Today's Messages (OFF)  | Unanswered Messages (ON)

Forum: Radio Mods
 Topic: Yaesu FT-10 Extended Transmit Mod for 140-174MHz use
Yaesu FT-10 Extended Transmit Mod for 140-174MHz use [message #32] Wed, 14 December 2005 00:06
root  is currently offline root
Messages: 145
Registered: December 2004
Senior Member
  1. Remove antenna and battery.

  2. Locate the Ni-Cd battery sticker on the back of the radio chbassis. Pry up the corner of the sticker and peel it off carefully.

  3. Remove the two screws located under the sticker. These retain the keypad.

  4. Slowly lift off the keypad. Use care not to dislodge the gasket.

  5. Locate and unsolder the 0 ohm chip resistor at location "M" (see diagram below).

  6. Re-install keypad with two screws. Be sure gasket is properly seated.

  7. Replace the Ni-Cd sticker if desired. Reattach battery and antenna.

  8. Press down and hold the Top-Notch and Lamp button while turning the radio on.
   | knob |
 +---------------------+
 |  +---------------+  |
 |  |  LCD Display  |  |
 |  |               |  |
 |  +---------------+  |
 |  -----------------  |
 |  -----------------  |
 |  -----------------  |
 | (on/off) ---------  |
 |                     |
 |  +---------------+  |
 |  |    Ribbon     |  |
 |  |    Cable      |  |
 |  |    ||||||     |  |
 |  |  o         o  |  |
 |  |         ::    |  |
 |  |           #:  |  |
 |  +---------------+  |
 +---------------------+
# = Lohoneyion "M", chip resistor to remove
The board may actually has an "M" near the correct resistor.

[Updated on: Wed, 14 December 2005 00:12]

 Topic: Icom 32AT Open Transmit for VHF & UHF
Icom 32AT Open Transmit for VHF & UHF [message #21] Sun, 03 July 2005 23:51
root  is currently offline root
Messages: 145
Registered: December 2004
Senior Member
MODS FOR ICOM 32AT

1. Remove battery and antenna.
2. Loosen two screws on top of unit as much as possible without removing them.
3. Loosen 4 flat head screws on bottom of unit 1 turn.
4. Loosen 2 screws near PTT switch 1 turn.
5. Remove 4 black screws on back of unit.
6. Lift bottom of front cover .25 inch, slide it down .25 inch, then lift front cover up 1 inch.
7. Disconnect plug on 4 wires coming from the speaker.
8. Lay front panel on table up-side down being careful of the flex circuit.
9. All mods are done to the back of the front panel. Notice places for 5 axial diodes, which I will call 1 through 5, 1 being nearest the display. Add/remove diodes so there are diodes in positions 3 and 5. This will open up receive coverage for VHF & UHF and enable keyboard entry of the 10 MHz digit.
10. Notice 4 surface mount resistors slightly left of center directly above the speaker, lined up in a row. Solder the anode (the side without the bar) of two diodes to the right side of the lower of the four caps. Now find the CPU. It\'s the PGA under the shield near the top of the board. Find the row of pins on the CPU nearest the speaker. Notice the the 8th pin from the right has a thicker trace coming from it. Now notice that there are small solder pads about .25 inch toward the speaker on both the fat trace and the two traces to the right of it. Solder one each of the cathodes of the 2 diodes to the solder pads on the two smaller traces. This will open up the transmit for VHF & UHF.
11. Put unit back together in reverse order.

This procedure worked for my unit (and many others), but I can\'t guarantee it will work for yours.

Bill Pherigo
WR0Y
 Topic: Special Buttons on IC706mkII
Special Buttons on IC706mkII [message #17] Sat, 26 February 2005 16:00
kc2nda  is currently offline kc2nda
Messages: 29
Registered: December 2004
Location: New Paltz
Junior Member
I have tried some special buttons on IC706mkII:

Push TS and DISPLAY while power up and you will see a strange power on check.

Push P.AMP/ATT and RIT/SUB while power up and you will be able to see SHIFT-ADJ on your 706mkII. Dont know what this is for, recalibrating ?

I think that these things even works on the older version of 706, dont know.

73 - Dennis, SM6WXO @ SM6JZZ
 Topic: More talk power on SSB from your Icom 706Mk2/Mk2G and Alinco DX70TH
More talk power on SSB from your Icom 706Mk2/Mk2G and Alinco DX70TH [message #16] Sat, 26 February 2005 15:58
kc2nda  is currently offline kc2nda
Messages: 29
Registered: December 2004
Location: New Paltz
Junior Member
The following adjustments are to increase the average talk power on SSB for the above radios. If your radio is still under warranty, check with your supplier to ensure warranty will not be invalidated



For both these adjustments you will need a very small cross-point screwdriver and a steady hand! Do not proceed if you are not confident!



Alinco DX70TH: Turn up the microphone gain as detailed in the manual. This should be set to maximum. The adjustments described here is concerned with the ALC control. ALC action is indicated by the TX light which should glow brighter when speaking into the microphone.

Remove the top cover and locate the high power/50w switch (this switch location is detailed in the manual, it is the only switch visible under the top cover). To the left of the switch there should be a small pot which is for the ALC. Just above the pot printed on the circuit board is 100w. Set the radio to 28Mhz and while speaking into the mike turn the pot counter clockwise until the TX light just fails to glow brighter. Back off slightly to restore the increase in brigthness of the TX light while speaking into the microphone. Replace the top cover.

This adjustment increases talk power considerably and for local contacts on SSB the compressor should be switched off.

Icom 706Mk2/Mk2G: The Icom 706 series are notorious for low talk power on SSB. A simple tweek of the ALC can solve the problem. This procedure was published in Radcom July 1999 but is updated here to include the IC706Mk2G. As far as I can ascertain, the later model 706MK2G seems not to suffer from the problem of low talk power and this mod may not be necessary. Remove the top cover. At the front edge of the main circuit board (to the left of the crystal filter slots, with the front of the radio facing you) should be a small pot. In the 706Mk2 this is R511 and in the 706Mk2G it is R579 (the number is not actually printed on the board!). The pot may be obscured by printed ribbon. This pot needs to be turned clockwise while speaking into the microphone, with power set to high and microphone gain at 6 (compressor should be switched off). Adjust for maximum talk power.

The article in Radcom claims that this adjustment will bring the 706Mk2 up to 100w pep without the need for the compressor. For the 706MK2G (early models), adjusting R579 can give a dramatic increase in talk power although you will find that you will still need to have the microphone gain turned up to 10 and the compressor switched on. On my own set I have noticed that some bands give more talk power than others. On 160, 80 and 2 meters I get nearly full power by speaking into the mike (gain at max and compression on). However on other bands the increased talk power is not so dramatic particulalry on 10, 20 meters).

Another way to boost the talk power on the 706 series is to use a preamplified microphone. If you do decide on a preamplified microphone reset R511/R579 back to it\\\'s original postion or distortion may result.

 Topic: Icom V8000 MARS Mod - STRAIT FROM ICOM
Icom V8000 MARS Mod - STRAIT FROM ICOM [message #14] Wed, 29 December 2004 01:55
root  is currently offline root
Messages: 145
Registered: December 2004
Senior Member
Here is the Icom MARS modification that I requested from the manufacturer and had to show proof of MARS licensing. They sent me this picture in the form of a PDF. I zoomed it in a lot so you could see it. In the picture the diode is removed. You can cut the solder leads with a razor or thin knife.
 Topic: IC-746 improved AGC and weak signal volume
IC-746 improved AGC and weak signal volume [message #13] Wed, 29 December 2004 01:47
root  is currently offline root
Messages: 145
Registered: December 2004
Senior Member
In the service manual under 5-4 RECEIVER ADJUSTMENT.

For setting the RECEIVER TOTAL GAIN.

Part 1 follow as written.
Part 2, set R761 for 178mV (-15dB).

This gives a better(lower) AGC knee signal level and during weak signal reception maintains good volume level without having to manually advance the volume control. This is especially useful for Six and Two metre weak signal work.

The noise blanker, general AGC action and S meter calibration were not adversely affected.
 Topic: IC746:Using 500Hz filters on SSB for Dig Modes
IC746:Using 500Hz filters on SSB for Dig Modes [message #12] Wed, 29 December 2004 01:45
root  is currently offline root
Messages: 145
Registered: December 2004
Senior Member
Hi there!

I ran usually my old TS440S-AT with 500Hz IF filters on USB mode for the Pactor lev 1 and 2, and for PSK31 very weak signals.
Some week ago I found in a Ham fair an FL100 CW filter for the IC746 at a bargain price, and in the last days it happened to me to have some time to devote to our hobby, and so I installed the 9 Mhz IF filter for 500Hz, FL100, on the IC746 for pactor 1 and 2 and psk31, as I am used to.

I followed the instruction on page 78 of the ICOM user manual.
After returning all the covers on, I went to page 60 of the instruction manual, to select the installed filter for the 9MHz-1 position.
I selected the FL100 . Then I went on page 42 for filter program mode setting as suggested on the page 60.
Note on the top of page 42, at the beginning of the chapter 5-11, 1st paragraph: \" Optional filters ....omissis...
.. Filters can be independently selected for each operating mode.\"
And so I went to program mode setting and pushed the \"filter\" button for 2 seconds and then choosed to program the CW and the SSB-Narrow for 9M on 500Hz and 455k for 2.4 k ..... but - surprise - the FL100 was not available on SSB!

I suspiciously read carefully the manual and find nothing on selecting filters depending from mode choosen..... or relation between filter type and/or bandpbass sensing... nothing. So I went to the usual \"dirty trick way\" to gamble with the filter program mode setting: I told the IC746 that the installed filter was an SSB Narrow 1.9kHz one, the FL223 type. All OK , hi hi ....

Then I went again on the procedure of page 42, and set the SSB-N filter mode for 9M \"1.9 kHz\" (hi!) and 455k at 2.4kHz.

It runs OK having now bandpbass of 500Hz on SSB-N mode available for Pactor lev1 and lev 2, and PSK31. On the TS440SAT I had to correct for the IF filter frequency moving the IF bandpbass slightly clockwise to fit it for the selected tone pair (1200-1400 Hz or 1400-1600 Hz) and the same had to be done on the IC746: selecting as usual USB I had to tune the outer larger one of the twin bandpbass tuning about 90 degrees clockwise.
This proved to be quite a god setting for operation on USB Pactor level 1 and 2 using high tones.

I tested some lower tone pair compatible with the CW bandpbass (but take care of the CW Pitch setting!!! it should be tuned fully clockwise or you\'ll get no audio out!) and tested with 400-600Hz, 500-700Hz and 600-800 Hz , but although the PtcII controller I use is very versatile on this respect, my ears are not, and so being used to \"by ear search and pre-tuning\" and then \"spectra fine tuning\" I endly went back to the usual 1500 Hz center frequency. I got 1500 Hz as I am also using pactor level3; before it I was using 1300 Hz center.

