Upgrading your MT2000 from 160 to 255 modes

Changing band limits in all MTSX RSS versions

General Information

Programming cable pinout

Cloning Cable Pinout and Instructions

MTSX Accessory Cable Pinout

Have a look at the MTSX series model breakdown chart

A manual supplement has been released for the MT2000/MTS2000/MTX838 with a new alignment procedure for the front end pre-selector. You can view this bulletin here.

"ToolProof" Error Information

General Information

Both the MTX8000 B5 & B7 models are Type II Trunking. If you are (un)lucky enough you might find an F3 modem that does Type II.

If it is an MTX8000 and has a front mounted display with either a 6 button or full keypad, you have a radio that will do Type II.

There were a few B3's that were Type II produced by Motorola. However, you can clone a Type II code plug into a B3 radio and it will work just fine.

You can run system watch using a MTS2000 handheld. Firmware version has to be above 5.44 (which has a 512k controller in it). Most MTS2000/MTX8000's only have a 256k controller, which will not work. You can put the radio into RF modem mode from the F4-F4-F4 (Trunking Config).

NOTE: When the radio is in the RF MODEM mode, it will do a self test and then the screen will go blank. The radio DOES NOT have to be programed to the system you want to watch. You set SYSTEMWATCH to the Spectra with RIB mode (works best). Even watches Type I systems.

If you have the accessory adapter for the side connector on the radio, the typical schematic of the speaker mic looks like this.

If you are using a Public Safety speaker mic with the radio, you might want to order part number 3205514W01 to cover the antenna connector on the radio.

If you are trying to program a MTX-838, from what we've heard, you need to use the MTSX software. The RVN4097F ver R02.10.01 RSS package specifically shows it programs the following radios: MT/MTS2000 MTX838/8000/9000. Now, the update for this software is RVN4097M R06.00.00 05 Sept 97, which should mean that it should program the radio as well. The cable you need is the standard MTSX programming cable.

Do you want to build your own programming cable? If you don't want to use an old speaker mic cable, see the individual part numbers of the parts for the Service Cable, below.

You may want to look at the schematic for the RKN4035D Service Cable. This is the actual Motorola cable used for programming and servicing these radios.

The individual part numbers for the components of this cable are listed below.

MTSX MVA

MTVA Vehicular Adapter Instruction Manual 6881075C95.

If you have the MTSX Convertacom (MTVA), you will notice that there are two DIP switches located on the bottom rear corner of the MTVA holder. These are used to select whether the microphone you are using has a manual PTT or serial data PTT.

For HMN1035 and HMN1056 microphones, set both dip switches toward the front of the holder. For HMN4044, HMN4047, NMN6209, and NMN6210 microphones, set both dip switches toward the back of the holder.

The pinout of the 6pin power connector on the NTN1340A is:

1   Audio+
2/3 Ground
4   I/P Stage Ground
5   A+
6   Audio Shield

According to the manual the top row is 4 5 6 left to right with a square over pin 5. The bottom row is 3 2 1.

• 6 square
• 5 square with tab over it
• 4 square with rounded bottom shoulders
• 3 square with rounded bottom shoulders
• 2 square with rounded bottom shoulders
• 1 square

Pinouts as they are in the holder unit schematic diagram for the NTN1340A:

The 25 pin connector is listed as J100:

Pin1 --- Green Led
Pin2 --- LH Data
Pin3 --- Tx/Rx Data
Pin4 --- LH Busy
Pin5--- Option B+
Pin6--- Hook
Pin7--- Pac-RT-CTRL
Pin8 --- Bat-RC   
Pin9 --- Bat-RT
Pin10 --- NC
Pin11 --- B+
Pin12 --- NC
Pin13 --- A+
Pin14 --- Red Led
Pin15 --- Data Mode CTRL
Pin16 --- CTS
Pin17 --- Aux Tx RTS
Pin18 --- NC
Pin19 --- Pac-RT
Pin20 --- NC
Pin21 --- NC
Pin22 --- NC
Pin23 --- Gnd
Pin24 --- Gnd
Pin25 --- PA Sense

Connector J104 goes to the Battery Board it's a 10 pin connector, pins are:

Pin1 --- Gnd
Pin2 --- Gnd
Pin3 --- Gnd
Pin4 --- Gnd
Pin5 --- Bat-RC
Pin6 --- Bat-RT
Pin7 --- B+
Pin8 --- B+
Pin9 --- B+
Pin10 --- B+

NOTE: The NTN1340A is NOT a complete MVA if you only have the radio holder portion. You need the control box (with or without integrated power amplifier) that interfaces to the DB25, otherwise that's all you have is a radio holder.

