BCD996P2 Photos and Technical Discussion

Status
Not open for further replies.

Nessus

Member
Joined
Oct 5, 2011
Messages
28
This is a request for photos of the internals of BCD996P2. In order to get an idea what is needed, please take a look at the photos located here:

http://forums.radioreference.com/voice-control-channel-decoding-software/113335-unitrunker-p25-raw-signal-must-filtered-2.html#post2395013

and here:

Index of /files/photo/996xt

The former set (Showing the CPU ecosystem) will likely require removal of the Metal RF Shield that is over top of the BCD996P2 CPU. This should only be attempted if you have previous experience. (Skill Level: Solder Sucker Wizard). If done correctly, the shield can be replaced with very little effort and zero damage after the photo shoot is completed. If you succeed, please record the numbers on each device under the shield, as shown in the first photo set linked above.

We are trying to answer three questions:

1) What is the processor used in BCD996P2?
2) Is the discriminator a PLL, a full I-Q mixer demodualtor, or something else?
3) Is the USB interface driven directly by the uP, or is there a USB controller?

High level problem statement: We would like to understand effort required to add P25 Phase-II to a BCD996XT. If members of the owner community are interested, we would like to develop a modiication kit that could breath new life into this venerable product.

If Mr. Opitz would be able to shed more light on the two quotes below, or answer the questions above, that would also be helpful, and greatly appreciated by the community of exising BCD996XT owners:

Upgrade from XT: Would cost around $499 to do such an upgrade (parts + labor, which would be significant). You'd have to replace the front panel, front port, entire PCB that includes all RF and logic circuits...
The RF design is identical to the BCD996XT. The only changes are as mentioned in the announcement post.
In other words if the RF section is the same, then presumably that part of the PCB could remain the same. If the processor is the same, there also. With the exception of the USB Port, the display and front panel seem the same to us.

Specific questions for Uniden:

1) Is there an IQ Demodulator in BCD996P2 that is different from the FM Demodualtor in BCD996XT?
2) Is the processor on the BCD996P2 a Mitsubishi 32186F8?
3) Is there now a USB controller on the BCD996P2 PCB?)
 

DaveIN

Founders Curmudgen
Database Admin
Joined
Jan 5, 2003
Messages
6,514
Location
West Michigan
While I love your idea of a retrofit kit you may have not thought it through or maybe your just hoping for a change of position from Uniden about the XT update. First, you would need a license for the P25 Phase II vocoder and the code embedded in the firmware of the BCD996P2 to be able to decode to analog voice. A huge problem unless you have the capitol and knowledge, not to mention the engineering and software team to support such an endeavor. Best of luck to you. Please keep us up to date on your progress.
 

XTS3000

Member
Joined
Nov 4, 2005
Messages
1,082
Upman said it would cost $499 to upgrade. I'd rather just buy an new P2 996, that way I'd still have the XT as a spare (and a rather nice spare scanner)
 

KA1RBI

Member
Joined
Aug 15, 2008
Messages
504
Location
Portage Escarpment
We are trying to answer three questions:

2) Is the discriminator a PLL, a full I-Q mixer demodualtor, or something else?
This is not something that can be determined by external visual inspection. As previously mentioned, for P25 it is sufficient simply to digitise the IF signal (once the IF signal has been converted to a low enough frequency range that it can be digitised). Once the IF signal exists in the digital domain it can be rendered into an I/Q format (if desired); for example, by applying a Hilbert transform. There is no specific, identifiable hardware component that would be different ...

Quiz: if the function described above is done in software / firmware, what would look different from the outside?

DaveIN said:
First, you would need a license for the P25 Phase II vocoder and the code embedded in the firmware of the BCD996P2 to be able to decode to analog voice.
Both IMBE and AMBE+2 use the same vocoder. The differences are in the compression and parameter quantization, which are conceptually layered on top of the actual codec. There is a full implementation of P25 Phase II RX in OP25, parts of which are based on library code from DSD.

