Firmware Hex Debug Tool

[merlin]

@ Elroy. Even though you were only programming a personality, the software does a complete rewrite of the flash.
A failure before completion can corrupt any part (s) of the flash.
The reason is there are chunks of personality stored throughout the flash.

 

[merlin]

This is basic information I got from a dealership/repair shop regarding this issue:

Yea, I heard a bad ground difference can be the cause.

 

[ElroyJetson]

Yes, I pretty much expected that. To me that's just bad engineering. If I were to have any input into the software/firmware architecture design of a radio, it would be set up in such a way that it makes two copies of its entire operating system so that it can recover from any programming or data error as long as one copy of the firmware is still good. Use the good one, automatically blank and rewrite the bad one.

Personality should also be stored separately from all firmware. In my opinion, not that one of a programmer/developer.

 

[BMDaug]

The VA stuff is cool! I make custom VA for my Unity mobiles and portables, mostly for ham repeaters so when I go to a channel, I get the call sign of the repeater on the screen as the channel name, but I hear the frequency and location of the repeater. It’s so nice to get all the info without digging into menus or cross referencing!

I have used the format button before, but never for this specific purpose. Since I am actually using VA, it’s difficult to remember exactly what you have to do to have the ability to click that button. You may have to turn on VA in the personality first, and you may or may not have to read the radio before being able to click that, but it definitely wipes the personality and VA storage volume.

VA is supported on your radio using R06T02 firmware if your part number ends in 21 Rev C or later, 31 Rev D or later, 41 Rev D or later, 51 Rev A or later, or 61 Rev J or later.

@ElroyJetson There are fuses throughout the PK board and PA board. They are surface mount components that you will need to desolder and replace. They are the last point of protection.

@merlin does it really write the flash again when programming a personality? When you format the flash drive on a Unity using the VA screen, the burn/boot/flash/enc remains intact… even on a 7100, it only writes flash and dsp if you choose a different version at load time… maybe the 7300 is different!

-B

 

[ElroyJetson]

I might want to ask for some newer firmware if you'd be willing to share it...I know this is pretty old as firmware goes. Because I've had it for at least eight or ten years.

I tried VA on a Motorola XTS5000. Soon discovered that it can get really annoying really quick. I recommend that VA messages should be as short as possible because it gets on my nerves to have to wait for the radio to complete saying "Channel One Hundred Seventeen" every time I switch to it. (Exaggerating....a bit.)

 

[BMDaug]

I might want to ask for some newer firmware if you'd be willing to share it...I know this is pretty old as firmware goes. Because I've had it for at least eight or ten years.

I tried VA on a Motorola XTS5000. Soon discovered that it can get really annoying really quick. I recommend that VA messages should be as short as possible because it gets on my nerves to have to wait for the radio to complete saying "Channel One Hundred Seventeen" every time I switch to it. (Exaggerating....a bit.)

Ya… on most of the Harris mobiles and the Unity portables, you can toggle it on and off and also set priority as to RX audio or VA audio as well as min and max volumes… definitely can get annoying, but it’s useful info the way I have it set up, not just redundant to what’s on the screen.

-B

VA should work on older firmware, I just have the compatibility matrix for T02 on hand so I referenced that. I don’t own an m7300…

 

[TDR-94]

What Merlin described with the complete rewrite of the flash, applies to the OMAP radios. The XG-100 along with the M7100/P7100/5100/700P(i) and older portable/mobile radios, are not OMAP based radios and don't perform a rewrite of the flash when programming a personality.

 

[ElroyJetson]

That sounds right. A 7100 programs very quickly compared to an OMAP radio.

 

[BMDaug]

That sounds right. A 7100 programs very quickly compared to an OMAP radio.

That makes sense because none of the radios I’ve messed with take more than about 30 seconds to write a personality. Which models are OMAP? I know what OMAP is but I’ve never been able to identify a definitive list of models. As far as I can tell, the 7100 obviously came before the 7300, but didn’t the XG100 come after that? Did they do OMAP for a while and then stop or do they still use OMAP for some models?

