PIC12LF1840T48A integrated radio transmitter

Just read about this on the Electronics Bus blog,
It's a new PIC microchip with an integrated radio transmitter intended for keyfobs and the like. There are 8 preset channels covering a couple of bands: 418-443.92 and 864-869.85mhz per the datasheet (Page 361). There's an application note as well. It supports FSK and OOK. FSK mode can run up to 100kbps(!) at a power output of up to +10dBm. (About 10mw if the online conversion tool I used is right).

Can you receive FSK with AFSK demodulation? This chip would be interesting paired with code and a cheap GPS chip to make a small, low-power, cheap APRS beacon. Add a homebrew power amp for the 430 or 440mhz band and you could have a platform for a remote APRS sensor or sensor network. Although, since it's just the transmitter, I'm guessing you'd have to be careful of collisions.

Read More

Of 3D printers and themes

Okay, so the theme I had up wasn't working for me. It was a new dynamic layout that Google is offering and even on my computer it was kinda bogging down. And my computer used to be fast... 4 years ago.

This is a new 3D printer project that I heard about. Called Printrbot, of course. What is a 3D printer? Wikipedia I've been following the news of a couple of homemade 3D printers for years, mostly the RepRap and the Makerbot. This seems to be a new one that is made to be easy to build and inexpensive. And actually, from reading the Kickstarter page there.. It's a special version of the RepRap? I don't know. Anyways, $500 there will get you all the parts to assemble one of these 3D printers. $750 will get you one assembled and ready to go.

"Printrbot is small and intended to be your FIRST printer. The print area is roughly 5″ x 5″ x 5″. It does make a few sacrifices to keep things simple, but it is designed to be upgradable and expandable. You can easily increase the build area to whatever size you want. You can mount it inside a box or frame for rigidity. The included hardware is “full-sized” and on par with the Prusa – the current high-resolution champ. While Printrbot could happily serve your 3D printing needs sitting on your desk in your office, right next to your computer, it could also be the seed that spawns a never-ending series of upgrades to a bigger and better 3D future. You’ve got options."

I could easily see this being beneficial to homebrewers. You could print plastic cases, a front panel for a radio, knobs.. small ones or big VFO wheels, standoffs, plastic morse code key?, insulators for antennas, etc I'm sure there are a ton more things you could use a 3D printer for.

Read More

New theme, TM-241, etc

I'm trying out a new theme to go with the changes behind the scenes at Blogger. It's a little less plain than my old one but I'm not sure if the navigation is going to be a pain, especially for people with older computers. If anyone experiences that, leave me a message on this post?

I haven't forgotten about my work on reverse engineering the remote control protocol for the Kenwood TM-241a radio. I've been very busy with school work lately. I'm in my final month of my Associates degree at IvyTech for Computer Information Technology. I am on track to keep my 4.0 GPA too, which is great. It's caused me no end of stress right now though. I'm on a program that let people who had their jobs displaced to other countries go back to school for a 2-year degree. Many of us did so with the idea that the economy was going to be in much better shape by now. At least, I did. I've been applying for positions since June and haven't had much luck even getting interviews. Once my education program ends, so does my unemployment. Shortly after that... we're going to be in trouble. Of course, one of the places I have applications at right now may come through and save us at the last second. Not that I can count on that though.

I'm thinking about trying some ads on here to see if I can get a little ad money.

If anyone knows anyone hiring within 30-60 minutes of Richmond, IN.. please, let me know. I'll have an Associates degree and I also already have my A+ certification. I'll be taking the Network+ soon and should get that easily.

Speaking of the Kenwood TM-241a work.. I haven't managed the basic application to fuzz out the numbers. It seems doing serial comms under .NET is a little hairy. Also, the Bus Pirate's binary mode is easy to get into but a little hard to use so far. I'm a little inexperienced in it, so it might just be I'm not understanding it right. From what little by-hand fuzzing I've done using a terminal mode on the Bus Pirate.. I feel like my original theory is wrong. I was hoping it would be a simple 3 byte command.. an address and two bytes for the command. The protocol to send the display information out seems to have 1 nibble of data along with 1 nibble of check information. So for example, 0x00 0x04 0x04 0x04 0x08 might be a valid packet with the first nibble having data and the second nibble being a check digit of some kind. The nibbles might have BCD numbers or be bit-level information for single LCD elements. My theory with the control scheme was with 1 byte for address, and 2 bytes for data.. that's 2 nibbles or one whole byte for data giving 256 possible combinations of buttons or commands.