Here people using other controllers like KAM+ or alike have to adjust their bandpbass tuning depending on the tones frequencies they use.

Actually I have not yet the FL52A 500Hz 455kHz filter; if I\'ll find it at bargain price I\'ll buy it and test it;
I saw by now that having 2.4 kHz bandpbass on 455 kHz works.

I have to say that apart from this test and related trick to get the 500Hz bandpbass for USB digital RX, I would not suggest asnecessary to buy and install such filters on the IC746 : with the PtcII controller you may work very well on pactor, psk31, rtty and other 500Hz bandpbass modes on the IC746; (do not use the DSP and or NB, NR sometimes\'s good, some others no)

The same applies for the soundblaster software programs like Digipan or others, the normal bandpbass is more than adequate, and you may taylor it using the twin bandpbass tuning.

I recommend the narrow filters on TS440sat and alike: more,I suggest on them to replace also the 455kHz filters with other that have better performances (IN-RAD has some good ones) and the old good TS440S will copy nicely and happily very low level digital signals.

I hope this notes will be useful for some reader, I will appreciate any feedback on this matter.

Thanks and 73 de I2JJR Augusto
 Topic: IC-746 Backlight Repair
IC-746 Backlight Repair [message #11] Wed, 29 December 2004 01:44
root  is currently offline root
Messages: 145
Registered: December 2004
Senior Member
Here you go guys, here is the repair mod for the backlight.

Remove top and bottom cover.


Remove the 4 screws holing on the face, 2 on left and 2 on right of face holding it to chbassis. Theres 1 ribbon cable connecting the face to main unit, just pull strait out.


Remove knobs just by pulling them off. VFO just pulls off also.


Unplug all ribbon cables on back of face, number them with a permanent marker if you think you might mix them up.


There is 5 screws holding the top circuit board in, take them out and lift up board, be carefull and feed 2 of the ribbon cables through the board. On the back side of this board there are 2 steel boxes on the board. Take the top off of the biggest one.
You will see a small square transistor with the #B1201 on it. This is the problem transistor thats been giving backlight problems.

This transistor has no way of cooling laying flat on the board.remove this at your own risk. You have to have a small tip iron and a good set of eyes and steady hands. The center leg on the transistor is cut off, this is the ground leg, and the top of the trans is soldered to the board.

Heat the top of the transistor and lift it and it will come loose,then unsolder the legs and lift. Remember which way it came out. Take the new trans and don\'t cut the center leg off, the center leg needs to be soldered where the top of the transistor was soldered. And the other 2 where they were from the start, leaving the part standing up instead of laying flat on the board.

Now push the transistors side against the metal box and put some heatsink compound around the transistor and between the part and box, now it can keep cool.

Thats it, put the top back on and put the unit back together. Replacment part #s are NTE2525 or 2SA1244 or 2SB1201, good luck and take your time.

Works well
 Topic: IC-746 modulation on AM
IC-746 modulation on AM [message #10] Wed, 29 December 2004 01:43
root  is currently offline root
Messages: 145
Registered: December 2004
Senior Member
If you want more crisper and louder modulation on AM, turn radio upside down and remove cover at the top right hand corner of radio you will see a varible that says (AM mod). Clockwise increases mod and counter clockwise decreases mod. You might want to use another radio on the same frequency so you can hear results. The radio that you are listening with needs no ant screwed in to it being that you are only listening.

I have done this and mine has loud crisp modulation. Remember, no compression on AM, you will find that it will muffle you on AM.

Do at your own risk.

73s
 Topic: Monitor Audio Output Too Low Icom IC-746
Monitor Audio Output Too Low Icom IC-746 [message #9] Wed, 29 December 2004 01:43
root  is currently offline root
Messages: 145
Registered: December 2004
Senior Member
The monitor function on the IC-746 tends to have low output compared to receiver AF volume, therefore in order to listen to yourself, you have to increase the volume. When the PTT is released back to receive mode, the AF setting nearly blows your speaker or your headphones.

If the monitor audio output is too low on your ICOM 746, you can add 4.7K resistor in parallel with R1087. This brings up the gain of IC1082 to a more reasonable level that can still be controlled by the monitor level function but with plenty more gain.

Technical Notes:

These SMDs are located in the Main Board. You will probably need a service manual to locate these parts on the main board. Adding modifications to these very small parts requires some skill and a good magnifier together with the appropriate tools. A 1/8 Watt resistor will be suitable for this modification, but still require some precision.
 Topic: Power mod for the ICOM IC-746
Power mod for the ICOM IC-746 [message #8] Wed, 29 December 2004 01:42
root  is currently offline root
Messages: 145
Registered: December 2004
Senior Member
Power mod for the ICOM IC-746
Remove bottom cover.

Find the voice module plug-in.Right behind it you will see 4 pots

R993 144 mhz power adj
R991 50 mhz power adj
R989 HF bands power adj
R990 AM power adj

You can tweak these to up the power suggest on hf doing it on 40 meters. you can get close to180 watts on 40-75 meters about 125 to 150 on 20-10.

The pots are very small be careful not to use something to big. the are all metal pots.

NI4L

[Updated on: Sun, 06 May 2007 12:50]

 Topic: Extended RX/TX for IC-746
Extended RX/TX for IC-746 [message #7] Wed, 29 December 2004 01:41
root  is currently offline root
Messages: 145
Registered: December 2004
Senior Member
Open the bottom cover of the IC-746
Place radio on surface upside down with front to your left.


Find chip label HD6433042SFB24
To the right of this chip (3/4 inch) are two rows of diodes.


14 diodes in the right column and 7 diodes in the left column.

For Icom 746 Radios with the diodes in the 1, 2, 6, 7, 9, 11 and 14 positions, remove numbers 6 and 7 leaving the other 5 in place.
Mod complete.
 Topic: Separating the Tx and Rx lines on 2 meters in the IC746 could not be easier
Separating the Tx and Rx lines on 2 meters in the IC746 could not be easier [message #6] Wed, 29 December 2004 01:40
root  is currently offline root
Messages: 145
Registered: December 2004
Senior Member
Separating the Tx and Rx lines on 2 meters in the IC746 could not be easier.

Put the rig on the bench with the front panel facing towards you, and turn upside down, with the front panel still facing towards you.

Remove the bottom cover.

At back-left there is a 5 inch square metal screening plate held in place by four screws - remove it.

You will see a miniature co-ax plug and cocked, labeled VRX. Simply unplug, tuck the original plug out of the way and plug in a new plug attached to a length of miniature coax, which can neatly leave the rig through the hole on the back panel that contains an earth bolt. Now you have your separate receive input!

You could cut off and re-use the miniature co-ax plug, but I preferred to contact my local Icom dealer and buy a new one (a couple of dollars) - the Icom description is: PLUG TMP-P01X-A1 (Min Coax) IC-125.

73
David, G4YTL

[Updated on: Wed, 29 December 2004 01:40]

 Topic: IC-746 (USA models) All Band TX Modification
IC-746 (USA models) All Band TX Modification [message #5] Wed, 29 December 2004 01:38
root  is currently offline root
Messages: 145
Registered: December 2004
Senior Member
This information is to help clear the confusion about the ICOM IC-746 modification for out of amateur band transmissions. There are a couple of different mods floating around for the IC-746. For USA models, the following information is the ONLY mod for the IC-746! I verified this with my contacts at ICOM. They verified that this was the ONLY modification for the IC-746 (USA model) and that there were NO others. I then performed the modification and the radio transmits from about 100KHZ to 60MHZ and 118MHZ to 176MMZ so be careful with this mod!

Read the following instructions all the way through before performing this mod. Perform this modification ONLY if you feel capable of soldering VERY small surface mount diodes! Do this totally at your own risk.



------------------------------------------------------------ --------------------

Turn the radio upside down and position the front panel to your right. The main tuning knob will be to your lower right and the microphone connector to your upper right. This will orientate the radio in the proper direction to read the parts layout identification silk screening. (Note: the IC part numbers will be UPSIDE DOWN.)

Remove the twelve screws from the sides and bottom securing the bottom cover.

Locate the Circuit board with the Optional IF filters. The filters will be in the upper left hand corner of the circuit board. Look to the lower middle of the circuit board for silk screening that reads “Option UT-102”. (almost the center of the radio) Immediately to the right of the “Option UT-102” silk screening you will see two columns (14 positions in each column) of VERY small surface mount diodes in a tight configuration. I’ll call them diode positions 1-14. This column should have diodes in EVERY position 1-14. The next column to the right is diode positions 15-28. This column should have diodes in positions 15, 18, 20, 22, 23, 27 and 28 as shown below.

[01] [15]
[02] [ ]
[03] [ ]
[04] [18]
[05] [ ]
[06] [20]
[07] [ ]
[08] [22]
[09] [23]<-- Remove this diode only!!!
[10] [ ]
[11] [ ]
[12] [ ]
[13] [27]
[14] [28]

Diode 23 is VERY small and has a small “Y” on top of it. Use the finest pair of tweezers you have to remove diode 23 ONLY! Make sure you remove diode 23 only and NO other diodes! Make sure you have NO solder bridges as the diode pads are VERY small!

Use a clear piece of tape and tape the diode to one of the metal covered cans near the columns in the same orientation you removed it. This way you’ll have your diode to reinstall if you ever feel you need to and you’ll know the orientation of the diode.

This completes the TX modification. Replace the cover and screws.

TX should be from about 100KHZ to 60MHZ and 118MHZ to 176MMZ.

Do this totally at your own risk. Never, transmit out of the ham bands or your privileges.

73

Lyndel, N7LT
Forum: Motorola Mods
 Topic: Motorola Maxar/Moxy 2M Conversion
Motorola Maxar/Moxy 2M Conversion [message #1476] Sat, 01 September 2012 01:21
root  is currently offline root
Messages: 145
Registered: December 2004
Senior Member
By Tom Herman, CETma N1BEC/7

I've always wondered how easy it would be to put the Motorola Maxar/Moxy series radios onto the two meter ham band.

My gut feeling was that it shouldn't be too hard, but any interest was strictly academic because I had multichannel synthesized equipment for 2M. I hadn't had a reason to go ahead and try a conversion until my friend John, KC7OQN, came up with an old radio that he wanted to pop onto 146.52 Simplex. Many thanks to John for the "Guinea Pig", and for ponying up the $30.00 for two crystals.

My philosophy with radio conversions is to do the minimum amount of parts substitution that will give best practical performance. The usual approach is to replace capacitors, and not mess with coils, fragile, or hard to get to parts unless I absolutely have to. K.I.S.S!

The victim was a "Mid Split" (150.8-162 MHz) D23TRA1300AK two channel low power unit. The first order of business was to check out the radio to see if it worked at all on its original channel. It did, and the rocks were ordered from West Crystal in British Columbia. They got here three weeks later, right on schedule.