-B

 

[merlin]

Yes, I pretty much expected that. To me that's just bad engineering. If I were to have any input into the software/firmware architecture design of a radio, it would be set up in such a way that it makes two copies of its entire operating system so that it can recover from any programming or data error as long as one copy of the firmware is still good. Use the good one, automatically blank and rewrite the bad one.

Personality should also be stored separately from all firmware. In my opinion, not that one of a programmer/developer.

I already thought this through and my engineering would include something like JTAG. That could write the entire memory space except masked rom.
Your notion is very sound but would take double the memory to implement.

 

[merlin]

That makes sense because none of the radios I’ve messed with take more than about 30 seconds to write a personality. Which models are OMAP? I know what OMAP is but I’ve never been able to identify a definitive list of models. As far as I can tell, the 7100 obviously came before the 7300, but didn’t the XG100 come after that? Did they do OMAP for a while and then stop or do they still use OMAP for some models?

-B

A valid point but you compare 7100 at 2Mb flash to Unity/OMAP at 8Mb flash.
Unless OMAP is totally different, all those broken blocks, the fastest programming is to write the entire flash.
The 7300 came first, a foundation for the XG series. Still very much the same.

 

[wa8pyr]

I tried VA on a Motorola XTS5000. Soon discovered that it can get really annoying really quick. I recommend that VA messages should be as short as possible because it gets on my nerves to have to wait for the radio to complete saying "Channel One Hundred Seventeen" every time I switch to it. (Exaggerating....a bit.)

I found the same; it's gets really annoying, really fast. One of the issues is that as long as the radio is bloviating about what zone and/or channel you just switched to, you can't hear any activity on that channel other than the VA babbling away.

Some of the people around here had it on every single zone and channel in the radio (several hundred), set up by the dealer, which couldn't have been cheap; I told them if they wanted to keep that feature it was going to be a premium cost thing (at $60 an hour), since it was going to take me a great deal of time to create the files and associate them with the proper channels. Most of them elected to give it up.

When I do (rarely) use VA, I use it only for Zone names.

 

[BMDaug]

I found the same; it's gets really annoying, really fast. One of the issues is that as long as the radio is bloviating about what zone and/or channel you just switched to, you can't hear any activity on that channel other than the VA babbling away.

Some of the people around here had it on every single zone and channel in the radio (several hundred), set up by the dealer, which couldn't have been cheap; I told them if they wanted to keep that feature it was going to be a premium cost thing (at $60 an hour), since it was going to take me a great deal of time to create the files and associate them with the proper channels. Most of them elected to give it up.

When I do (rarely) use VA, I use it only for Zone names.

I don’t know about the Motos, but with Harris radios, you can prioritize either RX audio or VA audio and if you prioritize RX, it will skip the VA altogether in order to receive the incoming TX. Also, on most of the Harris radios, you can add a programmable menu item to toggle the VA. I especially enjoy VA on my manpack XG100M with HHC731 where screen size is limited.

-B

 

[ElroyJetson]

I THINK the 7200/5200was the first OMAP product line. Certainly the 7300/5300 is OMAP while the 7100/5100 platform is not.

Come to think of it...the radio I need to recover is actually an M5300. I just remembered that. The only difference is literally the inclusion of option 30 which limits the radio so that it can't do P25 Phase II trunking. It's just a feature-controlled software limitation.

Since there's no Phase II trunking in my area that isn't currently an issue. Some day it might be.

 

[ElroyJetson]

While I'm thinking of it, I have a P7200 that doesn't have any kind of regular firmware in it. Just pre-programmed test frequencies. Does anybody have regular P7200 firmware I can load into it?

It's worth a shot. The radio is worthless as it is now.

 

[ElroyJetson]

If possible, please provide instructions to communicate with the radio via the RS232 rear connector.

Will this require a null modem cable or adapter?

 

[ElroyJetson]

I'm reposting this from an earlier related topic from a few years back. It may contain useful information.


CH721 Control Head EID configuration procedure





HyperTerminal or PuTTY will work, which ever you have on hand.