A huge problem unless you have the capitol and knowledge, not to mention the engineering and software team to support such an endeavor.
Having done this personally, I can attest it's not a big deal. OP25 as an example was developed by volunteers in spare time, and this includes the complex-constellation demodulator that has apparently so far eluded the scanner manufacturers.

With all the capitol [sic] and knowledge possessed by the commercial engineering and software teams of the scanner manufacturers, how do you explain the following ? :

A couple things - first off, my 436HP still struggles with simulcast issues at times (it's much better than previous scanners though), whereas OP25 might add a squeak or two to the audio, but other than that it keeps right on going.
Max
 

DaveIN

Founders Curmudgen
Database Admin
Joined
Jan 5, 2003
Messages
6,514
Location
West Michigan
Both IMBE and AMBE+2 use the same vocoder. The differences are in the compression and parameter quantization, which are conceptually layered on top of the actual codec. There is a full implementation of P25 Phase II RX in OP25, parts of which are based on library code from DSD.
I'm not positive Max, but I suspect the codic is hard coded and can't be changed without physically removeing and replacing the vocoder in the scanner. Something that would drive the cost of a "retrofit kit". Don't forget the licensing fee for the codec.

Having done this personally, I can attest it's not a big deal. OP25 as an example was developed by volunteers in spare time, and this includes the complex-constellation demodulator that has apparently so far eluded the scanner manufacturers.
With your background and knowledge perhaps you could team up with Nessus.

With all the capitol [sic] and knowledge possessed by the commercial engineering and software teams of the scanner manufacturers, how do you explain the following ? :
Well, for one thing the scanner is made for the consumer market, not a system radio user, and not specific to one simulcast system. Maybe if you spent the money needed to purchase a P25 capable scanner and the money that would be spent for the retrofit kit you could afford a system specific radio that may not work well in all zones of that particular simulcast system and it could possibly solve the issue in receiving CQPSK multi-phasing?

I'm sure this is all baloney to you :twisted:
 

Nessus

Member
Joined
Oct 5, 2011
Messages
28
I'm not positive Max, but I suspect the codic is hard coded and can't be changed without physically removeing and replacing the vocoder in the scanner. Something that would drive the cost of a "retrofit kit". Don't forget the licensing fee for the codec.
Hello DaveN. The P25 IMBE CODEC (Actually it is just the DECoder) is in the BCD996XT firmware. There is no hardware CODEC for IMBE on the BCD996XT. The IMBE coDEC in BCD996XT can be updated at will. I have provided the evidence here:

http://forums.radioreference.com/voice-control-channel-decoding-software/113335-unitrunker-p25-raw-signal-must-filtered.html#post2394399

This does leave one to wonder why Uniden blobbed black epoxy at key locations on the Main Circuit Board. Furthermore, the microprocessor port pins that are under that epoxy are driven by obfuscated firmware that constructs a several weird patterns in RAM (that I have not been able to elicit the purpose of,) and then streams these patterns out these ports using DMA.

Wouldn't it be cool if there was a way to make an inexpensive in-circuit-emulator and debugger for the BCD996XT? Then we could single-step the code with breakpoints, see what it was up to, and form a group of developers that could expand the function of this far-from-dead development platform. Of course this is impossible.

Regarding the IMBE license, the BCD996XT comes with an implied license. Probably one of the reasons it is priced Higher Than Your Average Bear(cat)...See what I did there?

N.
 

Voyager

Member
Joined
Nov 12, 2002
Messages
12,055
The blobs are there by FCC mandate to protect against people doing what you are proposing (albeit with other digital modes).
 