A quick check showed receive sensitivity was pretty good (~ .23 uV for 12 dB SINAD), but the transmit power was a tad low (4.6 watts @13.8 Volts), but I decided to go ahead with the conversion anyways.

I inadvertently left the unit powered up while I got called away from the service bench to attend to some "honey do's". When I got back, there was the unmistakable odor of burned electronics in the air. The unit was still receiving, but had no transmit.

Checking the circuit board showed a burned inductor (L 106). A closer check revealed this was an effect, and not a cause, and if I had installed another part, it would have burned up as well. The ultimate problem was a dead short on the other side of L 106: C 130, which turned out to be a .05 uF/25 volt tantalum capacitor.

It's fairly common for the Tantalum caps in the Moxy/Maxars to go critical, so a good S.O.P. is to leave a potential candidate unit powered up on a current limited power supply in a well ventilated area to see if the caps will hold up or not.

Fortunately, I have a small mountain of UHF Maxar/Moxy's, and since the exciters are practically identical to the VHF??????s, they became a valuable source of parts and quickly got the D23 going again.

Original operating frequencies were about 158 MHz TX, and 152 MHz RX. The old crystals were removed, and the '52 rocks installed. I elected to do the transmitter conversion first. The plan was to try to just align the unit, and if that worked, to go through afterwards and mop up any circuits that needed optimizing.

Keying up, I spotted the fundamental and triple of the oscillator, and zeroed the tripled signal on frequency.

L 102 and L03 are tuned first, while metering M3. L 102 tuning is quite sharp, L 103 a bit broader.

There was no L105 M5 reading, so M3 was tuned for a dip when adjusting L 105. The tuning was broad.

L 107 and L 108 tuned broad, then the PA was adjusted. Power output screamed to 14 watts! (I assume that the lower output prior to conversion was due to a partially shorting C 130 pulling down the B+ going to the tripler stage).

The tuning of L 105, L107, and L 108 were not optimum, the cores being bottomed out on the circuit board or close to it. (Managed to break the L 105 core, parts car to the rescue again!)

Check out the following table for the parts that needed to be changed out:
Range
Inductor AffectedCapacitor ChangedHighMid"Low"
L 105C 127434756(Note: all capacitances in pico-Farads.)
L 107C 1316810
L 108C 13481015


With the new capacitors installed, all three cores tuned well towards the center of the slug form. Power was then backed down to ten watts even. Don't try going to 12 pF for C 131, 10 is ideal.

The receiver was a most pleasant surprise! Without doing anything other than dropping the crystal in the right slot and centering it on frequency, it gave 12 dB SINAD at 1.75 microvolts! Further tuning was done, and the radio dropped to a stunning .25 microvolts 12 dB SINAD with no parts replacement. No conversion was necessary on the receiver.

[Updated on: Sat, 01 September 2012 01:22]

 Topic: Mitrek High Split to 6M Ham Band Conversion
Mitrek High Split to 6M Ham Band Conversion [message #1039] Sat, 15 October 2011 04:57
root  is currently offline root
Messages: 145
Registered: December 2004
Senior Member
11-02-03

By Tom Herman, CETma N1BEC/7

Here are the parts that need to be changed out to make the Motorola Mitrek operate well on the Six Meter Ham Band.

The criteria here was to make the conversion as easy as possible, and to do this by changing out capacitors only, and just as many as are actually needed for good operation.

Possibly other parts could be changed out, but the following list will get you the best performance for the least grief!

Do yourself a favor, and use a good, hot soldering iron. To do this conversion, a number of coil shields must be removed, and some of the parts are soldered onto fairly substantial groundplanes.

Also, if you do not solder the cans back on well, you will wind up with annoying intermittents!

After re-tuning, the Mitrek in question gave me the rated power of 50 watts, and good receiver sensitivity.

Transmitter:

Part #        Orig. Value   6M Value    Notes:
C 701         16 pF             12 pF   Watch soldering on cans of L 701- 
C 703         24 pF             20 pF   L 705: Very Hi Q circuits! Poor
C 704        150 pF            120 pF   Soldering will cause erratic TX
C 707         33 pF             24 pF   power!
C 710         22 pF             15 pF
C 712         22 pF             15 pF
C 713         27 pF             20 pF

Receiver:
Part # Orig. Value 6M Value Notes: C 166 100 pF 80-90 pF Rx picked up 0.05 uV sens. Tunes C 101 30 pF 15 pF much better after conversion! C 104 22 pF 15 pF C 106 22 pF 15 pF C 108 22 pF 15 pF C 110 22 pF 15 pF
Good Luck and have fun!

-Tom
 Topic: Motorola HSN1000A
Motorola HSN1000A [message #1034] Tue, 11 October 2011 15:35
root  is currently offline root
Messages: 145
Registered: December 2004
Senior Member
How to modify a Motorola HSN1000A amplified speaker for use with other radios, scanners, etc. Obtain a Molex # 0003061061 or 0003061062 female connector. Looking at the end of the female connector with the beveled corners to the left and the two triangular notches to the right, the pins are as follow:

upper left: audio ground

upper right: audio in

middle left: +13.8 volts

middle right: power ground & external speaker ground

lower left: external speaker out

lower right: internal speaker in

Connect a 1/8' (3.5mm) mono mini phone plug across the primary winding of an audio transformer. Connect the secondary winding of the audio transformer across the audio in and audio ground pins on the Molex connector.

Plug the mono mini phone plug into the headphone jack of your audio source. Connect power across the +13.8 volt and power ground pins on the Molex connector. Also connect the power ground pin on the Molex connector to the sleeve connection of a 1/8' (3.5mm) mono mini phone jack. Connect the external speaker out pin on the Molex connector to the tip connection of the mono mini phone jack. Connect the internal speaker in pin on the Molex connector to the normally closed connection on the mono mini phone jack. Plug an external speaker into the mono mini phone jack if you wish to use one or leave the mono mini phone jack unplugged to use the speaker inside the Motorola HSN1000A.

If you always want to use the internal speaker of the Motorola HSN1000A, you can simply jumper the external speaker out pin to the internal speaker in pin and leave off the mono mini phone jack. If you want to use the HSN1000A with a handheld radio having its own power source (e.g., batteries) isolated from the power source for the HSN1000A, then the audio transformer is optional. Ideally, the audio transformer would have 8:8 ohm winding impedance, but I used a 600:600 ohm transformer that can easily be scavenged from an old telephone modem or bought at Radio Shack, if they still carry item # 273-1374.

If you want to connect the HSN1000A to an audio source with a stereo output, simply use a 1/8" (3.5mm) stereo mini phone plug instead of a mono mini phone plug and connect only the tip and sleeve connections, leaving the ring connection unconnected.

 Topic: Syntor X Amateur Conversion (2M)
Syntor X Amateur Conversion (2M) [message #309] Thu, 20 January 2011 00:38
root  is currently offline root
Messages: 145
Registered: December 2004
Senior Member
I have found the Syntor to be a relatively inexpensive easy to convert radio for 2 Meter amateur use.

The EEPROMS used commonly in the orange label memory module are 2816A(28C16)devices normally supplied by SEEQ and have no markings on the top of the package.

There is a more rare version that has a white label and it uses a unique one time burned prom. Best bet if you encounter one of these would be to upgrade to the orange label module but there are a couple of devices on the personality board that are not compatible with the faster memory module Motorola document 68-80100453 explains this in depth if you have access.

The PROMS are easily programmed using a commercial EPROM programmer that supports the 2816 device I use a Pocket Programmer from Transtronics and it seems to work fine. There is software available that allows the image to be generated and loaded to the programmer which in turn programs the memory. module.pbenett@macnet.com is an excellent source for the software.

VCO modification may be needed in some cases for general ham use the solder jumpers on the VCO board need to be soldered together where the factory tuning cut was made as that will add the necessary capacitance to allow the VCO to lock on the new frequencies. If the unlock led located near the RF board is glowing constant when PTT is applied or in RX most likely the VCO will need modification or the software did not dump the data to the programmer correctly.

Beware I have ran into some freeware software that may have possibly used the wrong algorithm which resulted in incorrect code plug data even when the software reads correctly.

Good Luck with the mod.
kg4muc

[Updated on: Thu, 20 January 2011 00:49]

Forum: Radio Equipment
 Topic: FS Icom PW-1 1KW Amp & ICOM IC-756PRO III #MINT
FS Icom PW-1 1KW Amp & ICOM IC-756PRO III #MINT [message #1509] Fri, 12 October 2012 11:05
james2e0rum  is currently offline james2e0rum
Messages: 3
Registered: October 2012
Junior Member
Icom PW-1 1KW Amplifier
S/N-02319, this amplifier is in excellent condition! 10/12 meter mod done.
Includes original box, cables and manuals.
Must be a licensed amateur, this will be verified.
Feel free to email with any questions.
COSTS $1800usd
Email :james2e0rum@yahoo.com



Mint ICOM IC-756PRO III in PERFECT FULL working condition and MINT cosmetics. If has been kept with cover (included) and comes with original box, cables, fuses, etc as new. I have used this radio for a while, and it puts out FULL output and absolutely everything work as it should. I can provide pictures and we can talk on 40 meters.
Costs: $1200usd

Contact : Mr. Jack
Email : james2e0rum@yahoo.com
2e0rum
73
 Topic: FS:Icom PW-1 1KW Amplifier AND KENWOOD TS-950SDX.
FS:Icom PW-1 1KW Amplifier AND KENWOOD TS-950SDX. [message #1274] Thu, 23 February 2012 17:44
2w0cdz73  is currently offline 2w0cdz73
Messages: 1
Registered: February 2012
Junior Member
Icom PW-1 1KW Amplifier

S/N-02308, this amplifier is in excellent condition! 10/12 meter mod done.
Includes original box, cables and manuals.
Must be a licensed amateur, this will be verified.
Feel free to email with any questions.
COSTS 2000USD

CONTACT:Mr. Paul G
EMAIL :paul2w0cdz@gmail.com


KENWOOD TS-950SDX

KENWOOD TS-950SDX in excellent condition both electronically and cosmetically. Radio is a late production with serial number in the 90 million range. Non-smoker. Operating manual, hand mic, color sales brochures, and Service Manual (on CD) are all included.
COSTS 1200USD

CONTACT:Mr. Paul G
EMAIL :paul2w0cdz@gmail.com

  • Attachment: Ken.jpg
    (Size: 39.46KB, Downloaded 746 time(s))

 Topic: Rohn 100ft SS Tower
Rohn 100ft SS Tower [message #214] Fri, 06 November 2009 09:16
MONKEYWRENCH  is currently offline MONKEYWRENCH
Messages: 1
Registered: November 2009
Location: Houston
Junior Member
I have two disassembled Rohn 100 ft towers for sale. Built 09/2004. $5000 each.
 Topic: yaesu ft-411e handheld for sale
yaesu ft-411e handheld for sale [message #180] Thu, 18 September 2008 03:39
tazmaniadevil  is currently offline tazmaniadevil
Messages: 1
Registered: September 2008
Location: stilesville,indiana
Junior Member

make me an offer

 Topic: Nokia N95 8GB @200usd
Nokia N95 8GB @200usd [message #172] Sun, 27 April 2008 12:46
lewmab9  is currently offline lewmab9
Messages: 8
Registered: October 2006
Junior Member

http://www.ukdata.com/creditreports/viewCompanyDetails.do?co mpanyId=02581567

Company Details - ELECTRONICS WORLD (UK) LIMITED

Address:LOWERHILL HOUSE FARM, LOWERGATE ROAD,

ACCRINGTON, LANCASHIRE,

BB5 6LN,UK.