Use this procedure to change the control head’s model information character.
The model information character is the sixth (6th) character in the head’s 12-character EID:

1. If a CAN cable is connected to the control head, disconnect it. The head cannot be communicating with a radio.

2. Turn the control head off by rotating its on/off/volume control fully counterclockwise to the off (detent) position.

3. Set a regulated-output DC power supply to 13.6 VDC and connect it to the control head’s DC power input connector using DC Power Cable CA-012365-001 or CA-012616-001.

4. While holding the control head’s “C” preset button fully depressed, turn the head on by rotating its on/off/volume control clockwise out of the detent position. When it powers-up, it will indicate “NO MRU” in the display. Disregard this indication. The head’s test command mode is now enabled.

5. Using CH-721 Serial Programming Cable CA-104861 (or equivalent), connect the Personal Computer’s (PC’s) serial port to the DB-9 serial port connector on the rear panel of the CH-721. If the PC is not equipped with a DB-9 serial port connector, the use of a suitable adapter is required, such as USB-to-RS-232 Adapter Cable CN24741-0001.

6. At the PC, start the terminal emulation software such as Windows HyperTerminal.

7. Configure the terminal emulation software for the respective serial communication port (e.g., COM1) at 19200 bps, 8 data bits, 1 stop bit, no parity, and no flow control.

8. Set the terminal emulation software’s function, arrow, and control keys to act as terminal keys. For HyperTerminal, this is accomplished via the respective serial port’s Properties dialog box (Settings tab), as illustrated in Figure 5-3.

9. Set the terminal emulation software for TTY (teletype) emulation. For HyperTerminal, this is accomplished via the respective serial port’s Properties dialog box (Settings tab), as illustrated by the left-most dialog box in Figure 5-3.

10. Set the terminal emulation software to echo typed characters locally. For HyperTerminal, this is accomplished via the respective serial port’s Properties dialog box (and Settings tab), and ASCII Setup button, as illustrated by the right-most dialog box in Figure 5-3.


Figure 5-3: Configuring the Terminal Emulation Software (e.g., HyperTerminal)

11. While in the terminal emulation software, enable “Caps Lock” by pressing the respective key on the PC’s keyboard. The control head’s test command mode only recognizes capital (upper-case) letters.

12. Type the following command to send it to the control head. This is the “show EID” command. <Ctrl B> means to hold the keyboard’s “Ctrl” key down while typing the "B" key. Likewise, <Ctrl C> means to hold the keyboard’s “Ctrl” key down while typing the "C" key. The space between the “W” and the “E” must be included, and all letters must be in upper
case.
<Ctrl B>CH-SHW EID<Ctrl C>
The control head will respond with its 12-character EID string, as illustrated in Figure 5-4. The sixth character in this EID string is the control head’s model information character that must be changed in a subsequent step. The other characters within this string cannot be changed.


Table 5-1:

Control Head’s Model Information Character Definitions (6th Character in the 12-Character EID String)
6th CHARACTER CONTROL HEAD MODEL
5 Front-Mount System Model Control Head
6 Remote-Mount System Model Control Head
7 Front-Mount Scan Model Control Head
8 Remote-Mount Scan Model Control Head

13. Select only the twelve reported EID characters and copy them to the Windows clipboard.

14. Open a Windows Notepad session and paste the 12-character EID string into Notepad.

15. Using Table 5-1 as a guide, determine the proper new character for the control head conversion, for example, if converting a System model control head from a remote-mount to a front-mount, the correct new character is 5.

16. In Notepad, change the sixth character of the 12-character EID string to the proper character. The other characters within this string cannot be changed!

17. Copy only the 12-character EID string to the Windows clipboard (with the new 6th character).

18. Within the terminal emulation software, type the following command to send it to the control head. The space between the “D” and the “S” must be included, and all letters must be in upper case.
<Ctrl B>CH-LOD SFM<Ctrl C>
<Ctrl B> means to hold the keyboard’s “Ctrl” key down while pressing the "B" key. Likewise,
<Ctrl C> means to hold the keyboard’s “Ctrl” key down while pressing the "C" key, then release both keys before pressing the key for the next character.

