SB9600 Exploration and controlling radio from PC

[RussianE39]

Hello!
Many people around using their radios at home near computer, and because our lovely Motos is channel based radios, not frequency based it is very annoying to program every needed frequency each time. So I developed little tool for controlling radio from PC. Sorry for my English (it's totally not my native language), but I'll do my best to explain what my tool purpose:
1. It is serial port monitor with special functions of working with Motorola SB9600 protocol.
2. You can not only watch packets between various radio parts, but also you can send them too!
3. You can tune radio to frequency you want
4. You can scan frequency range
Here is screenshot, how tool looks:
735aa308d0cb8ddff12b8e325010b280.png
And that's the tool iself:
http://storage.v12.su/p25ca/remoto.7z
I've personally tested it with Astro Saber, Astro Spectra, MTS2000, MCS2000.
For MCS2000 additional feature would be included very soon: your text output on display.

[RussianE39]

Oh, also forgot to tell some more:
1. Tool is totally wine friendly. As you could see from screenshot - it works in Linux with no problems, although it is Win32 APP
2. By default, tool configured to first serial port (COM1). If you want some another - edit index= in [port] section of settings.ini. 0 here means COM1, 1 - means COM2 for example
3. To control radio from PC, first you need to push CSQ button, this will freeze radio's own "soul" so it won't intercept you while you will be playing with radio.
4. On first five tabs there is buttons "Right-click to set". This is made for people, who found some nice SB9600 packet and wanted to send it more easily. For example - you found Volume Up or Volume Down packets. Now, it's great idea to send it by pressing button, not by typing or pasting packet every time. So you just "program" one of the free buttons to this packet and can send it just by pressing button.
5. Of course many of you will have question about interface, needed for this program. The answer is - if CPS works on your PC, this tool would work too, so usual RIB + cables should work in 100% cases. Even more - sometimes CPS won't work with your radio on particular computer, but this tool will work :-)
6. For now I'm working on raw codeplug backup/restore feature of radio. I think many of you tired using awful Astro Lab DOS RSS for that (including me).

[cyrus]

Wow, very cool tool.

Perfect type of app for a remote base.

[RussianE39]

Well, adding TCP/IP remote capabilty wouldn't be hard, but it could be useful only after we got enough experience and discover useful commands for such use of our radios. Main idea would be to collect useful SB9600 commands to drive radio totally headless. And it looks like only basic commands are same for all series (like RESET, CSQ). So we should make some database for different models. Unfortunately, I'm not old-school Motorola fan, and I don't have much radios around to experiment with. But I have strong feeling that even Syntor X 9000 could be driven with my tool.

[cyrus]

I was thinking of using RDP or something similar to take control of the remote PC.

[RussianE39]

Hey, this would be totally unprofessional Imagine - running one PC with 5-6 radios wired in, and control all of them from your android tablet. Aren't it cooler, than ugly RDP session ?

[cyrus]

An IP link between an instance of the app on your local desktop to the remote would be the best but until then, RDP would be the easiest way.

[RussianE39]

How about audio input issues ? Seems astro spectra gives bridged power amplifier monofonic output to speaker. This could probably harm line-in of almost any PC sound card.

[Alpha]

Audio, you'll have to either tap in to discriminator level audio, or tap it before the power amp IC, yes the speaker drive levels
are probably way too high for PC sound card input, impedance too low, voltage too high. A matching transformer like 8 ohm to 1K-10K would be best, otherwise about a 1-10 uF non-polar or electrolytic cap in series will block the 12V DC on the speaker line outputs, and a 10K pot will knock the level down to something acceptable.


This software looks really cool, BTW, I am very interested to play around with it a bit. I also have some older SyntorX 9000's in my storage area, so I'll have to drag one out and test it on that old radio to see if it works. It would be really nice if it worked with Syntor X's but I think they're too primitive. I have some old Sabers and Systems Sabers I'll try it with too.
Thanks!