Now, in previous experiments I have managed to affect something while sending data. Once I managed to have the radio skip around in the memory channels by significant steps. Another time, before I figured out the exact communication settings, I managed to overwrite the memory channels with bogus data. That's probably the greatest clue that what I may be dealing with is direct control over the internal memory of the radio. If so, my job is significantly harder. I need to figure out how to address specific areas of memory and what the contents mean, all while not being able to read it directly.

...

Or can I? Looking at the service manual, there's no information on what the main cpu is, and it looks like no external memory. If I could figure out what the cpu is, I can at least figure out my constraints. Working further on fuzzing the interface, I may be able to figure out the correct way to issue address commands and data. The main questions are: How many bytes do I need for an address? Do they require the checkdigits like what is used to talk to the LCD? How many bytes do I send after the address? Checkdigits? What is the constraints on memory area I can address? With that, I can start poking values into memory to see what happens. I know there's a soft power off feature, so you can turn the radio off from the remote control interface. There's also got to be a method to key the transmit, because the PTT line is one used for the communications.

There's apparently an internal basic scripting language on the newer Bus Pirate firmwares. I may need to look into upgrading mine. If it doesn't work, I have a cheap ICSP capable programmer here that I can maybe revert it with.

Read More

TM-241 again

Figured out how to read the S-meter data when it is active. Not too shabby. Still trying to figure out what kind of format the button data is in when transmitted. I have been doing a little hand fuzzing, aka sending random data bytes. I had a theory that they used the exact same control scheme not only on the remote control interface, but also on the internal configuration. That might be true for the LCD commands, but upon closer examination of the schematic, the buttons are in a matrix on CPU pins, SQL and VOL are variable resistors and the VFO knob is a quadratic encoder. Still, it might be valuable to open it up, and patch into the internal LCD signals if it helps me figure out which bits control what LCD elements.

I might also need to write a basic program to start fuzzing. If I could figure out some representative commands, maybe I could go from there and send test commands that are more likely to have a response. At the very least, I need to figure out: VFO knob, VFO button, MEM button, VOL, SQL, and PTT. The last one is important because the MIC connection on the radio is part of the communication scheme for the remote control interface.

Read More

TM-241 Progress

After a misstep where I had faulty data, I am getting valid data out of it now. I can tell because I have figured out how the frequency is encoded and I can predict the results of changing to a different one. There's a lot of work still to be done because so far all I can do is read. I also don't know how everything is encoded.

So far I can read the frequency, if there's an offset and which direction, if I'm in VFO mode, CALL mode or Memory channel mode and which channel. I can also see if there's a signal but I haven't figured out how the S-meter is transmitted yet.

There are several bytes where I'm sure data is encoded at the bit level, I've already seen it with offset, CALL and there's a bit that is set if I'm receiving a signal.

There are quite a few LCD elements that I don't know where they map yet. Much of my experimentation so far has been to set something on the radio, turn it off, configure the Bus Pirate, turn the radio on and read it. If I had a RC-10 or especially RC-20 I could probably rig it up to drive it from the Bus Pirate. Then I could configure the packet of bytes to feed it and see what it does. I could also use it to send control packets to the radio to see what they are. I'm guessing the remote control interface is like a "dumb terminal".. if you push a key, it send that key to the radio instead of doing processing itself. That explains why the radio isn't sending a lot of information out such as what the offset is, or if there's a CTCSS tone and what it is. All the radio is sending is what should be displayed on the LCD. I can probably expect a different packet if I'm in a screen to change the tone, for example. Already I have noticed that when I'm on the CALL channel, it omits data for the VFO and MEM channel.

I'm also a little curious as to how the IF-20 sends information to the RC-20 when there's a second (at least) radio connected. The TM-241a only sends out information for itself. The IF-20 would connect to multiple radios and format the information from all of them into a form that can drive the main and sub display on the RC-20. I'm guessing it's an addressing change.

I know Kenwood killed off the remote control displays sometime after the x41 series. I wonder if the protocol survived in the x51 and future radios? Probably not, but you never know. There's a lot of potential power here, this could have been a major selling feature even now.

Read More

Kenwood TM-241a

I'm working on reverse engineering the remote control interface on my TM-241a. When it was a new radio you could buy options to use it: RC-10, RC-20, IF-20. The RC-20 looks like any other remote head but with the IF-20 you could hook it up to 4 radios. You could end up with one control and microphone to drive a 2m radio, 440, 220 or 1.2ghz. It also worked across different revisions of the radios although I think the x41 were the last ones.

I emailed Kenwood looking for any information on this interface awhile back, they couldn't help me with the protocol but they were kind enough to send me PDF documents with schematics on the RC-20 and IF-20. Between those, and a PDF service manual for the TM-241a I found.. I have figured out how to do an electrical interface. I'm using a Bus Pirate v3 from Sparkfun to do it. Not entirely sure if I'm interfaced correctly, but I am getting repeatable data. It's quite noisy because I am just using the unshielded probe cables I got with my Bus Pirate.