Service Manuals

Here are a listing of the Service Manual part numbers for this series of radios:

• 6881200C15 -- HT1000/JT1000/MT2000 & MTX8000/9000 Radio Theory
• 6881200C40 -- HT1000/JT1000 & MT2000 Service Manual
• 6881200C25 -- MTX8000/9000 Service Manual
• 6881076C65 -- MT2000 Operator's Manual
• 6881072C10 -- MTX8000/9000 B3 Operator's Manual
• 6881072C40 -- MTX8000/9000 B5/B7 Operator's Manual

Error Codes

Below is a list of the Power-up Display Codes and Operational Display Codes that may show up on your MTSX series radio.

Power-up Display Codes:

Operational Display Codes:

Upgrading your MT2000 from 160 to 255 modes

This may be a little too scary for some of you to want to attempt but...

It appears that all A7 model MT2000's are capaple of doing 255 modes rather than the 160 they are shipped with. The problem is getting the radio to do it. I have found one way to do this.

NOTE:There are a couple of things you should be aware of before you undertake this project:

• once you create your own model profile and program your radio, it becomes an individual radio
• you will not be able to program any old saved files you have from this radio into it
• you will not be able to clone this radio to any other "normal" MT2000
• there is no way of going back to a "normal" MT2000 unless you can create a model profile identical to a "normal" MT2000 and program the radio with it
• for each zone you add after 10, you loose one channel (11 zones gives you 254 channels)
• write down the tuning data from the radio before you reprogram it, the reprogramming effort changes tuning data all to default so your radio won't work as well until it is retuned.

An additional note, the Version 4.00 software will let you add modes beyond 160 in the Add Personality screen. I don't know if the software will let you program more than 160 modes into the zone lists though, under the Radio Wide Information the software still reports 160.

What you have to do is get your hands on a copy of the MT2000 LAB RSS. Get the newest version you can. This software will let you create your own model profile and then a blank codeplug. All you need to do is create a model profile (with any model number you want ie. MY_MT2000) and in the Maximum Channels field, enter 255. Set everything else the way you want or think it should be.

Create yourself a blank (default) codeplug and program it into the radio. Load your normal RSS and read the radio. Program it up the way you want and program the radio.

The following information was passed along to me and is a potential hazard if you use LAB RSS and write to the radio (reading is fine):

"ToolProof" Error Information

This is (Service Repair Note) SRN 1173

Date March, 1995

Deadline Date n/a

Memo To SRN Mailing List

From Radio Network Solution Group/Product Services, Plantation

Subject MTS2000 Programming Sources - Unauthorized Tool Usage

Symptoms Radio Inoperative Error 01/93

Potential Problem Radios MTS2000 Models Only with firmware 5.42 or greater

Cause Implementation of Toolproofing in release 5.42 and greater

Motorola has been shipping FLASHport software upgrades on the MTS2000 radio since September of 1994. To date, 9,000 units have been upgraded in the field. To protect against illegal software copying and/or radio upgrades, Motorola is implementing "TOOLPROOFING" into the MTS2000 radio at the Florida factory beginning 2/27/95.

The result is many existing upgrade tools (PCON Plus, Depot RSS, Lab RSS, etc.) will no longer work with the MTS2000 radio. If these tools are used with MTS2000 radios that ship after the 2/27/95 date, the radio will fail upon power up. Any questions that arise as a radio fails to power up should be directed to Florida Product Services for diagnosis and further instructions. The number is 1-800-523-4007. Once an issue is diagnosed with the TOOLPROOFING as the violation, the individual will be instructed to send the radio(s) into the nearest depot location, where the "FLASHport depot tool" will be used.