DaveIN

Founders Curmudgen
Database Admin
Joined
Jan 5, 2003
Messages
6,514
Location
West Michigan
Hello DaveN. The P25 IMBE CODEC (Actually it is just the DECoder) is in the BCD996XT firmware. There is no hardware CODEC for IMBE on the BCD996XT. The IMBE coDEC in BCD996XT can be updated at will. I have provided the evidence here:



http://forums.radioreference.com/voice-control-channel-decoding-software/113335-unitrunker-p25-raw-signal-must-filtered.html#post2394399



This does leave one to wonder why Uniden blobbed black epoxy at key locations on the Main Circuit Board. Furthermore, the microprocessor port pins that are under that epoxy are driven by obfuscated firmware that constructs a several weird patterns in RAM (that I have not been able to elicit the purpose of,) and then streams these patterns out these ports using DMA.



Wouldn't it be cool if there was a way to make an inexpensive in-circuit-emulator and debugger for the BCD996XT?



Regarding the IMBE license, the BCD996XT comes with an implied license. Probably one of the reasons it is priced Higher Than Your Average Bear(cat)...See what I did there?



N.

Wow. Yea... Cool. So, when will we see the fruits of your labor again? Still waiting for results. You'll still need to reverse engineer it to make it work. Best of luck.
 

DaveIN

Founders Curmudgen
Database Admin
Joined
Jan 5, 2003
Messages
6,514
Location
West Michigan
Oh, by the way, it looks like the latest firmware for the next gen P2 radios are a little different. I suspect this will also keep the XT models from getting any new "major" firmware update, so perhaps your work would be for not.
 

Nessus

Member
Joined
Oct 5, 2011
Messages
28
Oh, by the way, it looks like the latest firmware for the next gen P2 radios are a little different. I suspect this will also keep the XT models from getting any new "major" firmware update, so perhaps your work would be for not.
Hi DaveN,

I do not understand what you are saying. I am saying that I would like to understand how to modify an 996XT to become a 996P2. The firmware load file for the 996 P2 has different format, if that is what you mean. It is a raw encrypted binary, whereas the 996XT firmware file is a Motorola S-Record format file containing an encrypted binary. Furthermore, the encryption method used for the 996P2 is more sophisticated than the encryption on the 996XT. But it still has flaws. :)

I previously said

http://forums.radioreference.com/voice-control-channel-decoding-software/113335-unitrunker-p25-raw-signal-must-filtered-2.html#post2395013

that I was unable to locate any evidence that a BCD996P2 had undergone FCC certification. I checked again today, and still no evidence of this as far as I can ascertain.

OET -- FCC ID Search

Grantee code: AMW
Wildcard for product code: UB37, or UB38

Or use advanced search and "UB" as the wildcard, and download 490 records into a spreadsheet...

Finally, a similar search on the Canadian Equivalent of FCC registration turns up something VERY curious:

https://sms-sgs.ic.gc.ca/equipmentSearch/searchRadioEquipments

Use the following wildcard in the certification field:

513C-UB

Adjust number of fields displayed per page to 100. Do you see what I see?

...Something is rotten in the state of Denmark my friend, and I intend to get to the bottom of it.
 

PiccoIntegra

Member
Joined
Dec 19, 2002
Messages
528
Location
North Texas
I am saying that I would like to understand how to modify an 996XT to become a 996P2.
This is not possible. The CPUs are not the same, completely different. The XT has the M32R series, and the P2 has the RX631(?). RX series none the less..

The firmware load file for the 996 P2 has different format, if that is what you mean. It is a raw encrypted binary, whereas the 996XT firmware file is a Motorola S-Record format file containing an encrypted binary. Furthermore, the encryption method used for the 996P2 is more sophisticated than the encryption on the 996XT. But it still has flaws. :)
You would need physical access to a 996P2 to obtain the encryption key/tables. You won't figure this out by trial and error.


that I was unable to locate any evidence that a BCD996P2 had undergone FCC certification.
The RF section of the two scanners(996XT and 996P2) are identical, which is why the radio didn't have to be certified.

...Something is rotten in the state of Denmark my friend, and I intend to get to the bottom of it.
"I just want to say, good luck.. we're all counting on you" -Capt. Over
 
Status
Not open for further replies.
Top