19. Within the terminal emulation software, type the following command to send it to the control head. This is the “clear EID” command. The space between the “R” and the “E” must be included, and all letters must be in upper case.
<Ctrl B>CH-CLR EID<Ctrl C>
The control head will respond with a cleared EID (all 12 characters set to “F” as illustrated in Figure 5-5.
Figure 5-5: Clearing the Control Head’s EID (Example)

FFFFFFFFFFFF

20. Send the revised EID to the control head by sending it the following command. Spaces are significant, and “ENTER NEW 12-DIGIT EID HERE” is use a paste function within the terminal emulation software to enter the EID, before typing the <Ctrl C>:
<Ctrl B>CH-SET EID [ENTER NEW 12-DIGIT EID HERE]<Ctrl C>


CAUTION
Verify the entered string is correct before sending the <Ctrl C> to the control head. If the string is not correct, press the Backspace key until the string is erased, type or paste in
the correct string, and then press <Ctrl C>. An example is shown in the following figure:
Figure 5-6: Sending the Revised EID to the Control Head (Example)
The control head’s EID is now revised to match the new mounting configuration.

21. Disconnect DC power from the control head, and then disconnect the serial cable.

22. If performing a front-mount to a remote-mount conversion, connect the radio to the control head via the CAN link, power-up both units, and verify basic control head operation. Be sure to terminate the radio’s antenna port with an appropriate antenna or 50-ohm load.
If performing a remote-mount to a front-mount conversion, continue with the hardware conversion procedure presented in Section 5.1.2.

 

[ElroyJetson]

I'm not making much progress. Actually haven't made contact with the radio via hyperterminal using the recommended settings, or any others for that matter.

Anybody got the service manual for this? I took the covers off to take a look and I need to see the manual to be sure I'm interpreting what I see correctly. I'd expect the green SMD devices on the power rail to be fuses (two terminals) but I'm reading 38K across three of the four. My meter is OK. I need to see the manual to verify that they ARE the fuses. If not, find out what they are and where the fuses are.

But if those fuses open I'd expect a completely dead radio. If they are the fuses.

 

[merlin]

I THINK the 7200/5200was the first OMAP product line. Certainly the 7300/5300 is OMAP while the 7100/5100 platform is not.

Come to think of it...the radio I need to recover is actually an M5300. I just remembered that. The only difference is literally the inclusion of option 30 which limits the radio so that it can't do P25 Phase II trunking. It's just a feature-controlled software limitation.

Since there's no Phase II trunking in my area that isn't currently an issue. Some day it might be.

I don't know about the 7200s. The 7300s/OMAP had a dual core arm CPU, The 7100s had the H8, a big difference.
They also went to smart control heads with the 7300 too.

I THINK the 7200/5200was the first OMAP product line. Certainly the 7300/5300 is OMAP while the 7100/5100 platform is not.

Come to think of it...the radio I need to recover is actually an M5300. I just remembered that. The only difference is literally the inclusion of option 30 which limits the radio so that it can't do P25 Phase II trunking. It's just a feature-controlled software limitation.

Since there's no Phase II trunking in my area that isn't currently an issue. Some day it might be.

Sadly, the only documentation I have for the M7300/5300 is a TSM. Lost MRU issue but covers componant failure:

 

[merlin]

If possible, please provide instructions to communicate with the radio via the RS232 rear connector.

Will this require a null modem cable or adapter?

These get iffy. You communicate with the radio in the same manner and setup as with programming.
If that is via RS232, all you need is an RS232 cable, the radio end wired like data communication device (DCE)
If via CAN port, you need the same as programming cable and open can ports terminated.
Even the 7100s using terminal, the connection gets dropped when the radio switches to high speed.
It also changes protocol to RS485, so packets have another level of encapsulation.
Closest I get is connected with terminal, power the radio, and start HDT (on). I get a stream of data showing formatting and info, but too vauge to work with.
I don't know if this works with the 7300s, and XG series did away with that in liew of some odd test mode.