

EPROM Structure

OK, below is the result of many dedicated hours of reverse engineering by one of our contributors, enjoy!

Since the Motorola PROM modules are somewhat expensive and require the suitcase programmer (which is also expensive) to program, I thought maybe I could find a way to put together my own PROM using a part that is less expensive to program. To do that, I had to determine the PROM layout and the meaning of the data in the PROM.

The first step was determining the layout of the PROM module. Figure 1 shows a bottom and top (component side) view of the PROM. If you hold the module such that you are viewing the circuit card and the metal housing is away from you and bulge in the housing is on the top you will be oriented to the figure. The left side contacts mate with the controller and the right side mates with the phase detector module.

The pin definitions are as follows:

Controller side

1,2       Time out timer (TOT) disable
3,4       TOT time select
6         +5.2V pulsed
7         PROM enable
8,9,10    Ground
11,12,13  +5.2V
15,16     50 KHz
17        ADDR 7
18        ADDR 6
19        ADDR 5
20        ADDR 4
21        ADDR 3
22        ADDR 2
23        ADDR 1
24        ADDR 0
25        NP LATCH
26        NA LATCH

Phase Detector side

26,25,24,23  Ground
21,22        +5.2V pulsed
19,18        Ground
16,15,14     +5.2V
12,11        50 KHz
10           DATA 0
9            DATA 1
8            DATA 2
7            DATA 3
6            DATA 4
5            DATA 5
4            DATA 6
3            DATA 7
2           NP LATCH
1           NA LATCH

If you carefully remove the metal case from the PROM module, you will see the top view also shown in Figure 1. The black dots are vias in the circuit board. The important ones are the address, data, and the +5.2V pulsed. I soldered small wire wrap wire into the via and hooked up the analyzer leads to those wires. I could also use the same set up to actually program the memory locations with my own data. I would need a pulsed voltage supply and some switches to set the address and data to do that and am reading up on that now.

Using a logic analyzer, I tapped into the address and data lines of the PROM. The PROM pinout matches that of an AM27S23 which is a 2K bipolar PROM arranged as 256x8.

The PROM pinout is as follows:

1  ADDR 0
2  ADDR 1
3  ADDR 2
4  ADDR 3
5  ADDR 4
6  DATA 0
7  DATA 1
8  DATA 2
9  DATA 3
10 GND
11 DATA 4
12 DATA 5
13 DATA 6
14 DATA 7
15 /CHIP SEL 
16 /CHIP SEL
17 ADDR 5
18 ADDR 6
19 ADDR 7
20 VCC

Whenever a frequency is selected by the channel select or the zone select, the PROM data is sent to the phase controller module to set up the PLL. The 5.2V for the PROM is pulsed on for 320 microseconds. This energizes the PROM and saves battery power since the PROM is only on while the PLL is being loaded with data. Two bytes of data are required to tune the PLL. Based on the logic analyzer display, the controller actually sends the data twice(maybe for redundancy?).

The next part of the puzzle was to figure out what the data meant and how it was arranged in the PROM. The radio I experimented on was a 400-430MHz MX300-R. It had 2 channels programmed in it, 413.025 and 413.150 MHz in Zone B.

When I selected channel 1 for receive, the logic analyzer showed ADDR 0x00 = B2h and ADDR 0x01 = 87h. When chl 2 was selected for receive, the analyzer showed ADDR 0x02=BCh ADDR 0x03=87h. For transmit mode, the channel 1 indicated ADDR ox80 = A2 ADDR 0x81 = 85h and channel 2 showed ADDR 0x82 = ACh and ADDR 0x83 = 85h

I had a hint that the PLL used a dual modulus prescaler because of the NA, NP latch signals on the schematic. From the tx and rx frequencies I computed the VCO frequencies. In receive, the VCO = (RF-21.4)/6 and in TX mode, VCO = (TX-21.2)/6

I next assumed a channel step size of 12.5 KHz since the delta between the receive frequencies was 125 KHz and I saw a change from B2h to BCh (delta of 10d) then 125/10 = 12.5 KHz. That would be a reference frequency in the PLL of 12.5KHz/6 = 2.08333 KHz. Even though the radio filters are set up for 25 KHz channel spacing, you could in fact tune the radio in 12.5 KHz channel steps.