[RussianE39]

As I understand, Syntor X 9000 is first radio, which uses SB9600 protocol. So, most commands should work for them. I think Saber uses SB9600 too, at least Astro Saber uses SB9600 for internal communications too. If you inspect my screenshot closely, you could see directly raw ASCII string "SELF CHK" for example. This was captured from dash-mounted Astro Spectra. And seems, most high-end Motorola gear uses SB9600 for internal communication (imagine communication between main CPU <-> Display <-> Keypad <-> DSP on a same bus). Just like CAN bus in modern car. Basically, to get some nice results from my tool, you should fire up it, then press some button on front panel and watch what happens in log, such way you can analyze and find exact packet, which triggers some function. Considering my particular Astro Spectra - I've noticed, that packet's opcodes for some particular button is same, probably on booting main CPU reads codeplug portion about binding of keys, and then process those opcodes depending on function, assigned to codeplug.

[jry]

If you want to control the radios the old VRCH ( Virtual Control Head ) program was downloadable at Motorola. Believe it was part of the MW800 drivers and support software. I do have a copy if Motorola got rid of the links.
It did allow control of spectra, Astro spectra and MCS2000 via a standard RIB setup. Had the control head graphic in the SW and allowed to set the button functionality as well.
Cool idea for the laptops in the vehicles but may have been to much trouble for someone just to change channels

[PRC148]

I got this working and controlling an Astro Saber but what about audio? I don't seem to hear anything out the front speaker.

[RussianE39]

VRCH is different beast, as you could tell from it's name it's Virtual Radio Control Head, my tool is made slightly for different purpose - for example you can't tune with VRCH to some particular frequency. There was at least two versions of VRCH floating around - one is from MW400 and another one from MW800, both of them is buggy as hell, but MW800 at least could be installed almost on any PC.
PRC148, at least on mine Astro Saber I don't have any troubles with audio. Just check this by tuning radio to some known fequency, like trunk control channel, to see, will radio unsquelch on it.

[PRC148]

I tried scanning the entire 800 band at 12.5 steps but nothing was ever heard. I then paused it on a known active frequency and there was no audio. Perhaps it's my cable? However, I used both a home made ribless thing and also a factory rib and cable setup but I still couldn't get any audio. Could it be a firmware issue or something inherent to an 800? I'm using one with the 6.whatever 9600 firmware.

Also, just to clarify, when it goes into CSQ mode I can push buttons and hear the beep but no button data is displayed on the screen at all. The scan mode does seem to echo back the same packets sent.

09:14:07 | freq: 853012500
09:14:07 | TX(5) 03 2A C2 3F A7 | ?*???
09:14:07 | RX(5) 03 2A C2 3F A7 | ?*???
09:14:10 | freq: 853025000
09:14:10 | TX(5) 03 2A C4 3F 4E | ?*??N
09:14:10 | RX(5) 03 2A C4 3F 4E | ?*??N
09:14:13 | freq: 853037500
09:14:13 | TX(5) 03 2A C6 3F 9C | ?*???
09:14:13 | RX(5) 03 2A C6 3F 9C | ?*???
09:14:16 | freq: 853050000
09:14:16 | TX(5) 03 2A C8 3F 03 | ?*???
09:14:16 | RX(5) 03 2A C8 3F 03 | ?*???

It's a very neat program and very handy. You did an excellent job. I can't wait to try it on a spectra once I mod my cable for audio output.

[RussianE39]

Well, you shouldn't worry about your interface, everything is nice with your interface seems. Problem is in 800mhz band variables for packet generation.

09:14:07 | freq: 853012500
09:14:07 | TX(5) 03 2A C2 3F A7 | ?*???
09:14:07 | RX(5) 03 2A C2 3F A7 | ?*???

Echo is made by radio itself, not by my tool. Basically, if radio echoes packet it means packet is correct. I can't test 800mhz at all, because I don't have anything here working on 800mhz, our police in Moscow uses UHF, not 800mhz band. My understanding of situation with 800mhz is following - we tune radio properly (although I don't know how to tell if VCO really locks or not), but target frequency is not correctly calculated, because I didn't guessed 800mhz band coefficient correctly. In other words - you want 853.0125Mhz, but in fact we order radio to tune to 863.0125Mhz (this is my random guess, I don't know how much we missed real freq).
Now about CSQ mode. Yes, you push buttons, and probably even see packets, which is generated by radio control head (don't be surprised by this words, even astro saber has "control head" it just built inside radio). But radio won't respond to them ,because it is in CSQ mode. It will only listen to PC in such mode.

[PRC148]

OK, I will try to come up with a Vhf or Uhf unit to test it. The 800 does not seem to display any button push data at all.