Corrective Action

All Motorola owned Depots and International Regional Support Centers (RSC s) will be equipped with a FLASHport depot tool . This proprietary tool will ONLY be distributed to the National Subscriber Depot in Schaumburg, the Florida Regional Support Center, and 18 previously established International Regional Support Centers Worldwide who have signed license agreements not to copy or distribute the tool. This new tool will have the capability to reprogram as required to perform repairs.

This bulletin is for information only, no warranty is implied.

Toolproof Explanation

Now, above is the official explanation of the toolproof situation and its rectification. What follows below is what we have been told is the way this silly protection scheme is implemented.

First, a little info on the structure of the MTSX series codeplug.

In its native format (the format that is actually dumped to the radio), the codeplug file is actually a standard Motorola S-record. It is unpacked from the archive file format and converted to an s-record which is stored in memory when the codeplug is read from disk. When the codeplug is written to disk, the s-record is packed and converted to the archive file that is stored.

The native codeplug is a list of blocks or records. The first block/record begins at address 0000h of EEPROM space. The format of each block/record follows the general s-record format:

S<TYPE><LENGTH><ADDRESS><DATA....><CHECKSUM>

S-RECORD CONTENT

S-Records are character strings made of several fields which specify the record type, record length, memory address, data, and checksum. Each byte of binary data is encoded as a 2-character hexadecimal number: the first ASCII character representing the high-order 4 bits, and the second the low-order 4 bits of the byte.

The 5 fields which comprise an S-record are defined as follows:

Field		Characters	Description
1	Type	2	S-record type - S1 or S9.
2	Record length	2	The count of the character pairs in the record, excluding the type and record length (in bytes).
3	Address	4	The 2-byte address at which the data field is to be loaded into memory.
4	>Data	0-2n	From 0 to n bytes of executable code, or memory loadable data. n is normally 20 hex (32 decimal) or less.
5	Checksum	2	The least significant byte of the one's complement of the sum of the values represented by the pairs of characters making up the record length, address, and data fields (One's complement of the length, address and data fields modulo 256 minus 1).

Each record is terminated with a CR/LF/NULL. Accuracy of transmission is ensured by the record length (byte count) and checksum fields.

Some specific info relating to the radio's codeplug:

• The block type (S1) refers to 'InternalCodeplugRootBlock'
• The data is radio parameters defined by various tools like Lab, Factory test and tuning equipment, RSS and others. Also contains pointers to linked Blocks (ie. ExternalCodepluRootBlock).

Now, on to toolproofing...

• It is available only on open architecture controllers (with flash memory).
• It checks if the codeplug and the FLASH platform were created together (that they are syncronized).

Internal codeplug block 01 contains a 9 byte fingerprint record, which is calculated as the result of Encryption(FlashSignature, ModelNumber, SerialNumber, HardwareDefinitionVector, FlashCodeVector). The Encryption() function is similar to ordinary DES.

On power up, the radio always calculates the current fingerprint of the radio, and this value is compared to the 9 bytes stored in the codeplug.

So, if anything changed in internal codeplug (model, serial, Hvector, FlashCode, fingerprint itself) the radio will display the dreaded error message 'F01/93' and execute ROS_Idle (ROS means Radio Operating System).

The important thing at this state, the ROS is able to communicate with the external world using serial bus, so, if you have codeplug image from THIS radio, you will be able to put it back (by labtool for example) any time and resume normal operation.

NOTE: THERE IS NO TOOL CAPABLE OF CREATING A GOOD CODEPLUG, EXCEPT THE FACTORY ROBOT! There is some field software like LABTOOLS, but they can create WORKING codeplug, not GOOD one. The radio will be operational with such a codeplug, but someone will need to spend hours with test equipment tuning this radio to meet the specifications and adjust hundreds of settings to have all the specs in their type-approval window for the specified temperature and battery level range. Field Labtools do not support toolproof radios. Of course this fine tuning can be omitted if the radio used for HAM radio purposes.

"Fixing" or Recovering From a Toolproof

To properly backup a MTSX radio before attempting to hack it with lab perform the following:

USE LAB SOFTWARE FOR BACKING UP THE RADIO! Conventional RSS will NOT back up a radio like was previously thought!