The total division ratio from the VCO freq to the reference freq is as follows:

CHL 1 RX = 31330 (65.270833MHz/2.0833KHz) =  VCO/Ref
CHL 2 RX = 31340 (65.291666MHz/2.08333KHz)
CHL 1 TX = 31154 (64.904166MHz/2.0833KHz)
CHL 2 TX = 31164 (64.925 MHz/2.0833KHz)

Now that I have the division ratio N for each frequency, I took a few guesses at the dual modulus prescaler values. 63/64 is a common one but that didn't work out right. I tried 80/81 and that was the one! For a dual modulus, N(total) = (N * P) + A, where N and A are the 2 values loaded into the PLL.

CHL 1 RX = 31330 N=391  A=50   (391*80)+50=31330
CHL 2 RX = 31340 N=391  A=60
CHL 1 TX = 31154 N=389  A=34
CHL 2 TX = 31164 n=389  a=44

If you write out memory location 0x01 and 0x00 in binary...

87h = 1000 0111   and   B2 =  1011 0010

the N value is represented by addr 0x01 (the second of the pair of addresses for each channel) and the A value is represented by addr 0x00 (or the first of the pair of addresses)

For the N value, add 256d to the binary value (add a leading 1). This now represents the N value. That bit will always be set to 1 for the range the VCO operates over so there is no need to waste memory space with it. The PLL controller just adds it in by itself.

N=   (1) 1000 0111 = 391d   amazing!

For the A value, drop the leading 1

A = ( ) 011 0010  = 50d wow it works!

If you were to program a PROM using a test setup, compute the N and A values for the total N value that is required using N[total]=N*P + A. N[total] is the required VCO frequency divided by the reference frequency (2.0833333KHz). Then subtract 256 from the N value and convert to hex. For the A value add 128 and convert to hex. N should be in the range of 381 to 448 and A will range 0 to 79.

Now that you know what data to put in the PROM to get the right frequency out, you next need to know where all the channels map to in the PROM memory. All I did was capture the addresses for each channel and zone. The PROM memory map is as follows:

RECEIVE FREQUENCIES

0x00  Chl 1  Zone B PLL A value
0x01  Chl 1  Zone B PLL N value
0x02  Chl 2  Zone B PLL A value
0x03  Chl 2  Zone B PLL N value
.
.
0x16  Chl 12  Zone B PLL A value
0x17  Chl 12  Zone B PLL N value
.
.
0x20  Chl 1  Zone A PLL A value
0x21  Chl 1  Zone A PLL N value
.
.

0x37  Chl 12  Zone A PLL N value
.
.
0x40  Chl 1 Zone C PLL A value
.
.
0x57  Chl 12 Zone C PLL N value
.
.
0x60  Chl 1  Zone D PLL A value
.
.
0x77  Chl 12 Zone D PLL N value


TRANSMIT FREQUENCIES

0x80  Chl 1  Zone B PLL A value
0x81  Chl 1  Zone B PLL N value
0x82  Chl 2  Zone B PLL A value
0x83  Chl 2  Zone B PLL N value
.
.
0x96  Chl 12  Zone B PLL A value
0x97  Chl 12  Zone B PLL N value
.
.
0xA0  Chl 1  Zone A PLL A value
0xA1  Chl 1  Zone A PLL N value
.
.
0xB7  Chl 12  Zone A PLL N value
.
.
0xC0  Chl 1 Zone C PLL A value
.
.
0xD7  Chl 12 Zone C PLL N value
.
.
0xE0  Chl 1  Zone D PLL A value
.
.
0xF7  Chl 12 Zone D PLL N value

You can see that Zone B is located first in memory. That is because zone B is the default zone in single zone radios. Also notice that in transmit mode, only the MSB of the address gets set. The transmit addresses are offset from the receive by 80h.

The last 8 locations in each memory block are not programmed, due to the use of a 12 position frequency switch (instead of 16 position).

Note that this data is valid for the UHF radios. I think the VHF radio PLL data will be slightly different because there is a range control bit for the VCO. My guess is the MSB of the PLL A word that was set to 1 for UHF functions as the VHF range control bit.