[RussianE39]

Ok, here is new version, with some variables exposed to dialog box, also some more new features, like Signatures tab, where you can put known packets with mean description, to ease understanding of what happening.
http://storage.v12.su/p25ca/remoto-19mar.7z
Now considering serial port settings - just compare yours with default in distribution settings.ini.
Basically the Delphi code for Scan mode is very simple:

procedure TForm1.SendFreq(RXfreq, TXfreq: Integer; RxOnly:
boolean);
var
RXnumdel, TXnumdel, delta: word;
RXdata, TXdata: TBytes;
begin
if (RXfreq <= VHFmax) then
delta := deltaVHF
else
delta := deltaUHF;
RXnumdel := (RXfreq div 6250) - delta;
TXnumdel := (TXfreq div 6250) - delta;
// RX
setlength(RXdata, 5);
RXdata[0] := 3;
RXdata[1] := RXnumdel shr 8;
RXdata[2] := RXnumdel;
RXdata[3] := $3F;
RXdata[4] := CRC_16(RXdata, 4, $00FF);
SendToMoto(RXdata, length(RXdata));
if (RxOnly) then
exit;
// TX
setlength(TXdata, 5);
TXdata[0] := 2;
TXdata[1] := TXnumdel shr 8;
TXdata[2] := TXnumdel;
TXdata[3] := $3F;
TXdata[4] := CRC_16(TXdata, 4, $00FF);
SendToMoto(TXdata, length(TXdata));

end;

[Magnus]

This is a cool tool. I'm going to play with it ASAP with my 3k.

[RussianE39]

Well, I can confirm, my tool won't work currently with 800mhz, problem is slightly deeper. I will try to fix it tomorrow. For now don't even try it for 800mhz - packet generation is broken for such freqs.

[PRC148]

It seems to me there is something wrong with way the comport operates. It appears to be "stuck". I tried a Vhf W7 astro spectra and the results were the same as the astro saber. I could reset the radio but only half way. It would hang on the blank screen and dim led bootloader when it tried to power back up. It would not totally boot until the programming lead was removed from the computer comport. The CSQ mode would appear on the screen when that button was selected but the radio became frozen just like the astro saber. It would not respond to button pushes at all until the comport was again removed. I tried numerous different settings in the port menu but nothing changed.

Have you tried using this in Windows or are you only using it in Linux?

[RussianE39]

PRC148, I have windows on notebook and Solaris on workstation (wine works in both OSes). Symptoms you describe looks like radio has "BUSY" on bus, check your DTR settings (as DTR signal corresponds to BUSY signal on SB9600 bus).
serial.png
This is screenshot of my workstation, where it works with both Astro Saber III UHF and Astro Spectra W3.

[PRC148]

I disabled DTR and RTS and now it works with the spectra. This is neat as heck. I can envision a million different uses and ways someone could build on this such as a channel scan etc... An Arduino or Netduino controller would work great as a home made custom remote head with a VFO control too.

Great job! Very neat!

What does GET KS do?

[Magnus]

I gave it a try with my 3k, now I can't wait to get a charged battery on it as it went dead before I got to try anything cool.

[RussianE39]

Ok, I sniffed buddy's 800Mhz Astro Saber in Astro Tuner ->Performance Testing->Bit Error Rate, and it gave me very interesting results which should be explored and researched more. This is packets in extended format, which sets modulation type and Rx Frequency:
851.003:F8 2B 00 01 1A 00 01 1F 40 61
851.303:F8 2B 00 01 1A 00 01 1F 70 31
852.303:F8 2B 00 01 1A 00 01 20 10 90
And this is Modulation type sniff:
Modulation type:
852.303
12.5Khz/C4FM:
F8 2B 00 01 1A 00 01 20 10 90
25Khz/C4FM:
F8 2B 00 05 1A 00 01 20 10 8C
CQPSK:
F8 2B 00 09 1A 00 01 20 10 88
Wide Pulse:
F8 2B 00 0D 1A 00 01 20 10 84



Also, guys with 800mhz, can you try to play with deltaUHF = 128160 ? Seems this would be more correct delta for that band, although I'm not sure 100%.

[PRC148]

800 seems to be working. I think it was mainly me that was the issue due to not knowing how to get it setup at first. I did apply that 128610 delta and that seems to work fine. I am able to tune in an analog repeater 30 miles away just fine.

Can you tell me what KS and ATR mean?