Registered No.02581567


We sell a wide range of products. Nokia , Motorola , Samsung , Sony Ericsson , Nextel , Siemens s. Digital Cameras , Nikon Camera, Canon Camera. Games , Xbox 360 , NIntendo , Play Station 2 , Sony PSP's , GBA. PDA.Pocket pc Tomtom Go 700 , Tomtom Go 600 and Tomtom Go 500 Ipods Nano , Ipod Mini , Ipod Shuffle. Laptops/Notebook.and many more, All our product are brand new,
1. Complete accessories(Well packed and sealed in original company box)
2. Unlocked / sim free.


3. Brand new (original manufacturer) box - no copies
4. All phones have english language asdefault
5. All material (software, manual) - car chargers - home chargers - usb
data cables -holsters/belt clips - wireless headsets(bluetooth) -
leather and non-leather carrying cases - batteries.

If you are interested, forward your questions and enquires to us via
email with your order and shipping details. we give 1 year warranty for
every product sold out to our costumers, our product are company class
1 tested and approved by global standard organization of wireless
industries, Brand new merchandise with complete accessories, extra
charger
and battery.serious buyers should.
Contact us on:

E-mail;ectronics2008@yahoo.com

chrismobilelimited@outgun.com

Alexelectronics2008@yahoo.com

Best Regards,
Williams
447011139058,
 Topic: selling gear,
selling gear, [message #143] Tue, 02 October 2007 13:07
blacksheep  is currently offline blacksheep
Messages: 1
Registered: October 2007
Location: midwest
Junior Member
Yaesu FT-847 great condition, 650.00

Ameritron AL-80B 700.OO

Icom-272OH 150.00

Bird meter (43uhf) 215.00

All items are in original packaging with proper paper work, also owned by a non smoker.

Have other stuff and will list later.
 Topic: trans radio
trans radio [message #92] Mon, 18 December 2006 18:43
jokster5982  is currently offline jokster5982
Messages: 2
Registered: December 2006
Junior Member

trans diamond radio model 60 23 upper lower asking 350
 Topic: Kenwood TH-22AT
Kenwood TH-22AT [message #72] Tue, 22 August 2006 13:47
Arben  is currently offline Arben
Messages: 1
Registered: August 2006
Location: Tennessee
Junior Member
I have a Kenwood TH-22AT handy talkie for sell. Please visit
http://www.steveholder.com/radio.html for details.

.
 Topic: 2 GE BASE UNITS
2 GE BASE UNITS [message #71] Mon, 31 July 2006 01:02
MOTOROLA2006  is currently offline MOTOROLA2006
Messages: 1
Registered: July 2006
Location: CAMBRIDGE
Junior Member

FOR SALE IS 2 GE BASE UNITS
1 IS A GE MASTR EXECUTIVE 2 WORKS GOOD CLEAN CURRENTLY INSTALLED
CHANNEL 1 RX 463.950 TX 468.950 PL 131.8
CHANNEL 2 RX 464.950 TX 469.950 PL 131.8
CHAN 3,4,5,6,7,8 NOT INSTALLED
COMES WITH MIC THIS UNIT IS 40 WATTS ETC


1 GE TRUNKED DESKTOP STATION 110WATTS COMES WITH MIC ETC
CHANNEL 1 RX 146.300 TX 147.300 PL 127.3
CHANNEL 2 RX 147.650 TX 148.650 PL 127.3
WORKS GOOD USED ONLY FOR 2 YEARS GOT NEW EQ



(MAKE OFFER)
 Topic: HTX-212 2Meter Radio Shack Mobile
HTX-212 2Meter Radio Shack Mobile [message #4] Wed, 29 December 2004 00:24
n2nys  is currently offline n2nys
Messages: 2
Registered: December 2004
Location: Hyde Park, NY
Junior Member

HTX-212 2Meter Radio Shack Mobile - seller is opting out - busniness matter closed - found use for it in house - sorry - Dave

[Updated on: Fri, 09 September 2005 19:24]


Dave Bogdan
N2NYS (Formally KB2ZUH)
Entertainment Technician &
Computing Advisor
http://www.n2nys.com
n2nys@optonline.net
n2nys@n2nys.com
Home & Cell: 845-242-6653
\\\\\\\"God puts us all in each other lives for one reason or another. Some people come into our lives, stay a while, leave footprints on our hearts and we are never, ever the same\\\\\\\"
Forum: Kenwood Mods
 Topic: Kenwood TH-K20A - MARS / CAP TX Modification
Kenwood TH-K20A - MARS / CAP TX Modification [message #1396] Thu, 05 July 2012 01:19
root  is currently offline root
Messages: 145
Registered: December 2004
Senior Member
This modification is provided "as is," and is subject to change without notice. The author makes no warranty of any kind with regard to this modification procedure. The author shall not be liable for any error or for incidental or consequential damage in connection with the furnishing, performance, or use of this modification procedure.

It is illegal to operate outside the limits of your class license or permits.

Procedure for the Kenwood TH-K20A Mars Mod:

Turn off the transceiver and remove the battery pack.

Remove the antenna, channel selector knob, and volume knob.

Remove the Side Jack Accessory Cover.

Remove the two screws from the bottom of the radio on the back side.

Carefully lift the front panel up from the chassis, starting at the bottom of the radio. Be careful not to damage the speaker wires as you're opening the radio.

Locate and carefully remove the Diode reference D from the TX/RX unit - (see Figure 1).

Assemble the transceiver.

Reset the radio.
Press and Hold the F Key While Turning the Radio On
Release the F Key
Use the Channel Knob to Select Full Reset (FL.RST)
Press F then Press F Key Again to Confirm Reset

Transmitter Operating Range: 142 ~ 151.995MHz

KENWOOD TH-K20A – Full Extended TX Modification

This modification is provided "as is," and is subject to change without notice. The author makes no warranty of any kind with regard to this modification procedure. The author shall not be liable for any error or for incidental or consequential damage in connection with the furnishing, performance, or use of this modification procedure.

It is illegal to operate outside the limits of your class license or permits. Procedure:

Turn off the transceiver and remove the battery pack.

Remove the antenna, channel selector knob, and volume knob.

Remove the Side Jack Accessory Cover.

Remove the two screws from the bottom of the radio on the back side.

Carefully lift the front panel up from the chassis, starting at the bottom of the radio. Be careful not to damage the speaker wires as you're opening the radio.

Locate and carefully remove both Diodes reference C & D from the TX/RX unit - (see Figure 1).

Assemble the transceiver.

Reset the radio.
Press and Hold the F Key While Turning the Radio On
Release the F Key
Use the Channel Knob to Select Full Reset (FL.RST)
Press F then Press F Key Again to Confirm Reset

Transmitter Operating Range: 136 ~ 173.995MHz

Caution: This modification requires soldering equipment rated for CMOS type circuits. It also requires familiarity with surface mount soldering techniques. If you do not have the proper equipment or knowledge, do not attempt this modification yourself Seek qualified assistance.

index.php?t=getfile&id=58&private=0

Forum: PIC Microcontrollers
 Topic: Arduino Uno32 Bootloader Reprogramming
Arduino Uno32 Bootloader Reprogramming [message #985] Mon, 05 September 2011 20:29
root  is currently offline root
Messages: 145
Registered: December 2004
Senior Member
Some Ardruino boards were shipped with bad bootloaders. When you try to burn a new program, the programmer will throw an error like this:

avrdude: verifihoneyion error, first mismatch at byte 0x0000
0x0c != 0xff
avrdude: verifihoneyion error; content mismatch

Many people are having these problems with these boards. If you are having these problems you need to burn a new bootloader.

Connect to the Uno32 with a terminal program (like puttytel). Set the baud rate to whatever COM port the Uno32 is connected to and use 115200 for the baud rate. As soon as you connect, type !!! and then you should see something like this:

!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!
Explorer stk500V2 by MLS V1.0
Bootloader>

Then type ? (question mark)

Bootloader>? CPU stats
Explorer stk500V2 by MLS V1.0
Compiled on = Apr 24 2011
CPU Type = 32MX320F128H
GCC Version = 3.4.4 Microchip MPLAB C Compiler for PIC32 MCUs v1.11(A)-2010050 4
DEVID = 5090A053
Bootloader>


You will see the compile date.. This bootloader in this example was bad.

After the new bootloader was burned (file is attached). The problem should disappear. You must cycle the power. If you connect the Uno32 again with a terminal you will see the new compile date.

How do you reprogram the Arduino Uno32 bootloader?

This is a good question. There isn't anything that has a very good documentation for doing this. Some posts may tell you to return the board. If you can't understand the following, then it would be better to send the board back. BUT, this type of thing should really be learned if one isn't sure how to do this.

First the Arduino Uno32 board that was purchased, didn't have any pins installed (soldered) on the board for the ICSP section. You must take solder a 6 pin header to the board in order to use it.. I do not know why they didn't come with it in the first place. You can get header pins from Mouser or Digi-Key.

Then you will need a programmer that will program via the ICSP. A PICkit 2 in this case was used to reprogram the bootloader. A 12V power supply (doesn't need 12V, 9V will probably do just fine) was used to power the Arduino Uno32 board while this was being accomplished. If you don't power the Uno32 board, you will probably be drawing too much current for both the PICKit and the Arduino board. Hooking them in series to program will fail. The PICkit software will throw an error message saying the voltage is too low or wrong as soon as you load the program.

Open the PICkit software while the equipment is hooked up, load the hex file and burn! The Uno32 board needs to be restarted when completed. This should complete the process. If you don't have a PICkit, you can use any other programmer than has an ICSP port.

Hope this helps anyone that is having problems with their Arduino Uno32 boards... It isn't so intuitive and there isn't very much supporting documentation for it...
Arduino Uno32 ICSP
Arduino Uno32 ICSP

[Updated on: Mon, 05 September 2011 20:33]

 Topic: PIC Assembler Directives
PIC Assembler Directives [message #80] Sun, 01 October 2006 20:03
kc2nda  is currently offline kc2nda
Messages: 29
Registered: December 2004
Location: New Paltz
Junior Member

PIC Assembler Language Directives



Assembler directives are instructions that direct the assembler to do something.