REEF

Manual Programming Procedure For MX300-S Code Plug

The following information was located in an old Motorola manual somewhere, and as you can see, it is very close to what was discovered by experimentation (method above). This procedure should provide the necessary info for programming both VHF and UHF radios.

Procedure for calculating frequency data and addresses for SSU/SXU series MX radios.

The basic theory behind the frequency synthesizer is to divide down the carrier frequency and compare it to a reference frequency, continually adjusting the carrier unit it matches the reference. The carrier, therefore, is the reference frequency times the divide ratio; and we can select a specific carrier by choosing the appropriate divide ratio.

To find the divide ratio, Nt, take the carrier, less the IF or offset frequency, and divide by the reference frequency. Two reference frequencies are available in the MX: 5.0kHz and 6.25kHz for VHF, and 10.0kHz and 12.5kHz in UHF. Choose the reference frequency so that Nt is an integer (if either reference will work, choose the higher).

The divide ratio is stored in the PROM as 2 bytes of data, Np and Na. Np is the quotient of Nt divided by 80, and Na is the remainder. If Na is 0 then subtract 1 from Np, and make Na be 80.

Np must fall into one of two possible ranges, R1 or R2.

Make a note of which range, then divide Np modulo 128 to get a value between 0 and 127.

Convert Np and Na to binary.

If reference was 6.25 or 12.5, set the MSB of Na to 1, otherwise, clear the MSB to 0. If Np was in range R1, clear the MSB of Np to 0, otherwise set the MSB to 1.

As an example, here are the calculations for a frequency of 162.7875 on receive:

Note that Np falls in R1 - then Np MOD 128 = 26

Now Na in binary is 0011 1110. We used 6.25 reference, so set the MSB = 1, giving 1011 1110 or BE in hexadecimal.

Np in binary is 0001 1010. Np fell in R1, so we should leave the MSB = 0. Np is therefore 1A in hex.

The data for a frequency of 162.7875 is Np=1A, and Na=BE.

Each channel has two bytes for receive and two for transmit, with Na being the first byte, and Np being the second.

For receive, the address corresponding to a channel is calculated by:

This is the address of the Na byte, and the following address is Np. Transmit frequencies are calculated by the same formula, plus 128.

Note that addresses FD, FE, and FF (which correspond to channels D15 and D16 transmit) are programmed with test data when the modules are assembled, and address FC is programmed with data indicating band, IF, offset, and reference frequency used to calculate the data programmed into the module - FF indicates a standard VHF radio, while FE indicates a standard UHF radio. None of this makes any difference to the operation of the radio, but if you read the module in an EPROM reader or similar, be aware that it will say "not blank" unless you skip these addresses.

If you are looking for a spreadsheet with all the values for all the frequencies, download this file and take a look.

Bandsplit Conversion

For an MX, the frequency dependent parts are the TX filter, the PA, the pre-selector, the VCO, and of course the channel elements. (Assuming this is an element model. If I remember rightly, all R models are synthesized but there may be "conversions" which consisted of an element controlled radio in an R housing. I expect you have a "normal" R model.) And yes, you will probably need to change the offset oscillator, but not if the radio is synthesized.

All synthesized MX radios use a 3.600000MHz oscillator element which you don't change. But if it's an element radio, depending on what desired offset you want, you may need to change it, anyway. In the case of operation in the 440-470 band, the normal offset is 5 MHz which requires a 26.4MHz offset element. (Add your offset to the IF frequency, usually 21.4MHz, to find out what you need.)

It's not unusual to find out that you don't really NEED to change out some of the frequency dependent components. Some of them are very tolerant of bandsplit changes and if you have a good bag of parts to select from, you can get amazingly wide band ranges. We know of a VHF 48 channel MX built years ago that would tune, lock, transmit, and receive over a 24 MHz range, and IN SPEC, no less, when no frequency dependent component in the radio was designed to work over more than a 12 MHz split! It ended up using mid-split (150.8 to 162) parts all thru it from 144MHz to 168MHz and it was (and still is) a reliable radio. Similar success may be had with UHF models as well.

While you're at it, you might consider upgrading your radios to 48 channel capacity. It takes only a few parts and is well worth the time.

Home