• From the Main menu select F3>F4>F2 to read the radio with no unpack
• From the Main menu select F3>F6 to Write S-Record


• Type in a unique name ending in &guot;.bin" so as to not mistake it for anything else
• Then press F6 to write the archive.

**GUARD THIS IMAGE FILE WITH YOUR LIFE!** It saves you $300 and a very tough explanation to Motorola if something goes wrong!

This doesn't unpack the codeplug, rather what you have stored on disk is a raw binary image of the radios codeplug, internal and external. That way, if something goes drastically wrong when you are hacking later, and you get the dreaded FAIL 01/93, you can use the procedure below to dump the raw image back to the radio to restore it.

You cannot edit this codeplug from memory. As far as the RSS is concerned you did not load a codeplug BUT the information is there. In order to edit a codeplug using RSS, the codeplug has to be unpacked and we bypassed that step so that the RSS won't hose things up.

Now, if you do screw up your radio and end up with FAIL 01/93, simply do the following to restore it:

• From the Main menu select F3>F6
• Type in the filename given to your image from step 2 above
• Then press F2 to read the archive without unpack. If you read with unpack you will still end up with FAIL 01/93
• From the Main menu select F3>F4>F8>F8 to write the radios internal and external codeplug
• When this is done, the radio will reset and come up just as it was when you made the image

This procedure has been performed several times successfully.

It is safe to say that trying to do anything with a toolproofed radio in Lab is useless. These methods should be able to protect one from screwing up their radio if they want to try to circumvent the toolproofing. I'm sure there are persons out there that may be able to.

Changing band limits in all MTSX RSS versions

Grab yourself a good hex editor like Hex Workshop.

Open the MTSX.ODB file.

Search for the ASCII text string of one of your band limits (ie 136). This should get you to a list like this:

000177F0 9C 78 01 00 08 00 08 00 0D 00 22 22 31 33 36 20 2D 20 31 37 .x........""136 - 17
00017804 38 20 4D 48 7A 39 01 00 0D 00 22 22 34 30 33 20 2D 20 34 37 8 MHz9....""403 - 47
00017818 30 20 4D 48 7A 3A 01 00 0D 00 22 22 34 35 30 20 2D 20 35 32 0 MHz:....""450 - 52
0001782C 30 20 4D 48 7A 3B 01 00 0D 00 22 22 38 30 36 20 2D 20 38 37 0 MHz;....""806 - 87
00017840 30 20 4D 48 7A 3C 01 00 0D 00 22 22 38 32 35 20 2D 20 39 31 0 MHz<....""825 - 91
00017854 35 20 4D 48 7A 3D 01 00 0D 00 22 22 38 39 36 20 2D 20 39 34 5 MHz=....""896 - 94
00017868 31 20 4D 48 7A 3E 01 00 0D 00 22 22 31 2E 30 20 2D 20 31 2E 1 MHz>....""1.0 - 1.
0001787C 36 20 47 48 7A 3F 01 00 0D 00 22 22 31 2E 35 20 2D 20 32 2E 6 GHz?....""1.5 - 2.
00017890 30 20 47 48 7A 40 01 00 20 00 22 22 FC 77 01 00 10 78 01 00 0 GHz@.. ."".w...x..

Notice these are all the different bandsplits. Find yours and edit it to what you want.

Next you will have to find the actual frequency limits for the radio and change these as well. If you look further down in the file you should see a few lists like:

00017E1C 08 00 08 00 08 00 22 22 38 32 34 2E 39 38 37 35 08 00 22 22 ......""824.9875..""
00017E30 39 30 31 2E 39 38 37 35 01 00 22 22 30 00 00 00 06 00 22 22 901.9875..""0.....""
00017E44 30 2E 30 30 30 30 00 00 06 00 22 22 30 2E 30 30 30 30 00 00 0.0000....""0.0000..
00017E58 06 00 22 22 30 2E 30 30 30 30 00 00 06 00 22 22 30 2E 30 30 ..""0.0000....""0.00
00017E6C 30 30 11 11 08 00 22 22 38 32 31 2E 39 38 37 35 20 00 22 22 00....""821.9875 .""
00018164 60 81 01 00 C4 81 01 00 07 00 07 00 08 00 22 22 38 35 31 2E `.............""851.
00018178 30 31 32 35 08 00 22 22 39 33 35 2E 30 31 32 35 01 00 22 22 0125..""935.0125..""
0001818C 30 69 01 00 08 00 22 22 31 33 36 2E 30 30 30 30 08 00 22 22 0i....""136.0000..""
000181A0 34 30 33 2E 30 30 30 30 08 00 22 22 34 35 30 2E 30 30 30 30 403.0000..""450.0000
000181B4 08 00 22 22 38 32 35 2E 30 30 30 30 1C 00 22 22 74 81 01 00 ..""825.0000..""t...
000182E0 3C 83 01 00 07 00 07 00 08 00 22 22 38 30 36 2E 30 31 32 35 <.........""806.0125
000182F4 08 00 22 22 38 39 36 2E 30 31 32 35 01 00 22 22 30 00 00 00 ..""896.0125..""0...
00018308 08 00 22 22 31 33 36 2E 30 30 30 30 08 00 22 22 34 30 33 2E ..""136.0000..""403.
0001831C 30 30 30 30 08 00 22 22 34 35 30 2E 30 30 30 30 08 00 22 22 0000..""450.0000..""
00018330 38 32 35 2E 30 30 30 30 1C 00 22 22 EC 82 01 00 F8 82 01 00 825.0000..""........
0001845C 58 84 01 00 BC 84 01 00 07 00 07 00 08 00 22 22 38 35 31 2E X.............""851.
00018470 30 31 32 35 08 00 22 22 39 33 35 2E 30 31 32 35 01 00 22 22 0125..""935.0125..""
00018484 30 00 00 00 08 00 22 22 31 33 36 2E 30 30 30 30 08 00 22 22 0.....""136.0000..""
00018498 34 30 33 2E 30 30 30 30 08 00 22 22 34 35 30 2E 30 30 30 30 403.0000..""450.0000
000184AC 08 00 22 22 38 32 35 2E 30 30 30 30 1C 00 22 22 6C 84 01 00 ..""825.0000..""l...
000185D8 40 86 01 00 08 00 08 00 08 00 22 22 38 36 39 2E 39 38 37 35 @.........""869.9875
000185EC 08 00 22 22 39 34 30 2E 39 38 37 35 03 00 22 22 30 2E 30 11 ..""940.9875..""0.0.
00018600 08 00 22 22 31 37 38 2E 30 30 30 30 08 00 22 22 34 37 38 2E ..""178.0000..""478.
00018614 30 30 30 30 08 00 22 22 35 32 30 2E 30 30 30 30 08 00 22 22 0000..""520.0000..""
00018628 39 32 30 2E 30 30 30 30 08 00 22 22 38 36 36 2E 39 38 37 35 920.0000..""866.9875
0001863C 20 00 22 22 E4 85 01 00 F0 85 01 00 FC 85 01 00 04 86 01 00  .""................

If you try and enter an invalid frequency in the RSS you will get a warning in the upper right box on the screen informing you of the legal band limits for your radio. This is where those limits are stored. Change them as required for your radio and you should be able to enter any frequency you want (no guarantees that it will actually transmit or receive there though).

Converting a B5 to B7 (C7)

Well, it looks like so far, the only way to convert a MTX B5 or B7 into a MTS C7 is to use Lab RSS. You need to read an archive for a MTS C7 and program it into the MTX.

Just remember to beware of the Toolproofing error...

If you are creating a codeplug from scratch with Lab/Depot RSS, you need to ensure the following options are set:

In the "Config, Features, Buttons, Lab" menu (page 1), set the following:

In the "Config, Features, Buttons, Lab" menu (page 2), set the following:

In the "Labtool, Labtool Config 2, Radio Wide", menu, set the following:

Remember, if you are creating a codeplug from scratch, you will need to do a fill service alignment after programming the radio.

If you have any questions, email us and we'll try to help.

Home