Directives do many things; some tell the assembler to set aside space for variables, others tell the assembler to include additional source files, and others establish the start address for your program. The directives available are shown below:

= Assigns a value to a symbol (same as EQU)

EQU Assigns a value to a symbol (same as =)

ORG Sets the current origin to a new value. This is used to set the program or register address during assembly. For example, ORG 0100h tells the assembler to assemble all subsequent code starting at address 0100h.

DS Defines an amount of free space. No code is generated. This is sometimes used for allohoneying variable space.

ID Sets the PIC's identifihoneyion bytes. PIC16C5x chips have two ID bytes, which can be set to a 2-byte value. Newer PICs have four 7-bit ID lohoneyions, which can be filled with a 4-character text string.

INCLUDE Loads another source file during assembly. This allows you to insert an additional source file into your code during assembly. Included source files usually contain common routines or data. By using an INCLUDE directive at the beginning of your program, you can avoid re-typing common information. Included files may not contain other included files. NOTE: The Device Include directive (i.e. INCLUDE 'C:\PicTools\16F877.inc' ) for the targeted device MUST be at the beginning of your source code.

FUSES NOTE that FUSE CONFIGURATIONs can be '&' together on a single line and/or spread between multiple lines. ALL FUSES directives are ANDed together to create the composite FUSE CONFIGURATION. (view the device "include" file for specific fuse syntax)

IF Assembles code if expression evaluates to TRUE.

IFNOT Assembles code if expression evaluates to FALSE.

ELSE Assembles code if preceeding evaluation is rejected.

ENDIF Ends conditional evaluation.

RESET Sets the reset start address. This address is where program execution will start following a reset. A jump to the given address is inserted at the last lohoneyion in memory. After the PIC is reset, it starts executing code at the last lohoneyion, which holds the jump to the given address. RESET is only available for PIC16C5x chips.

EEORG Sets the current data EEPROM origin to a new value. This is used to set the data EEPROM address during assembly. This directive usually precedes EEDATA. EEORG is only available for PICs that have EEPROM memory .

EEDATA Loads data EEPROM with given values. This provides a means of automatically storing values in the data EEPROM when the PIC is programmed. This is handy for storing configuration or start-up information. EEDATA is only available for PICs that have EEPROM memory.

Assembler Directive Examples



Include 'C:\PICTOOLS\16C877.inc' ; loads default symbols
; for the targeted device.
FUSES _WD_OFF&_LP_OSC ; specify multiple fuse settings
; using the '&' operator.
FUSES _CP_ON ; Specifies 1 fuse setting per line.
Digit = 43h ; Assign value 43h to Digit
Max EQU 1Ah ; Assign value 1Ah to Max
>ORG 10h ; Set assembly address to 10h
Count DS 2 ; Define 2 bytes at 10h & 11h
; Bytes can be referred to
; later as Count and Count+1
ID 1234h ; Set 16C5x ID to 1234h
ID "ABCD" ; Set newer PIC ID to 'ABCD'
INCLUDE "KEYS.SRC" ; Include KEYS.SRC file at
; point of insertion
RESET Start ; Set 16C5x reset jump to
; lohoneyion at Start
Start mov Count,#00 ; This will be executed
; when PIC is reset
EEORG 10h ; Set EEPROM address to 10h
EEDATA 02h,88h,34h ; Store 3 bytes in EEPROM

[Updated on: Sat, 08 December 2012 02:44] by Moderator

 Topic: PIC Assembly Language Commands
PIC Assembly Language Commands [message #59] Sun, 21 May 2006 23:55
kc2nda  is currently offline kc2nda
Messages: 29
Registered: December 2004
Location: New Paltz
Junior Member

PIC Assembly Language Commands


Mnemonic

Arguments

Name

Notes

ADDLW

 

Add Literal to W

 

ADDWF

 

Add W to file

 

ANDLW

 

And Literal with W

 

ANDWF

 

And W with file

 

BCF

 

Clear a bit from file

 

BSF

 

Set a bit in file

 

BTFSC

 

Test bit in file, skip next if clear (0)

 

BTFSS

 

Test bit in file, skip next if set (1)

 

CALL

 

Call subroutine

 

CLRF

 

Set file to 0

 

CLRW

 

Set W to 0

 

CLRWDT

 

Clear watchdog timer

 

COMF

 

Complement (Invert) file

 

DECF

 

Decrement file

 

DECFSZ

 

Decrement file, skip next if zero

 

GOTO

 

Goto line number

 

INCF

 

Increment file

 

INCFSZ

 

Increment file, skip next if zero

 

IORLW

 

(Inclusive) OR literal with W

 

IORWF

 

(Inclusive) OR W with file

 

MOVLW

 

Move literal to W

 

MOVF

 

Move file to W

 

MOVWF

 

Move W to file

 

NOP

-

No operation

Do nothing

OPTION

-

Copies W into Option register

To be discontinued

RETFIE

-

Return from handling interrupt

 

RETLW

K

Return with a literal in W

 

RETURN

-

Return from subroutine

 

RLF

F

Rotate a file left

 

RRF

F

Rotate a file right

 

SLEEP

-

Enter 'sleep' mode

 

SUBLW

K

Subtract literal from W

 

SUBWF

F

Subtract W from file

 

SWAPF

F,F

Swap 2 files

 

TRIS

 

Configure ports as I/O

To be discontinued

XORLW

 

(Exclusive) OR literal with W

 

XORWF

 

(Exclusive) OR W with file

 

[Updated on: Mon, 22 May 2006 00:05] by Moderator

 Topic: Enhanced Willem Programmer
Enhanced Willem Programmer [message #48] Tue, 04 April 2006 01:46
kc2nda  is currently offline kc2nda
Messages: 29
Registered: December 2004
Location: New Paltz
Junior Member
I purchased an Enhanced Willem Programmer to read and program chips. It is probably one of the best programmers I have used yet. Although I do wish the documentation was better! If anyone is looking for a programmer that will program PIC chips, I recommend this programmer. Of course before purchasing, make sure it will handle the chips you are looking to program.

In order to use this programmer to program some PIC chips, you do need to use the ICSP pins. The easiest way i think would be to get a 5 pin connector (to match the ICSP header on the PCB) and a 28 or 40 pin socket. Solder the 5 wires to the connector then solder the other sides to the chip socket in the right order (of course).

http://www.hamradio.cc/images/projects/pic-ethernet/pic_icsp.jpg

Here is the 5pin ICSP header to a 28 pin PIC chip's connection:

Vpp <--------> Pin 1
Vdd <--------> Pin 20
GND <--------> Pin 19
RB7 <--------> Pin 28
RB6 <--------> Pin 27

Here is the 5pin ICSP header to a 40 pin PIC chip's connection:

Vpp <--------> Pin 1
Vdd <--------> Pin 32
GND <--------> Pin 31
RB7 <--------> Pin 40
RB6 <--------> Pin 39

Here is the 5pin ICSP header to a 18 pin PIC chip's connection:

Vpp <--------> Pin 4
Vdd <--------> Pin 14
GND <--------> Pin 5 (Vss)
RB7 <--------> Pin 13
RB6 <--------> Pin 12


I hope this helps any newbies. Don't forget to look at the chip's datasheet though. It MAY or MAY NOT be different. It is always better to make sure the pinouts are the same. This Enhanced Willem Programmer is awesome! After reading most frustrated forum posters, I have come to realize that it is easier to get mad at someone else than to try to solve the problem. Most of the problems I have had with the programmer is LACK of documentation. Other than that, I have gotten it to read and program many different chips. Hats off to the developers of this programmer. It is very nice for the money! If anyone else finds this post helpful, PLEASE pbass it on. The documentation on these should be better written!

KC2NDA

[Updated on: Sat, 15 April 2006 19:38]

Forum: Pagers
 Topic: Cloning Flex pagers
Cloning Flex pagers [message #303] Thu, 21 October 2010 17:11
stepnjump  is currently offline stepnjump
Messages: 1
Registered: October 2010
Location: Montreal
Junior Member
Hi guys,

I have a lot of pagers. they are all on the same frequency. Years ago, it used to be cheaper to have them all on the group call than now. Now it costs even more to have them on group call than if they were all on separate phone numbers!

Would any of you know if there would be a way to have them all again on the same cap-code or clone them so that once I page one beeper, they would all ring?

Thanks
 Topic: Motorola Service Manuals
Motorola Service Manuals [message #213] Sat, 10 October 2009 22:01
kc2nda  is currently offline kc2nda
Messages: 29
Registered: December 2004
Location: New Paltz
Junior Member
ORDER THESE FROM MOTOROLA, 1-800-422-4210
----------------------------------------------
Universal Programming Interface

Instruction Manual (w/schematics): 6881010B39

Bravo Plus
Theory/Maintenance: 6881012B35
Service Manual 33-37, 40-50 MHz: 6881012B15
Service Manual 138-174 MHz: 6881012B20
Service Manual, Synthesized RX 152-160: 6881012B80
Service Manaul 406-422, 435-512 MHz: 6881012B25
Service Manual 929-932 MHz: 6881012B30
Service Manual, Synthesized RX 929-932 MHz: 6881012B85

Scriptor LX2/Advisor Pro
Theory Maintenance Manual: 6881021B90
VHF Receiver Servicing Supplement: 6881103B36
Decoder Servicing Supplement: 6881104B25
Service Manual AARD RX kits, 132-174 MHz: 6881022B60

Advisor
Theory/Maintenance Manual: 6881011B75
Service Manual 138-174 MHz: 6881011B55
Decoder Servicing Supplement: 6881104B15
VHF HIGH-BAND PAGING RECEIVERS AARD4050A-D.....AARD4056A-D
Servicing Supplement: 6881103B02

Bravo Series Stand Alone Programmer
Instruction/Service Manual: 6881051C20

Bravo
Theory/Maintenance Manual, GSC: 6881046C40
Service Manual, GSC 138-174 MHz: 6881046C30
Theory/Maintenance Manual, POGSAG: 6881047C95
Service Manual, Low-band VHF: 6881047C70
Service Manual, High-band VHF: 6881047C75
Service Manual, UHF: 6881047C80
Service Manual, 900 MHz: 6881006B85

Keynote

Instruction/Service Manual, Tone and Voice, 138-174 MHz: 6881008B15

Wrist Watch Pager
Theory/Maintenance Manual: 6881011B15
Service Manual 138-174 MHz: 6881011B10
Programmer Instructions: 6881011B06
Operating Instructions: 6881011B05

BPR2000
Theory/Maintenance Manual: 6881033C65
Tone Alert/Silent Alert Service Manual, VHF: 6881032C55
Tone Alert/Silent Alert Service Manual, Low-band VHF: 6881032C75
Tone and Voice Service Manual, VHF: 6881032C50
Tone and Voice Service Manual, Low-band VHF: 6881032C60

Pageboy II
Theory/Maintenance Manual, 138-174 MHz: 6881000C90
Instruction Manual, 450-512 MHz: 6881009C60