I did accidentally overwrite a couple of the memories already with junk information. Somehow one wound up with 444.900 and the other had 109.490 in it. Obviously didn't try transmitting there. The radio probably wouldn't have let me, it gave me the error beep when I pushed the REV button to see where the offset ended up. I'm mostly concentrating on receiving the display data that the radio constantly sends out right now. I'm making a bit of progress on the puzzle but it would probably go a lot quicker if I had a RC-10 or RC-20 to experiment with.

All well, I love a puzzle.

My next step may be to collect a lot of information and make Visual Basic programs to help me analyse it. Both for errors, and also for changes between samples (ie, data for one frequency in a memory channel, and then data for another frequency in the same channel)

Read More

Freescale MC13260 SoC Two-Way Radio IC

Found this in a mailing-list post the other day. Very neat, it's a System-on-Chip that is almost everything you need to make a radio from 60MHZ-960MHZ.



From the Freescale website:

Target Applications:
Comprehensive analog FM radio
Comprehensive digital radio (DMR, P25, TETRA, dPMR)
Dual-mode analog FM and digital voice/data
"Talk around the network" feature for cellular applications

Features

ARM926EJ-S™ MCU operating at clock speeds up to 150 MHz
Modem processor (software-defined radio) operating at clock speeds up to 100 MHz
640 KB of integrated RAM
MCU peripherals to support control and monitoring functions
High-performance integrated RF transceiver supporting RF frequencies of 60 MHz–960 MHz
Fully integrated, high-performance RF fractional-N synthesizer
Integrated 13-bit audio CODEC with analog input/output
Three 12-bit DACs for support functions
10-bit general purpose ADC with four multiplexed inputs
Receiver supports linear modulation
Linear transmit support using integrated I and Q DACs and an external modulator
Advanced Encryption Standard (AES) module for secure communication
Full-speed USB device with integrated PHY

Pretty feature rich! I assume the RF components you need amount to bandpass filtering, preamp, transmit/receive switch, and filtering, power amp for transmit side. This chip implements the SDR conversion, AD/DA conversion, etc. It has an ARM9 CPU and a separate "modem" DSP. I'm unclear if the DSP handles the FM mod/demod and any modem processes such as encoding or decoding PSK, FSK, GMSK, QAM, etc.

This chip is pre-release, according the press release the chip will be available in Q1 2012.

Press Release: http://media.freescale.com/phoenix.zhtml?c=196520&p=irol-newsArticle&ID=1537559
Product Details: http://www.freescale.com/webapp/sps/site/prod_summary.jsp?code=MC13260&tid=vanSoCRadio
Fact Sheet: http://cache.freescale.com/files/rf_if/doc/fact_sheet/MC13260FS.pdf?fr=g
Support Info: http://cache.freescale.com/files/rf_if/doc/support_info/MC13260_TRN_SI.pdf?fr=g
Product Brief: http://cache.freescale.com/files/rf_if/doc/prod_brief/MC13260PB.pdf?fpsp=1

Other chips I've covered include:
CMX7163 QAM Modem

The CMX7163 QAM Modem is a low power half-duplex device supporting multiple channel spacings under host microcontroller (µC) control. Its Function Image™ (FI) is loaded to initialise the device and determine modulation types.
The 7163FI-4.x supports 4-, 16- and 64-QAM modulations up to 96kbps in a 25kHz channel, with channel estimation and equalization to provide robust performance under realistic channel conditions.
Flexible bit rates support a wide range of applications requiring a selectable bit rate and robustness.

An integrated analogue interface supports 'direct connection' to zero IF I/Q radio transceivers with few external components; no external codecs are required.TI CCxxxx series
From my blog post on the Ubertooth One:

A CC2591 2.4ghz PA/LNA,CC2400 2.4ghz RF transceiver and a LPC175x series ARM chip.
What inspired him to use a chip like the CC2400? He previously played around with a kids toy called an IM-ME. It's a pink pager-like device meant for girls to send instant messages over the Internet (via a usb dongle plugged into a computer)... He was able to turn it into aninexpensive spectrum analyzer type device. How? It has a CC1110 chip. This is an RF transceiver chip with an integrated 8051 cpu. According to the linked site:


Frequency range: 300 – 348 MHz, 391 – 464 MHz and 782 – 928 MHz
Pretty neat, it's capable of operation in the 70cm and 33cm bands at up to 500kBaud. This was in a toy that was less than $20 on ebay.

Read More