Spirit
Instruction Manual 132-174 MHz: 6881014C20

 Topic: Paging Frequency Allocations
Paging Frequency Allocations [message #69] Sat, 01 July 2006 22:49
root  is currently offline root
Messages: 145
Registered: December 2004
Senior Member
List of Paging Frequencies:
===========================

The FCC has set aside several frequency bands that paging companies are able
to use. These bands are (in MHz):

35 - 36
43 - 44
138 - 159
454 - 460
929 - 932
959 - 960

 Topic: Bravo Plus Receiver Board Part Numbers and Frequencies
Bravo Plus Receiver Board Part Numbers and Frequencies [message #67] Sat, 01 July 2006 22:36
root  is currently offline root
Messages: 145
Registered: December 2004
Senior Member
-Bravo Plus-

Service Manual Numbers:
Theory/Maintenance: 6881012B35
Service Manual 138-174 MHz: 6881012B20
Service Manual, Synthesized RX 152-160: 6881012B80
Service Manual 406-422, 435-512 MHz: 6881012B25

Receiver Board Part Numbers
138 - 143 MHz - AARD4050A
138 - 143 MHz - NRD7211A,B
143 - 148.6 MHz - AARD4051A
143 - 148.6 MHz - NRD7212A,B
148.6 - 152 MHz - AARD4052A
148.6 - 152 MHz - NRD7213A,B
152 - 159 MHz - AARD4053A
- NRD4050G
NRD4053G
NRD4056G
NRE6552C
454 MHz - NRE6553C
NRF4121C
NRN6200A
NRN8550A
NRD7214B

--------------------------------------------------------

[Updated on: Sat, 01 July 2006 22:48]

 Topic: POCSAG Pager Protocol
POCSAG Pager Protocol [message #66] Sat, 01 July 2006 21:28
root  is currently offline root
Messages: 145
Registered: December 2004
Senior Member

The following summary describes the coding used on POCSAG pager
signals and may be of interest to those curious about what those ear-splitting
beeps and buzzes mean and how they encode data. This summary is
based on a very old text of the standard from my files; the current
text of the POCSAG standard is available as CCIR Radiopaging Format 1.

Note that some current POCSAG signals (so called Super-POCSAG)
transmit paging at 1200 or 2400 baud instead of the 512 baud I refer to
here, but use essentially a similar coding standard.

The interested USA reader is reminded that willfully intercepting
other than tone only paging is a violation of the ECPA with similar
penalties and criminal status to willfully intercepting cellular phone calls.

The interested reader is advised that at least two of Universal
Shortwave's RTTY reading devices (the M8000 and the new C-400) are
capable of reading at least the older 512 baud version of POCSAG paging,
so commercial devices for this purpose are currently being sold in
the USA.

And finally, much alphanumeric paging - particularly that installed
some time ago, uses a proprietary Motorola encoding format called
GOLAY which is quite different from POCSAG. The two can be told apart
by their baud rates - GOLAY is 600 baud.


POCSAG


First POCSAG stands for Post Office Code Standarization Advisory
Group. Post office in this context is the British Post Office
which used to be the supplier of all telecommunihoneyions services in
England before privatization.

POCSAG as defined in the standard, (original POCSAG) is 512 bits
per second direct FSK (not AFSK) of the carrier wave with +- 4.5 khz shift
(less deviation than that is used in some US systems). Data is
NRZ coded with the higher frequency representing 0 (space) and the
lower one representing 1 (mark).

The basic unit of data in a POCSAG message is the codeword which
is always a 32 bit long entity. The most significant bit of a codeword
is transmitted first followed immediately by the next most significant
bit and so forth. The data is NRZ, so that mark and space values (plus
and minus voltages) as sampled on the output of the receiver
discriminator at a 512 hz rate corrospond directly to bits in the
codeword starting with the MSB. (Note that the audio output circuitry
following the discriminator in a typical voice scanner may considerably
distort this square wave pattern of bits, so it is best to take the
signal directly off the discriminator before the audio filtering).

The first (msb) bit of every POCSAG codeword (bit 31) indihoneyes
whether the codeword is an address codeword (pager address) (bit 31 = 0)
or a message codeword (bit 31 = 1). The two codeword types have
have different internal structure.

Message codewords (bit 31 = 1) use the 20 bits starting at bit
30 (bit 30-11) as message data. Address codewords (bit 31 = 0) use 18
bits starting at bit 30 as address (bits 30-13) and bits 12 and 11 as
function bits which indihoneye the type and format of the page. Bits 10 through
1 of both types of codewords are the bits of a BCH (31,21) block ECC
code computed over the first 31 bits of the codeword, and bit 0
of both codeword types is an even parity bit.

The BCH ECC code used provides a 6 bit hamming distance between
all valid codewords in the possible set (that is every valid 32 bit
codeword differs from ever other one in at least 6 bits). This makes
one or two bit error correction of codewords possible, and provides
a robust error detection capability (very low chance of false pages).
The generating polynomial for the (31,21) BCH code is x**10 + x**9
+ x**8 + x**6 + x**5 + x**3 + 1.

Codewords are transmitted in groups of 16 (called batches), and
each batch is preceeded by a special 17th codeword which contains a
fixed frame synchronization pattern. At least as of the date of the
spec I have, this sync magic word was 0x7CD215D8.

Batches of codewords in a transmission are preceeded by a start
of transmission preamble of reversals (10101010101 pattern) which must
be at least 576 bits long. Thus a transmission (paging burst) consists
of carrier turnon during which it is modulated with 512 baud reversals
(the preamble pattern) followed by at least 576/512 seconds worth of
actual preamble, and then a sync codeword (0x7CD215D8), followed by 16
data/address codewords, another sync codeword, 16 more data/address
codewords and so forth until the traffic is completely transmitted. As
far I am aware there is no specified postamble. I beleive that all 16
of the last codewords of a transmission are always sent before the
carrier is shut off, and if there is no message to be sent in them the
idle codeword (0x7A89C197) is sent. Later versions of the standard may
have modified this however.

In order to save on battery power and not require that a pager
receive all the bits of an entire transmission (allowing the receiver
to be turned off most of the time, even when a message is being transmitted
on the channel) a convention for addressing has been incorperated which
splits the pager population into 8 groups. Members of each group
only pay attention to the two address code words following the synch
codeword of a block that corrospond to their group. This means that
as far as addressing is concerned, the 16 codewords in a batch are
divided into 8 frames of two codewords apiece and any given pager
pays attention only to the two in the frame to which it assigned.

A message to a pager consists of an address codeword in the
proper two codeword frame within the batch to match the recipients frame
assignment (based on the low three bits of the recipient's 21 bit
effective address), and between 0 and n of the immediately following
code words which contain the message text. A message is terminated by
either another address code word or an idle codeword. Idle codewords
have the special hex value of 0x7A89C197. A message with a long text
may potentially spill over between two or more 17 codeword batches.

Space in a batch between the end of a message in a transmission and
either the end of the batch or the start of the next message (which of
course can only start in the two correct two codeword frame assigned to
the recipient) is filled with idle codewords. A long message which
spills between two or more batches does not disrupt the batch structure
(sync codeword and 16 data/address code words - sync code word and
16 data/address codewords and so forth) so it is possible for a pager
not being addressed to predict when to next listen for its address and
only turn on it's receiver then.

The early standard text I have available to me specifies a 21 bit
address format for a pager (I beleive this has been extended since)
with the upper 18 bits of a pager's address mapping into bits
30-13 of the address codeword and the lower 3 bits specifiying which
codewords within a 17 codeword batch to look at for possible messages.
The address space is further subdivided into 4 different message classes
as specified by the function bits (bits 12 and 11 of a codeword). These
address classes corrospond to different message types (for example
bits 12 and 11 both zero indihoneye a numeric message encoded in 4 bit BCD,
whilst bits 12 and 11 both set to 1 indihoneye an alpha message encoded
in 7 bit ASCII). It was apparently envisioned that a given pager could
have different addresses for different message types.


There are two message coding formats defined for the text of messages,
BCD and 7 bit ASCII. BCD encoding packs 4 bit BCD symbols 5 to a codeword
into bits 30-11. The most significant nibble (bits 30,29,28,27) is the
leftmost (or most significant) of a BCD coded numeric datum. Values beyond 9
in each nibble (ie 0xA through 0xF) are encoded as follows:

0xA Reserved (probably used for something now - address extension ?)
0xB Character U (for urgency)
0xC " ", Space (blank)
0xD "-", Hyphen (or dash)
0xE ")", Left bracket
0xF "(", Right bracket

BCD messages are space padded with trailing 0xC's to fill the codeword.
As far as I know there is no POCSAG specified restriction on length but
particular pagers of course have a fixed number of characters in their
display.

Alphanumeric messages are encoded in 7 bit ASCII characters packed
into the 20 bit data area of a message codeword (bits 30-11). Since four
seven bit characters are 21 rather than 20 bits and the designers of the
standard did not want to waste transmission time, they chose to pack the
first 20 bits of an ASCII message into the first code word, the next
20 bits of a message into the next codeword and so forth. This means
that a 7 bit ASCII character of a message that falls on a boundary can
and will be split between two code words, and that the alignment of character
boundaries in a particular alpha message code word depends on which code
word it is of a message. Within a codeword 7 bit characters are packed
from left to right (MSB to LSB). The LSB of an ASCII character is sent
first (is the MSB in the codeword) as per standard ASCII transmission
conventions, so viewed as bits inside a codeword the characters are
bit reversed.

ASCII messages are terminated with ETX, or EOT (my documentation
on this is vague) and the remainder of the last message codeword is
padded to the right with zeros (which looks like some number of NULL
characters with the last one possibly partial (less than 7 bits)).

The documentation I have does not specify how long a ASCII
message may be, but I suspect that subsequent standards have probably
addressed the issue and perhaps defined a higher level message protocol
for partitioning messages into pieces. The POCSAG standard clearly
does seem to allow for the notion of encoding messages as mixed
strings of 7 bit alpha encoded text and 4 bit BCD numerics, and it
is at least possible that some pagers and paging systems use this
to reduce message transmission time (probably by using some character
other than ETX to delimit a partial ASCII message fragment).


Brett Miller N7OLQ

[Updated on: Sun, 02 July 2006 01:01]

 Topic: Phrack Magazine - The Wonderful World of Pagers
Phrack Magazine - The Wonderful World of Pagers [message #38] Sun, 22 January 2006 23:04
root  is currently offline root
Messages: 145
Registered: December 2004
Senior Member
==Phrack Magazine==

Volume Five, Issue Forty-Six, File 8 of 28

************************************************************ ****************


The Wonderful World of Pagers

by Erik Bloodaxe

Screaming through the electromagnet swamp we live in are hundreds of
thousands of messages of varying degrees of importance. Doctors,
police, corporate executives, housewives and drug dealers all find
themselves constantly trapped at the mercy of a teeny little box:
the pager.

Everyone has seen a pager; almost everyone has one. Over 20 million
pagers are on the streets in the US alone, sorting out their particular
chunk of the radio-spectrum. Another fifty-thousand more are
put into service each day.

But what the hell are these things really doing? What more can we
do with them than be reminded to call mom, or to "pick up dry-cleaning?"

Lots.


** PROTOCOLS **

Pagers today use a variety of signalling formats such as POCSAG, FLEX
and GOLAY. The most common by far is POCSAG (Post Office Standardization
Advisory Group), a standard set by the British Post Office and adopted
world-wide for paging.

POCSAG is transmitted at three transmission rates--512, 1200 and 2400 bps.
Most commercial paging companies today use at least 1200, although many
companies who own their own paging terminals for in-house use transmit
at 512. Nationwide carriers (SkyTel, PageNet, MobileComm, etc.) send
the majority of their traffic at 2400 to make the maximum use of
their bandwidth. In other words, the faster they can deliver pages,
the smaller their queue of outgoing pages is. Although these
carriers have upgraded their equipment in the field to broadcast at
2400 (or plan to do so in the near future), they still send out
some pages at 1200 and 512 to accommodate their customers with older
pagers. Most 512 and 1200 traffic on the nationwide services is
numeric or tone-only pages.

POCSAG messages are broadcast in batches. Each batch is comprised of 8
frames, and each frame contains two codewords separated by a
"synchronization" codeword. A message can have as many codewords
as needed to deliver the page and can stretch through several batches
if needed. The end of a complete message is indicated by a "next address"
codeword. Both addressing and user data are sent in the codewords, the
distinction being the least significant bit of the codeword:
0 for address data, and 1 for user-data.

Standard alphanumeric data is sent in a seven-bit format, with each codeword
containing 2 6/7 characters. A newer 8-bit alphanumeric format is
implemented by some carriers which allow users to send data such as
computer files, graphics in addition to regular alphanumeric messages.
The 8 bit format allows for 2.5 characters per codeword.

Numeric data is 4 bit, allowing up to 5 numbers to be transmitted per
codeword. Tone and voice pages contain address information only.

(NOTE: Pager data uses BCH 32,21 for encoding. I don't imagine
very many of you will be trying to decode pager data by building your
own decoders, but for those of you who may, take my interpretation
of POCSAG framing with a grain of salt, and try to dig up the
actual POCSAG specs.)

** THE PAGING RECEIVER **

Paging receivers come in hundreds of shapes and sizes, although the vast
majority are manufactured by Motorola. Numeric pagers comprise over
fifty percent all pagers in use. Alphanumeric comprises about thirty
percent, with tone and voice pagers making up the remainder.

Pagers are uniquely addressed by a capcode. The capcode is usually six
to eight digits in length, and will be printed somewhere on the pager
itself. Many pager companies bassign customers PIN numbers, which are
then cross-referenced to a given capcode in databases maintained by
the service provider. PIN numbers have no other relationship
to the capcode.

Tone pagers are by far the most limited paging devices in use.
When a specified number has been called, an address only message
is broadcast, which causes the intended receiver to beep. Wow.
Tone pagers usually have 4 capcodes, which can correspond to
different locations to call back. Voice pagers are similar, except
they allow the calling party to leave a 15 to 30 second message.
The voice message is broadcast immediately after the capcode of the
receiver, which unsquelches the device's audio.

Numeric pagers, although seemingly limited by their lack of display
options have proven otherwise by enterprising users. Most numeric
data sent is obviously related to phone numbers, but numerous users
have developed codes relating to various actions to be carried out
by the party being paged. The most prolific users of this have
been the Chinese who have one of the most active paging networks
in the world. I suppose the next biggest users of code-style numeric
paging would be drug dealers. (2112 0830 187 -- get to the fudgeing
drop site by 8:30 or I'll bust a cap in your bass!) Smile

Alphanumeric pagers are most often contacted through a dedicated
service that will manually enter in the message to be sent onto the
paging terminal. One such service, NDC, offers its phone-answering
and message typing services to various pager companies. Next time
you are talking to a pager operator, ask him or her if they are at
NDC. They probably are.

In addition to the capcode, pagers will have an FCC ID number, a serial
number, and most importantly, the frequency that the device has been
crystaled for imprinted on the back of the device. Although technology
exists that would allow pagers to listen on a number of frequencies
by synthesizing the frequency rather than using a crystal, pager
manufacturers stick to using crystals to "keep the unit cost down."

Pagers may have multiple capcodes by which they can be addressed by.
Multiple capcodes are most often used when a person has subscribed to
various services offered by their provider, or when the subscriber is
part of a group of individuals who will all need to receive the same
page simultaneously (police, EMTs, etc.).

Most low-cost pagers have their capcode stored on the circuit board
in a PAL. Most paging companies will completely exchange pagers
rather than remove and reprogram the PAL, so I don't think
it's worth it for any experimenter to attempt. However, like most
Motorola devices, many of their paging products can be reprogrammed
with a special serial cable and software. Reprogramming software
is usually limited to changing baud rates, and adding capcodes.

Additionally, some units can be reprogrammed over the air by the
service provider. Using a POCSAG feature known as OTP (over the air
programming) the service provider can instruct the paging receiver to
add capcodes, remove capcodes, or even shut itself down in the case
of non-payment.

** SERVICES **

With the growing popularity of alphanumeric pagers, many service providers
have decided to branch out into the information business. The most
common of these services is delivery of news headlines. Other services
include stock quotes, airline flight information, voice mail and
fax reception notification, and email. Of course, all of these services
are available for a small additional monthly premium.

Email is probably the single coolest thing to have sent to your
alpha pager. (Unless you subscribe to about a zillion mailing lists)
Companies like SkyTel and Radiomail give the user an email address
that automatically forwards to your paging device.
IE: PIN-NUMBER@skymail.com. Several packages exist for forwarding
email from a UNIX system by sending stripping down the email to
pertinent info such as FROM and SUBJECT lines, and executing a script
to send the incoming mail out via a pager terminal data port.
One such program is IXOBEEPER, which can be found with an archie
query.

Radiomail's founder, (and rather famous ex-hacker in his own right - go
look at ancient ComputerWorld headlines), Geoff Goodfellow had devised
such a method back in the late 70's. His program watched for incoming
email, parsed the mail headers, and redirected the FROM and SUBJECT
lines to his alphanumeric pager. Obviously, not many people had
alphanumeric pagers at all, much less email addresses on ARPANET
back in the 70's, so Geoff's email pager idea didn't see much
wide-spread use until much later.

Two RFC's have been issued recently regarding paging and the Internet.
RFC 1568, the Simple Network Paging Protocol, acts similarly to SMTP.
Upon connecting to the SNPP port the user issues commands such as:

PAGE followed by pager telephone number
MESS followed by the alpha or numeric message
SEND
& QUIT

RFC 1568 has met with some opposition in the IETF, who don't consider
it worthwhile to implement a new protocol to handle paging, since it
can be handled easily using other methods.

The other RFC, number 1569, suggests that paging be addressed in a rather
unique manner. Using the domain TPC.INT, which would be reserved for
services that necessitate the direct connection to The Phone Company,
individual pagers would be addressed by their individual phone numbers.
Usernames would be limited to pager-alpha or pager-numeric to represent
the type of pager being addressed. For example, an alpha-page being sent to
1-800-555-1212 would be sent as pager-alpha@2.1.2.1.5.5.5.0.0.8.1.tcp.int.

** PAGING TERMINAL DATA PORTS **

Many services offer modem connections to pager terminals so that
computer users can send pages from their desks using software packages
like WinBeep, Notify! or Messenger. All of these services connect to
the pager terminal and speak to it using a protocol known as
IXO.

Upon connection, a pager terminal identifies itself with the following:

ID=

(I bet you always wondered what the hell those systems were)
Paging terminals default to 300 E71, although many larger companies
now have dialups supporting up to 2400.

Many such systems allow you to manually enter in the appropriate information
by typing a capital "M" and a return at the ID= prompt. The system will then
prompt you for the PIN of the party you wish to page, followed by a prompt
for the message you wish to send, followed by a final prompt asking if you
wish to send more pages. Not every pager terminal will support a manual
entry, but most do.

All terminals support the IXO protocol. As there are far too many
site specific examples within the breadth of IXO, we will concentrate on
the most common type of pager services for our examples.

[ Sample IXO transaction of a program sending the message ABC to PIN 123
gleened from the IXOBeeper Docs ]

Pager Terminal YOU
------------------------------------------------------------ --

ID=
PG1
Processing - Please Wait


ACK
[p
123
ABC
17;

ACK

EOT


The checksum data came from:

STX 000 0010
1 011 0001
2 011 0010
3 001 0011
000 1101
A 100 0001
B 100 0010
C 100 0011
000 1101
ETX 000 0011
----------------
1 0111 1011
----------------
1 7 ; Get it? Get an ASCII chart and it will all make sense.


Note: Everything in the paging blocks, from STX to ETX inclusive are used
to generate the checksum. Also, this is binary data, guys...you can't
just type at the ID= prompt and expect to have it recognized as IXO.
It wants specific BITS. Got it? Just checking...


** PAGER FREQUENCIES - US **

[Frequencies transmitting pager information are extremely easy to
identify while scanning. They identify each batch transmission
with a two-tone signal, followed by bursts of data. People with
scanners may tune into some of the following frequencies to
familiarize themselves with this distinct audio.]

Voice Pager Ranges: 152.01 - 152.21
453.025 - 453.125
454.025 - 454.65
462.75 - 462.925

Other Paging Ranges: 35.02 - 35.68
43.20 - 43.68
152.51 - 152.84
157.77 - 158.07
158.49 - 158.64
459.025 - 459.625
929.0125 - 931.9875

** PAGER FREQUENCIES - WORLD **

Austria 162.050 - 162.075 T,N,A
Australia 148.100 - 166.540 T,N,A
411.500 - 511.500 T,N,A
Canada 929.025 - 931-975 T,N,A
138.025 - 173.975 T,N,A
406.025 - 511.975 T,N,A
China 152.000 - 172.575 N,A
Denmark 469.750 N,A
Finland 450.225 T,N,A
146.275 - 146.325 T,N,A
France 466.025 - 466.075 T,N,A
Germany 465.970 - 466.075 T,N,A
173.200 T,N,A
Hong Kong 172.525 N,A
280.0875 T,N,A
Indonesia 151.175 - 153.050 A
Ireland 153.000 - 153.825 T,N,A
Italy 466.075 T,N,A
161.175 T,N
Japan 278.1625 - 283.8875 T,N
Korea 146.320 - 173.320 T,N,A
Malaysia 152.175 - 172.525 N,A,V
931.9375 N,A
Netherlands 156.9865 - 164.350 T,N,A
New Zealand 157.925 - 158.050 T,N,A
Norway 148.050 - 169.850 T,N,A
Singapore 161.450 N,A
931.9375 N,A
Sweden 169.8 T,N,A
Switzerland 149.5 T,N,A
Taiwan 166.775 N,A
280.9375 N,A
Thailand 450.525 N,A
172.525 - 173.475 N,A
UK 138.150 - 153.275 T,N,A
454.675 - 466.075 T,N,A

T = Tone
N = Numeric
A = Alphanumeric
V = Voice


** INTERCEPTION AND THE LAW **

For many years the interception of pages was not considered an
invasion of privacy because of the limited information provided
by the tone-only pagers in use at the time. In fact, when
Congress pbassed the Electronic Communications Privacy Act in 1986
tone-only pagers were exempt from its provisions.

According to the ECPA, monitoring of all other types of paging signals,
including voice, is illegal. But, due to this same law, paging
transmissions are considered to have a reasonable expectation to
privacy, and Law Enforcement officials must obtain a proper court
order to intercept them, or have the consent of the subscriber.

To intercept pages, many LE-types will obtain beepers programmed with
the same capcode as their suspect. To do this, they must contact
the paging company and obtain the capcode bassociated with the person
or phone number they are interested in. However, even enlisting
the bassistance of the paging companies often requires following
proper legal procedures (warrants, subpoenas, etc.).

More sophisticated pager-interception devices are sold by a variety
of companies. SWS Security sells a device called the "Beeper Buster"
for about $4000.00. This particular device is scheduled as
a Title III device, so any possession of it by someone outside
a law enforcement agency is a federal crime. Greyson Electronics
sells a package called PageTracker that uses an ICOM R7100
in conjunction with a personal computer to track and decode pager
messages. (Greyson also sells a similar package to decode
AMPS cellular messages from forward and reverse channels called
"CellScope.")

For the average hacker-type, the most realistic and affordable option
is the Universal M-400 decoder. This box is about 400 bucks and
will decode POCSAG at 512 and 1200, as well as GOLAY (although I've never
seen a paging service using GOLAY.) It also decodes CTCSS, DCS, DTMF,
Baudot, ASCII, SITOR A & B, FEC-A, SWED-ARQ, ACARS, and FAX. It
takes audio input from any scanners external speaker jack, and
is probably the best decoder available to the Hacker/HAM for the price.

Output from the M400 shows the capcode followed by T, N or A (tone, numeric
or alpha) ending with the message sent. Universal suggests hooking
the input to the decoder directly to the scanner before any de-emphasis
circuitry, to obtain the true signal. (Many scanners alter the audio
before output for several reasons that aren't really relevant to this
article...they just do. Smile )

Obviously, even by viewing the pager data as it streams by is of little
use to anyone without knowing to whom the pager belongs to. Law Enforcement
can get a subpoena and obtain the information easily, but anyone else
is stuck trying to social engineer the paging company. One other alternative
works quite well when you already know the individuals pager number,
and need to obtain the capcode (for whatever reason).

Pager companies will buy large blocks in an exchange for their customers.
It is extremely easy to discover the paging company from the phone number
that corresponds to the target pager either through the RBOC or by paging
someone and asking them who their provider is when they return your call.
Once the company is known, the frequencies allocated to that company
are registered with the FCC and are public information. Many CD-ROMs
are available with the entire FCC Master Frequency Database.
(Percon sells one for 99 bucks that covers the whole country -
716-386-6015) Libraries and the FCC itself will also have this information
available.

With the frequency set and a decoder running, send a page that will be
incredibly easy to discern from the tidal wave of pages spewing
forth on the frequency. (6666666666, THIS IS YOUR TEST PAGE, etc...)
It will eventually scroll by, and presto! How many important people
love to give you their pager number?

** THE FUTURE **

With the advent of new technologies pagers will become even more
present in both our businesses and private lives. Notebook computers
and PDAs with PCMCIA slots can make use of the new PCMCIA pager cards.
Some of these cards have actual screens that allow for use without the
computer, but most require a program to pull message data out. These
cards also have somewhat large storage capacity, so the length of
messages have the option of being fairly large, should the service
provider allow them to be.

With the advent of 8-bit alphanumeric services, users with PCMCIA pagers
can expect to receive usable computer data such as spreadsheet
entries, word processing documents, and of course, GIFs. (Hey, porno
entrepreneurs: beeper-porn! Every day, you get a new gif sent to your
pagecard! Woo Woo. Sad thing is, it would probably sell.)

A branch of Motorola known as EMBARC (Electronic Mail Broadcast to A
Roaming Computer) was one of the first to allow for such broadcasts.
EMBARC makes use of a proprietary Motorola protocol, rather than
POCSAG, so subscribers must make use of either a Motorola NewsStream
pager (with nifty serial cable) or a newer PCMCIA pager. Messages are
sent to (and received by) the user through the use of special client
software.

The software dials into the EMBARC message switch accessed through
AT&T's ACCUNET packet-switched network. The device itself is used
for authentication (most likely its capcode or serial number)
and some oddball protocol is spoken to communicate with the switch.

Once connected, users have the option of sending a page out, or
retrieving pages either too large for the memory of the pager, or
from a list of all messages sent in the last 24 hours, in case the
subscriber had his pager turned off.

Additionally, the devices can be addressed directly via x.400
addresses. (X.400: The CCITT standard that covers email address
far too long to be worth sending anyone mail to.) So essentially,
any EMBARC customer can be contacted from the Internet.

MTEL, the parent company of the huge paging service SkyTel, is
implementing what may be the next generation of paging technologies.
This service, NWN, being administrated by MTEL subsidiary Destineer,
is most often called 2-way paging, but is more accurately Narrowband-PCS.

The network allows for the "pager" to be a transceiver. When a page
arrives, the device receiving the page will automatically send back
an acknowledgment of its completed reception. Devices may also
send back some kind of "canned response" the user programs. An example
might be: "Thanks, I got it!" or "Why on Earth are you eating up my
allocated pages for the month with this crap?"

MTEL's service was awarded a Pioneers Preference by the FCC, which gave them
access to the narrowband PCS spectrum before the auctions. This is a big
deal, and did not go unnoticed by Microsoft. They dumped cash into the
network, and said the devices will be supported by Chicago. (Yeah,
along with every other device on the planet, right? Plug and Pray!)

The network will be layed out almost identically to MTEL's existing paging
network, using dedicated lines to connect towers in an area to a central
satellite up/downlink. One key difference will be the addition of
highly somewhat sensitive receivers on the network, to pick up the ACKs
and replies of the customer units, which will probably broadcast at
about 2 or 3 watts. The most exciting difference will be the
speed at which the network transmits data: 24,000 Kbps. Twenty-four
thousand. (I couldn't believe it either. Not only can you get your
GIFs sent to your pager, but you get them blinding FAST!) The actual
units themselves will most likely look like existing alphanumeric pagers
with possibly a few more buttons, and of course, PCMCIA units will
be available to integrate with computer applications.

Beyond these advancements, other types of services plan on offering
paging like features. CDPD, TDMA & CDMA Digital Cellular and ESMR
all plan on providing a "pager-like" option for their customers.
The mere fact that you can walk into a K-Mart and buy a pager
off a rack would indicate to me that pagers are far to ingrained into
our society, and represent a wireless technology that doesn't scare
or confuse the yokels. Such a technology doesn't ever really go away.


** BIBLIOGRAPHY **

Kneitel, Tom, "The Secret Life of Beepers," _Popular Communications_,
p. 8, July, 1994.

O'Brien, Michael, "Beep! Beep! Beep!," _Sun Expert_, p. 17, March, 1994.

O'Malley, Chris, "Pagers Grow Up," _Mobile Office_, p. 48, August, 1994.


[Updated on: Sun, 22 January 2006 23:07]

 Topic: POCSAG Encoding
POCSAG Encoding [message #37] Sun, 22 January 2006 22:59
root  is currently offline root
Messages: 145
Registered: December 2004
Senior Member
Hi,

You do not have a problem let me explain how POCSAG is encoded so that you
can understand why you are getting these results................

00000000000000000011101101001001 Cap Code 8 seen as 32 bits- Alphanumeric

In the example above the MSB is the bit on the left and is called bit 32.
bit 32 is a zero if the codeword is a cap code and a 1 if it is data.
bit 31 to bit 14 is where the Capcode is placed, the lower 3 bits of the
capcode are discarded and not sent (I will explain why in a moment)
bits 13 and 12 are the function bits setting the page as
Alphanumeric/Numeric/Tone one/Tone two.
bits 11 to 2 are a CRC (Cyclic Redundency Checksum) this can be used to
correct up to 2 bit errors in the sent data. (This is a huge subject in its
own right)
bit 1 is an even parity bit.... if all the bits that are a 1 in the codeword
add up to an uneven number then this bit is set to one, if not then its set
to zero.

POCSAG data is sent as 32 bit codewords and after 16 codewords have been
sent then a syncronization codeword is sent and then another 16 codewords
and then another syncronization codeword and so on and so on.
Each 16 codewords is called a FRAME.
The Frame is further split into double codewords, that gives us a total of 8
pairs of codewords....... now if you remember we dropped the last 3 bits of
the CAP code..... 3 bits gives us a number from 0 to 7...... 0 to 7 is eight
numbers.
Because we dropped these 3 bits it means that pager 7 wil have the same
codeword value as pager 0 and pager 1 and pager 2 etc etc.
So in order to make sure that each pager only gets the pages its meant to
get what we do is to send pager zero's capcode and message in the first
double pair after a syncronization codeword and pager one's capcode and
message in the second double pair after a syncronization codeword...... etc
etc.

So to recap.........
If you enter the Cap code 8, then the first thing my PE software does is to
convert it to 1....... If you enter a Cap code of 9 then that is also
converted to 1....... infact all capcodes from 8 to 16 are all converted
into 1...... but when they are transmitted they are sent at different points
in time.... the point in time that a page is sent decides its value for the
lower 3 bits that we discarded.
So Cap Codes 0 to 7 have a POCSAG codeword of 0
So Cap Codes 8 to 15 have a POCSAG codeword of 1
So Cap Codes 16 to 24 have a POCSAG codeword of 2
And so on..........
There are over 2 million different Cap codes but only just over 250 thousand
Cap Code codewords transmitted.

So what you are experiencing is exactly what is supposed to happen with
POCSAG data.

I hope this helps,

All the best
Clive Cooper.
*******************************************
clive@nemesis.ltd.uk
http://www.whatpage.com/clive
PE Version 3 is now available at my website
DONT FORGET TO REGISTER.
*******************************************


Pages (6): [ «    1  2  3  4  5  6    »]


Current Time: Wed Jul 30 15:10:47 EDT 2014

Total time taken to generate the page: 0.09194 seconds
.:: Contact :: Home ::.

Powered by: FUDforum 2.7.6.
Copyright ©2001-2007 FUD Forum Bulletin Board Software